Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 1 of 21
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE TWITTER
ACCOUNTS

)
)
)
)
)
)

Case No.

17-MJ-567

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 21, 2017
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose

property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

Washington, D.C.

Hon. Beryl A. HoweJL,,-Chief U.S. District Judge
· Printed name and title

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 2 of 21

ATTACHMENT A
Property to Be Searched

This warrant applies to information associated with the Twitter profile with usemarnes:

that is stored at premises owned, maintained, controlled, or operated by Twitter, a company
headquartered in San Francisco, California.

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 3 of 21

ATTACHMENT B
Particular Things to be Seized
I.

Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the
government for each account listed in Attachment A:
a.

All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers;

b.

All past and current usernames, account passwords, and names associated with
the account;

c.

The dates and times at which the account and profile were created, and the
Internet Protocol ("IP") address at the time of sign-up;

d.

All IP logs and other documents showing the IP address, date, and time of each
login to the account;

e.

All data and information associated with the profile page, including photographs,
"bios," and profile backgrounds and themes;

f.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 4 of 21

g.

All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account

(i.e., "mentions" or "replies");
h.

All photographs and images in the user gallery for the account;

1.

All location data associated with the account, including all information collected
by the "Tweet With Location" service;

J.

All information about the account's use of Twitter's link service, including all
longer website links that were shortened by the service, all resulting shortened
links, and all information about the number of times that a link posted by the
account was clicked;

k.

All data and information that has been deleted by the user;

I.

A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user's "following" list and "followers" list);

m.

A list of all users that the account has "unfollowed" or blocked;

n.

All "lists" created by the account;

o.

All information on the "Who to Follow" list for the account;

p.

All privacy and account settings;

q.

All records of Twitter searches performed by the account, including all past
searches saved by the account;

r.

All information about connections between the account and third-party websites
and applications;

2

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 5 of 21

s.

All records pertaining to communications between Twitter and any person
regarding the user or the user's Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.

3

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 6 of 21

II.

Information to be seized by the government
All information described above in Section I that constitutes fruits, evidence, and

instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection
with computers) involving since March 1, 2016 including, for each user ID identified on
Attachment A, information pertaining to the following matters:
a. Any correspondence regarding hacked emails or other data from the
Democratic National Committee (DNC) and the email belonging to John
Podesta ("the email hack");
b. Any communications between the Target Accounts and individuals
associated with the email hack;
c. Any communications indicating any advance knowledge or direction,
planning, or control of the email hack;
d. Evidence indicating how and when the Twitter account was accessed or used,
to determine the chronological and geographic context of account access, use,
and events relating to the crime under investigation and to the Twitter account
owner;
e. Evidence indicating the Twitt~r account owner's state of mind as it relates to
the crime under investigation;
f.

The identity of the person(s) who created or used the user ID, including
records that help reveal the whereabouts of such person(s).

g. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.
4

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 7 of 21
AO 106 (Rev. 04/10) Application fora Search Warrant

UNITED STATES DISTRICT COURT

FILED

for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE TWIITER
ACCOUNTS

)
)
)
)
)
)

AUG -7 2017
Clerk, U.S. District and
Bankruptcy Courts

Case No. 17-MJ-567

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A.
located in the - - Northern
California
- - - - - District of - - - - - - - - - - - , there is now concealed (identify the
person or describe the property to be seized):

See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;

~ contraband, fruits of crime, or other items illegally possessed;
(y{ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. § 1030

Offense Description
Fraud and Related Activities in Connection with Computers

The application is based on these facts:
See attached Affidavit.

'J Continued on the attached sheet.
0 Delayed notice of_.__ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
IAaron Zelinsky (ASC)

~ p p U r o n t ' , ,ignatu,e

]

Mickey Robinson, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

08/07/2017
Judge's signature

City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 8 of 21

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH THE

FILED
AUG -7 2017
Clerk, U.S. District and

Case No. 17-MJ-569

B8nkruptcy Courts

Filed Under Seal

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Mickey Robinson, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the Twitter Accounts
1") and

(hereafter "Target Account

(hereafter "Target Account 2") and that is stored at premises owned,

maintained, controlled, or operated by Twitter, a social-networking company headquartered in
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(1 )(A).
2.

I am a Special Agent with Federal Bureau oflnvestigation ("FBI") assigned to

FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2012. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to foreign intelligence services national security investigations, as well as
federal financial crimes. I have conducted and participated in various investigations involving
multiple threat countries as well as national security threats and applicable criminal violations.

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 9 of 21

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that certain individuals with whom Target Account 1 was in
communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in
connection with computers), and that communications related to these violations will be found
on the Target Accounts. There is therefore probable cause to search the information described
in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as
described in Attachment B.
JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraphs 6, 20, and 28.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
Disseminate Hacked Information.
6.

According to the public and unclassified intelligence report conducted by the

United States Intelligence Community, the Russian military intelligence (General Staff Main
2

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 10 of 21

Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
7.

The public and unclassified intelligence report assessed that the GRU used a

Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Interactions with Guccifer 2.0 and Wikileaks.
8.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign.
9.

As discussed further below, Stone made a number of public references to

Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
Twitter with Guccifer 2.0.
10.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC

3

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 11 of 21

hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
11.

On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from

the DNC.
12.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
13.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.

4

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 12 of 21

14.

[Target

On August 12, 2016, Guccifer 2.0 publicly tweeted:

Account 1] thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released
the personal cellphone numbers and email addresses from the files of the Democratic
Congressional Campaign Committee (DCCC).
15.

On August 13, 2016, Stone posted a tweet using Target Account 1 calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
16.

On August 14, 2016, Stone sent a private message on Twitter using Target

Account 1 to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle reinstated
after having been suspended. 1
17.

On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating:

"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
interesting in the docs I posted."
18.

On August 16, 2016, Stone sent a private message using Target Account 1

asking Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016
presidential elections.
19.

On August 17, 2016, Guccifer 2.0 publicly tweeted,

[Target

Account 1] paying you back." Guccifer also sent a private message to Target Account 1 stating
"i 'm pleased to say u r great man. please tell me if I can help u anyhow. it would be a great
pleasure to me."

1

These messages were release by Stone on March I 0, 2017, as described further below in paragraph 28.

5

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 13 of 21

20.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
that investigators were also examining the Podesta Group.
21.

On August 21, 2016, using Target Account 1, Stone directed a tweet at John

Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
22.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
23.

On Saturday, October 1, 2016, using Target Account 1, Stone Tweeted,

"Wednesday@HillaryClinton is done. #Wikileaks."
24.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
6

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 14 of 21

balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of Wikileaks' 1O,..year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
· used Target Account 1 to tweet: "Payload coming. #Lockthemup."
25.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
26.

Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
27.

Wikileaks continued to release John Podesta's hacked emails throughout October

10-14, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 CSPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."

7

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 15 of 21

28.

On March 10, 2017, Stone spoke with The Washington Times and acknowledged

he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.

29.

On or about May 12, 2017, United States Magistrate Judge Michael S.

Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b)
requiring Twitter to disclose certain records, including subscriber and user activity information,
associated with the Target Accounts described above (Case number 17-GJ-0835). On or about
May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts
are registered to Stone.
30.

As described above, it appears that Stone has used the private messaging function

of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience
that individuals with multiple accounts on the same service, such as Stone has on Twitter, often
use both accounts for their communications. A review of Target Account 2's publicly available
information indicates that it has been in use since November 2015. Stone also appears to
comment using Target Account 2 frequently. Stone also often publicly "Retweets" messages
using Target Account 2 which originated from Target Account 1. Therefore there is probable
cause to believe that messages pertaining to the investigation, including messages to individuals
regarding the hack, as well as communications with Guccifer 2.0, will be found on Target
Account 1 and Target Account 2.
INFORMATION CONCERNING TWITTER

8

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 16 of 21

31.

Twitter owns and operates a free-access social-networking website of the same

name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
described in more detail below.
32.

Upon creating a Twitter account, a Twitter user must create a unique Twitter

username and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.
33.

Twitter asks users to provide basic identity and contact information, either during

the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
34.

A Twitter user can post a personal photograph or image (also known as an

"avatar") to his or her profile, and can also change the profile background or theme for his or her
account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.

9

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 17 of 21

35.

Twitter also keeps IP logs for each user. These logs contain information about the

· user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
36.

As discussed above, Twitter users can use their Twitter accounts to post "Tweets"

of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. TwiUer users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
of all "mentions" and "replies" for that username ).
37.

Twitter users can include photographs or images in their Tweets. Each Twitter

account also is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
38.

Twitter users can also opt to include location data in their Tweets, which will

reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.
39.

When Twitter users want to post a Tweet that includes a link to a website, they

can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
40.

A Twitter user can "follow" other Twitter users, which means subscribing to

those users' Tweets and site updates. Each user profile page includes a list of the people who are
10

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 18 of 21

following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously

followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
41.

In addition to posting Tweets, a Twitter user can also send DMs to one of his or

her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the inboxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
are stored on Twitter' s database.
42.

Twitter users can configure the settings for their Twitter accounts in numerous

ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
will not be sent to the user's phone.
43.

Twitter includes a search function that enables its users to search all public

Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.

11

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 19 of 21

44.

Twitter users can connect their Twitter accounts to third-party websites and

applications, which may grant these websites and applications access to the users' public Twitter
profiles.
45.

If a Twitter user does not want to interact with another user on Twitter, the first

user can "block" the second user from following his or her account.
46.

In some cases, Twitter users may communicate directly with Twitter about issues

relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, a:s well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
from using Twitter' s services.
47.

As explained herein, information stored in connection with a Twitter account may

provide crucial evidence of the "who, what, why, when; where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, profile contact information, communications,
"tweets" (status updates) and "tweeted"photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
12

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 20 of 21

used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
automatically added to "tweeted" communications. This geographic and timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal
evidence from law enforcement).
48.

Therefore, the computers of Twitter are likely to contain all the material described

above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information.
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED
49.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
13

 Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 21 of 21

particularly described in Section I of Attachment B. Upon receipt of the information described in
Section I of Attachment B, government-authorized persons will review that information to locate
the items described in Section II of Attachment B.
CONCLUSION

50.

Based on the forgoing, I request that the Court issue the proposed search warrant.

51.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING

52.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

Special Agent
Federal Bureau of Investigation

-z-~

Subscribed and sworn to before me on this _1_ day of August, 2017.

Th~i11:t~
Chief United States District Judge

14

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 1 of 23
AO 93 (Rev. 11/ 13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District ofC'" 111 mhi"
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE EMAIL
ACCOUNT

)
)
)
)
)
)

Case: 1: 17-mj-00661
Assigned To : Howell, Beryl A
Assian. Date : 9/11 /201 7
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location) :

See Attachment A.

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B.

YOU ARE COMMANDED to execute this warrant on or before
September 25, 2017
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

~ in the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
Hon. Beryl A. Howell
as required by law and promptly return this warrant and inventory to
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

~~
Washington, DC

/~

4?/ l@//:~;f-lJ
....1--_--c-P-~_,'--'-- -'~d
~ '--=--~'--~- - - -~/uc1ge,; signature

- -- -- - -- -- -- - -

Hon . Beryl A. Howell , Chief U.S. District Judge
Printed name and title

-

 Case Document 29-2 Filed 04/28/20 Page 2 of 23

A0 93 (Rev. 11!] 3) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date 

 

 

Executing o?icer ?s signature

 

Printed name and title

 

 

 

Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 3 of 23
AO 106 (Rev. 04/ 10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE EMAIL
ACCOUNT

)
)
)
)

)
)

SEP ~ 1 2017
Cterk. U.S. Dis,,:;·! & 1]ank1•Jlltc,
. Courts for t~e o:r.t•i,;t of Go!u.1i1;1la

Case: 1: 17-mj-00661
Assigned To : Howell. Beryl A.
Assian . Date . 9/1 11201 7
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the

- - -Northern
-----

District of

person or describe the property to be seized):

- - - - -California
- - - - - - - , there is now concealed (identify the

See Attachment B
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a) , 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 4 l (c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed fo r use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section
18 U.S .C. § 1030;

Offense Description
Fraud and related activities in connection with computers

18 U.S.C. § 371

Conspiracy to commit an offense against the United States

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ __ _ ) is requested
under 18U.S.C.§3 103a, the basis of which is set fo on the attached sheet.

Reviewed by AUSA/SAUSA:
IAaron Zelinsky {AS9

Amy Anderson , Special Agent. FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

09/11/2017

(il11,' J,o,11>1
Judge's signature

City and state: Washington, D.C.

Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 4 of 23

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

SEP 11 2017
C!er~·. 'v.,
I: "\ r s" ;n,
1.-l ,r,.,, & ..,ankru;:itny
Ct ur··'o
~ "
"' r 1·1" ' n·
• ,nt,-', ·1 or· Co 1u ' I
:-"I

IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIATED WITH THE
EMAIL ACCOUNT

. v

-

"

',

'

Case No.
Filed Under Seal

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Email Account

(hereafter the "Target

Account"), that is stored at premises owned, maintained, controlled, or operated by Microsoft

Corp. , d/b/a Hotmail, an email provider headquartered at One Microsoft Way, Redmond, WA
98052 (hereinafter "Microsoft"). The information to be disclosed by Microsoft and searched by
the Government is described in the following paragraphs and in Attachments A and B. This
affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a),
2703(b)( l)(A), and 2703(c)(l)(A).
2.

I am a Special Agent with Federal Bureau of Investigation ("FBI") assigned to

FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.
I have conducted and participated in various investigations involving multiple threat countries as
well as national security threats and applicable criminal violations.

mo a

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 5 of 23

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers) and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States). As set forth below,
Roger Stone used Twitter' s private direct messaging function to message Wikileaks, Julian
Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to disseminate hacked
information. Stone also repeatedly used Twitter' s private direct messaging function to instruct
individuals to email him on the Target Account to continue conversations begun on Twitter' s
private direct messaging system. These conversations included discussion of information related
to the Campaign and potential derogatory information concerning a presidential candidate in the
Republican primary. There is therefore probable cause to search the information described in
Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described
in Attachment B.
JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

2

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 6 of 23

§ 27 11(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraphs 6, 20, and 28.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
Disseminate Hacked Information.
6.

According to the public and unclassified intelligence report conducted by the

United States Intelligence Community, the Russian military intelligence (General Staff Main
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
7.

The public and unclassified intelligence report assessed that the GRU used a

Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLe~ to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and Wikileaks.
8.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 20 15. Although Stone had no

3

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 7 of 23

official relationship with the Campaign thereafter, Stone maintained his suppo1i for Trump and
continued to make media appearances in support of Trump's presidential campaign.
9.

As discussed further below, Stone made a number of public references to

Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
Twitter with Guccifer 2.0.
10.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
11.

On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from

theDNC.
12.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: " It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
13.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
4

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 8 of 23

October surprise, what would be your forecast on that given what Julian Assange has intimated
he ' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
14.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
15.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0' s
Twitter account was reinstated.
16.

On August 14, 2016, Stone sent a private message on Twitter using

@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle
reinstated after having been suspended. 1
17.

On August 15, 20 16, Guccifer 2.0 replied to Stone on Target Account 1, stating:

"wow. thank u for writing back, and thank u for an article about me! !! did you find anything
interesting in the docs I posted."

1 These

messages were released by Stone on March 10, 2017, as described further below in paragraph 28.

5

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 9 of 23

18.

On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking

Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.
19.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
20.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
that investigators were also examining the Podesta Group.
21.

On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John

Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange] ,
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."

6

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 10 of 23

22.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
23.

On Saturday, October 1, 20 16, using @RogerJStoneJr, Stone Tweeted,

"Wednesday @ HillaryClinton is done. #Wikileaks."
24.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of Wikileaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
used @RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
25.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
26.

Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
27.

Wikileaks continued to release John Podesta's hacked emails throughout October

10-21, 2016. On October 12, 20 16, John Podesta-referring back to Stone's August 21 , 2016 CSPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there' s at least a reasonable belief that [Assange] may have passed this information on to
7

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 11 of 23

[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who' s traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Hurna ALeJiu auJ Cheryl Mill:s, the Clinton ai<le:s, thought wtm::
deleted. I hear that through my emissary."
28.

On March 10, 2017, Stone spoke with The Washington Times and acknowledged

he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The

Washington Times.
29. ,

On March 27, 2017, CNN reported that a representative of Wikileaks, writing

from an email address associated with Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

C. Roger Stone's Private Twitter Direct Messages with Wikileaks and Julian Assange.
30.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr. While the full review of that returned information is ongoing,
the initial review indicates that, contrary to Stone' s representation to CNN that he "never
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
8

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 12 of 23

Wikileaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
31.

For example, on October 13, 2016, while Wikileaks was in the midst of releasing

the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@Wikileaks. This account is the official Twitter account of Wikileaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending wikileaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
32.

Less than an hour later, @Wikileaks responded by direct message: "We

appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
33.

On October 16, 2016, @RogerJStoneJr sent a direct message to @Wikileaks:

"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
a sieve. You n,eed to figure out who your friends are."
34.

On November 9, 2016, one day after the presidential election, @Wikileaks sent a

direct message to @RogerJStoneJr containing a single word: "Happy?" @Wikileaks
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
35.

In addition, @RogerJStoneJr has also recently exchanged direct messages with

Julian Assange, the founder of Wikileaks. For example, on June 4, 2017, @RogerJStoneJr
directly messaged @JulianAssange, an address associated with Julian Assange in numerous
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
9

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 13 of 23

information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumpedup sexual assault charges dropped I don't know of any crimt:: you nt::t::c.l lo be pardoned for - best
regards. R." That same day, @J ulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
Trump trying to squeeze us into a deal."
36.

On Saturday, June 10, 20 17, @RogerJStoneJr sent a direct message to

@Wikileaks, reading: "I am doing everything possible to address the-issues at the highest level
of Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

D. Roger Stone's Use of the Target Account to Continue Conversations Begun on
Twitter Direct Message.
37.

Using the direct messaging function associated with the account @RogerJStoneJr,

Stone sent direct messages to individuals instructing them to email the Target Account to
continue conversations began via Twitter direct message. For example, on August 8, 2015, an
individual sent @RogerJStoneJr a direct message asking ifhe had "a few minutes this afternoon
to talk about all of today' s drama with Trump." Stone responded the next day: "Sorry I missed
this - my email [Target Account]."
38.

On August 8, 2015, an individual sent a direct message to @RogerJStoneJr

reading: "Just got some stuff from the campaign you may want to respond to." That same day,
@RogerJStoneJr responded: "Such as-? My email is [Target Account] ."

10

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 14 of 23

39.

On August 9, 20 15, an individual sent @RogerJStoneJr a direct message asking to

arrange an interview. @RogerJStoneJr replied, "Okay - what do you need from me." The
individual replied, " Your email address. Twitter too public." Stone replied with the Target

Account.
40.

On September 7, 20 15, an individual sent a private direct message to

@RogerJStoneJr containing a " White Paper," regarding the "Most likely questions to be asked of
Mr. Trump on Foreign Policy." @RogerJStoneJr replied: "Send to me at [Target Account]."
41 .

On February 17, 2016, an individual sent a direct message to Stone reading: "Mr.

Stone I have a delightful story about one foul tempered governor currently pretending to be Ned
Flanders up on the stage. Interested?" @RogerJStoneJr responded on Friday, February 19, 2016:
"Sure---tell me what u know-[Target Account]."
42.

On March 21, 2016, an individual sent a private direct message to

@RogerJStoneJr reading: " Im trying to get a list of upcoming Trump events so I can Fly out and .
Film these Anti-Trump protesters. To show the American people that these are the people that
are actually creating the Chaos. No one is showing whats really going on outside at these events
honestly and quite frankly its pissing me off." The next day, @RogerJStoneJr responded: "Email
me at [Target Account]."
43.

On April 30, 2016, an individual sent a private direct message to @RogerJStoneJr

stating: "Give me a shout if you need a story moved. My followers are RTing fiends! lol."
@RogerJStoneJr responded: "Great- please e-mail me again at [Target Account]."
44.

On September 13, 2016, an individual send a private direct message to

@RogerJStoneJr asking for a "contact info so I can stay in touch in a more appropriate way than
Twitter DM." @RogerJStoneJr replied, "email me at [Target Account]."
11

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 15 of 23

BACKGROUND CONCERNING HOTMAIL
45.

In my training and experience, I have learned that Microsoft provides a variety of

on-line services, including electronic mail ("email") access, to the public. Microsoft allows
subscribers to obtain email accounts at the domain name Hotmail.com, like the email account
listed in Attachment A. Subscribers obtain an account by registering with Hotmail. During the
registration process, Hotmail asks subscribers to provide basic personal information. Therefore,
the computers of Microsoft are likely to contain stored electronic communications (including
retrieved and unretrieved email for Hotmail subscribers and information concerning subscribers
and their use of Hotmail services, such as account access information, email transaction
information, and account application information. In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users.
46.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my- training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account' s user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
47.

In my training and experience, email providers typically retain certain

transactional information about the creation and use of each account on their systems. This

12

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 16 of 23

information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
· (including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage
of the account. In addition, email providers often have records of the Internet Protocol address
(" IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access
the email account.
48.

In my training and experience, in some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
49.

This application seeks a warrant to search all responsive records and information

under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic
communications and any records or other information pertaining to the customers or subscribers
if such communication, record, or other information is within Microsoft's possession, custody, or
13

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 17 of 23

control, regardless of whether such communication, record, or other information is stored, held,
or maintained outside the United States.
50.

As explained herein, information stored in connection with an email account

may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience,
the information stored in connection with an email account can indicate who has used or
controlled the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the Internet Protocol
(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
'

account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
14

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 18 of 23

communications relating to the crime), or consciousness of guilt (e.g. , deleting communications
in an effort to conceal them from law enforcement).

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED
51 .

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Hotmail to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
particularly described in Section I of Attachment B. Upon receipt of the information described in
Section I of Attachment B, government-authorized persons will review that information to locate
the items described in Section II of Attachment B. The items identified in Attachments A and B
will also be screened by reviewers not on the prosecution team to identify andilter out privileged
material.

CONCLUSION
52.

Roger Stone used the @ RogerJStoneJr to communicate directly with Wikileaks

during the campaign, even though he publicly claimed to have "never" communicated with
Wikileaks. He also sent private messages to Julian Assange and Guccifer 2.0, the entity which
claimed responsibility for the DNC hack. Using @RogerJStoneJr, Stone has repeatedly
instructed individuals to continue conversations, including particularly sensitive issues related to
the Campaign, on the Target Account. There is therefore probable cause to believe that
evidence of the DNC hack and the hacking of other emails associated with the 2016 election will
be found on the Target Account.
53.

Based on the forgoing, I request that the Court issue the proposed search warrant.

15

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 19 of 23

54.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING

55.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

~f~e

~so~
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this / / ~y of September, 2017.

~d!f/k-d/

The Honorable Beryl A. Howell
Chief United States District Judge

16

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 20 of 23

ATTACHMENT A
Property to Be Searched

This warrant applies to information associated with the

Account

(the "Target Account") that is stored at premises owned, maintained,
controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered at One
Microsoft Way, Redmond, WA 98052.

17

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 21 of 23

ATTACHMENT B

I.

Information to be disclosed by Microsoft, Corp.
To the extent that the information described in Attachment A is within the possession,

custody, or control of the Microsoft, Corp. (hereinafter "the Provider"), regardless of whether
such information is stored, held or maintained inside or outside of the United States, and
including any emails, records, files, logs, ur iufunualiun lhal has been deleted but is still
available to the Provider, the Provider is required to disclose the following information to the
government for each account or identifier listed in Attachment A2:
a.

The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account, draft emails, the source
and destination addresses associated with each email, the date and time at which
each email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP
addresses associated with session times and dates, account status, alternative
email addresses provided during registration, methods of connecting, log files,
and means and source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the
date on which the account was created, the length of service, the types of service
utilized, the IP address used to register the account, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the ~ubscriber, methods of connecting;

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 22 of 23

f.

All search history or web history;

g.

All records indicating the services available to subscribers of the account;

h.

All usernames associated with or sharing a login IP address or browser cookie
with the account;

1.

All cookies, including third-party cookies, associated with the user;

J.

All records that are associated with the machine cookies associated with the user;
and

k.

All telephone or instrument numbers associated with the Account (including
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile
Identification Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile
Subscriber Integrated Services Digital Network Number ("MSISDN"),
International Mobile Subscriber Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi").

II.

Information to be Seized by the Government
All information described above in Section I that constitutes evidence, contraband, fruits,

and/or instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in
connection with computers) and 18 U.S.C. §371 (conspiracy to commit and offense against the
United States) involving Roger Stone or others associated with him and occurring after January
1, 2015, including, for each account or identifier listed on Attachment A, information pertaining
to the following matters:
(a)

Communications, records, documents and other files that reveal efforts by Roger
Stone to communicate with any individuals associated with carrying out the hacks
of the DNC or individual email addresses associated with the Clinton Campaign.

(b)

Records of any funds or benefits received by or offered to Roger Stone or an
individuals or entities associated with him by, or on behalf of, any individuals
associated with the hacks of the DNC or individual email addresses associated
with the Clinton Campaign.

2

 Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 23 of 23

(c)

Evidence indicating how and when the account was accessed or used, to
determine the geographic and chronological context of account access, use, and
events relating to the crimes under investigation and. to the account owner;

(d)

Evidence indicating the account owner' s state of mind as it relates to the crimes
under investigation;

(e)

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s).
(f) The identity of any person(s)- including records that help reveal the person(s)'

whereabouts-who communicated with the account about any matters relating to
activities conducted by Roger Stone on behalf of, for the benefit of, any
individual associated with hacks of the DNC or individual email addresses
associated with the Clinton Campaign.

3

 Case Document 29-3 Filed 04/28/20 Page 1 of 25

A0 93 (Rev I 1/13) Search and Seizure Warrant

 

UNITED STATES DISTRICT COURT

for the
District of Columbia

I th .
(Brie; de tatter ofthe Search of Case: 
the property to be searched 
or identi?z the person by name andaddress) ASSIgned To Howell. Beryl A.
INF Assign. Date 10/17/2017
Description: Search and Seizure Warrant


SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer
An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the Northern District of California

(identi?t the person or describe the property to be searched and give its location):

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identi?) the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 31. 2017 (not to exceed 14 days)
in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell 
(United States Magistrate Judge)

 

[3 Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose

property, will be searched or seized (check the appropriate box)
CI for days (not to exceed 30) CI until, the facts justifying, the later speci?c date of

Date and time issued: 4/7} 

Judge 's signature

 

Hon?eiyl A. Howell, Chief US. District Judge

Printed name and titie

City and state: Washington, 

 

Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 2 of 25

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google account:

that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043.

17

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 3 of 25

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a.
The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section LA, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section LA, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section LA.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;
18

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 4 of 25

i.

Google Drive files created, accessed or owned by the account;

j.
YouTube subscriber information, private videos and files, private
messages, and comments;
k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l.
account.

Google Talk and Google Hangouts conversation logs associated with the

19

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 5 of 25
06 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

District of Columbia

In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the p erson by name and address)

~

INFORMATION ASSOCIATED WITH

)
)

OCT 1 7 2017

Case: 1:17-mj-00760
Assigned To : Howell, Beryl A.
Assign . Date : 10/17/2017
Description: Search and Seizure Warrant

)
APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

·

See Attachment A.
located in the

- - -Northern
- ----

District of

person or describe the property to be seized):

California
------=-='-=--'=- - - , there is now concealed (identify the

See Attachment B.
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1 )(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section
18 U.S. C. § 1030
18 U.S.C. § 2
22 U.S.C. § 371

Offense Description
Fraud and Related Activities in Connection with Computers Agents
Aiding and Abetting
Conspiracy to Commit an Offense Against the United States

The appl ication is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ __ _
under I 8 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Rev;ewed by AUSA/SAUSk

IAaron Zelinsky (ASC)

) is requested

~ ~ f!;;;;:;.=
Amy Anderson, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

10/17/2017
Judge's s ignature

City and state: Washington , D.C.

Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 6 of 25

FILED
OCT 17 2017

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF rnr f Th1fRT /:;.
IN THE MATIER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1:17-mj-00760
Assigned To : Howell, Beryl A
Assign. Date : 10/1 7/2017
Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy Anderson, being first duly sworn, hereby depose and state as follows :
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the email account

(hereafter the "Target

Account"), that is stored at premises owned, maintained, controlled, or operated by Google,

Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043 .
The information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments A and B. This affidavit is made in support of an
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
2.

I am a Special Agent with Federal Bureau of Investigation ("FBI") assigned to

FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.
I have conducted and participated in various investigations involving multiple threat countries as
well as national security threats and applicable criminal violations.
3.

The facts in this affidavit come from ~y personal observations; my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 7 of 25

to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there.is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with co.mputers), 18
U.S.C. § 2 (aiding and abetting), and 18 U.S.C. § 371 (conspiracy to commit an offense against
the United States).
5.

As set forth below, Roger STONE communicated directly via Twitter with

WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used _by Russian intelligence to
disseminate hacked information. STONE, using his

Account, also emailed instructions

to Jerome CORSI to " Get to Assange" in person at the Ecuadorian Embassy and "get pending
WikiLeaks emails[.]" CORSI emailed STONE back on his

Account that it was "Time

to let more than Podesta to be exposed" (before any of Podesta' s were leaked). After Podesta's
emails were leaked, CORSI emailed STONE "talking points" about Podesta to the Target
Account. CORSI also emailed the Target Account to convey information "from a very trusted
source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. In addition,
STONE used the Target Account to continue conversations via email that he began on Twitter
and forwarded emails, including at least one related to WikiLeaks, from his

account to

the Target Account.

JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
2

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 8 of 25

such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 7.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
Disseminate Hacked Information.
7.

According to the public and unclassified intelligence report conducted by the

United States Intelligence Community, the Russian military intelligence (General Staff Main
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003 .
8.

The public and unclassified intelligence report assessed that the GRU used a

Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
9.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no

3

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 9 of 25

official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign.
10.

As discussed further below, Stone made a number of public references to

WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
Twitter with Guccifer 2.0.
11.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
12.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
13.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote_: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets froni Guccifer 2.0 in the article and
wrote: "Here' s Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
14.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organizat_ion. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
4

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 10 of 25

October surprise, what would be your forecast on that given what Julian Assange has intimated
he' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling wha~ the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
15.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
16.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
Twitter account was reinstated.
17.

On August 14, 2016, Stone sent a private message on Twitter using

@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user' s Twitter handle
reinstated after having been suspended. 1
18.

On August 15, 2016, Guccifer 2.0 replied to Stone at@RogerJStoneJr, stating:

"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
interesting in the docs I posted."

1

·

~~MA

These messages were released by Stone on March I 0, 2017, as described further below in paragraph 28-:

5

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 11 of 25

19.

On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking

Guccifer to retweet an article he had written regarding the ' rigg[ing]' of the 2016 presidential
elections.
20.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
21.

On August 18, 2016, Paul Manafort, Stone' s longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
22.

On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John

Podesta, Hillary Clinton' s presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a " ' mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
23.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."

6

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 12 of 25

24.

On Saturday, October 1, 2016, using@RogerJStoneJr, Stone Tweeted,

"Wednesday @HillaryClinton is done. #WikiLeaks."
25.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
used @RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
26.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
27.

Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta' s personal email account.
28.

WikiLeaks continued to release John Podesta's hacked emails throughout October

10-21, 2016. On October 12, 2016, John Podesta - referring back to Stone' s August 21 , 2016 CSPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there' s at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: " I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
7

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 13 of 25

him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
29.

On March 10, 2017, Stone spoke with The Washington Times and acknowledged

he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The

Washington Times.
30.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

C. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
31.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account@RogerJStoneJr. Contrary to Stone's representation to CNN that he "never
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
WikiLeaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
32.

For example, on October 13, 2016, while WikiLeaks was in the midst ofreleasing

the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
8

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 14 of 25

@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
33.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
34.

On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!

The more you \"correct\" me the more people think you're lying. Your operation leaks like a
sieve. You need to figure out who your friends are."
35.

On November 9, 2016, one day after the presidential election, @wikileaks sent a

direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately
followed up with another message less than a minute later: "We are now more free to
communicate."
36.

In addition, @RogerJStoneJr has also recently exchanged direct messages with

Julian Assange, the founder of WikiLeaks. For example, on June 4, 20 17, @RogerJStoneJr
directly messaged @JulianAssange, an address associated with Julian Assange in numerous
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumped9

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 15 of 25

up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best
regards. R." That same day, @JulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
Trump trying to squeeze us into a deal."
37.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: " I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

D. Roger Stone's Emails Regarding WikiLeaks, Julian Assange, Russia, and John
Podesta
38.

On September 11 , 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

(the "

Account"). Emails recovered pursuant to that search warrant indicated the following:
39.

On July 25, 20 16, STONE sent an email from his

Account to JEROME

CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
WikiLeaks emails .. . they deal with Foundation, allegedly."
40.

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed the

Account, " Word is

friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much

10

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 16 of 25

of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to Julian ASSANGE, the founder ofWikiLeaks, who resided
in Ecuador's London Embassy in 2016.
41.

On or about August 16, 2016, CORSI emailed the Target Account link to a piece

CORSI had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to
Derail Hillary."
42.

On or about August 31 , 2016, CORSI emailed the

Account: "Did you get

the Podesta writeup." STONE replied "yes."
43 .

On or about September 6, 2016, CORSI emailed the

Account: "Roger[,]

Is NY Post going to use the Pedesta [sic] stuff?"
44.

On or about October 4, 2016 STONE forwarded an email from his

Account to the Target Account with the subject line "Comment on WikiLeaks?" The email,
from a reporter, asked STONE for any comment on the "lack of an 'October surprise' release
from WikiLeaks today?"
45.

On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.

46.

On or about October 12, 2016, the same day on which Podesta accused STONE of

having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
Target Account and the

Account, with a subject line "Podesta talking points." Attached

to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that, "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
the Clinton Foundation." CORSI followed up several minutes later with another email to the
11

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 17 of 25

Target Account and the

Account titled, "Podesta talking points," with the text "sent a

second time just to be sure you go it." STONE emailed CORSI back via the

Account,

"Got them and used them."
47.

On or about October 17, 2016, CORSI emailed the Target Account and the

Account with the subject, "Fwd: AS SAN GE . .. URGENT ... " CORSI wrote, "From a
very trusted source," and forwarded an email with the header information stripped out, showing
only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador
and U .K. He will drop the goods on them if they move to extradite him. My guess is that he has a
set of dead man files that include Hillary. It's what they used to call a ' Mexican stand off[.]'
Only hope is that if Trump speaks out to save him[.] Otherwise he'd dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
48.
the

emailed the Target Account,

On or about January 7, 2017,
Account, CORSI, and

with the subject line, "in case you need

his mail ... ...... " Attached to the message was a scan of a business card for John Podesta.
Several hours later,

replied to all recipients, including the Target Account, "Ha ...

maybe he wants to go phishing with us?"
49.

I know from my training and experience that the term "phishing" is used to refer

to the practice of sending emails purporting to be from a reputable party in order to induce
individuals to reveal personal information, including passwords. Public reports indicate that
Podesta's emails were obtaining through a "phishing" scheme.

E. Roger Stone's Use of the Target Account to Continue Conversations Begun on
Twitter Direct Message.
12

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 18 of 25

50.

STONE has also used Target Account to continue conversations began via

Twitter direct message. For example, on August 18, 2016, an individual sent @RogerJStoneJr a
direct message asking "know where to send information to" regarding "Presidential polls and
why cycle favors Trump." Stone responded: "[Target Account] ."
51.

On August 19, 2017, an individual sent a direct message to @RogerJStoneJr

concerning an offer for "$500 for a 30 minute phone call," stating that "My audience would be
fascinated by discussion." The individual then direct messages Stone, "Hi Roger! I'm striking
out with your rep. Hoping we can swing something this week. My offer still stands."
@RogerJStoneJr wrote back: "Email me direct (Target Account]."
BACKGROUND CONCERNING GOOGLE

52.

Google provides numerous free services to the users with a Google profile. Some

of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user' s Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view, and share videos. Google also retains a record of searches conducted by the user,
as well as location data for the use of some of the services described above. All of these services
may record information uploaded, inputted, or gathered from the user.

13

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 19 of 25

53.

In my training and experience, in addition to information such as search history

can help to show the state of mind of an individual at the time the search was made, as well as
the individuals potential advance knowledge of events, as they search to see if the anticipated
event has occurred. Individuals who communicate via Gmail also often use other Google
products, including Google Talk, to communicate, and Google Drive to store or transfer, open, or
edit files.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED
54.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
particularly described in Section I of Attachment B. Upon receipt of the information described
in Section I of Attachments B, government-authorized persons will review that information to
locate the items described in Section II of Attachments B. The items identified in Attachments A
and B will also be screened by reviewers not on the prosecution team to identify and filter out
privileged material.

CONCLUSION
55.

STONE instructed CORSI via the

Account to "Get to Assange" at the

Ecuadorian Embassy regarding upcoming leaks, and CORSI emailed Stone on the
Account that it was "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC." CORSI later emailed STONE "talking points" about Podesta to the

Target Account, and also emailed the Target Account to convey information "from a very
trusted source" regarding ASSANGE, WikiLeaks, and potential disclosure. STONE also used
14

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 20 of 25

the Target Account to continue conversations via email that he began on Twitter and forwarded
emails related to WikiLeaks from the

Account to the Target Account. There is

therefore probable cause to believe that evidence of the DNC hack and the hacking of other
emails associated with the 2016 election will be found in the information associated with the
Target Account.
56.

Based on the forgoing, I request that the Court issue the proposed search warrant.

57.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

15

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 21 of 25

REQUEST FOR SEALING
58.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

Special Agent
Federal Bureau of lnvestigati_o n

Subscribed and sworn to before me on this

I J ~ of October, 2017.

~le~

The Honorable Beryl A. Howell
Chief United States District Judge

16

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 22 of 25

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Google account:

that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043.

17

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 23 of 25

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(±), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a.
The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and-the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section I.A.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;
18

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 24 of 25

1.

Google Drive files created, accessed or owned by the account;

J.
YouTube subscriber information, private videos and files, private
messages, and comments;
k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;

1.
account.

Google Talk and Google Hangouts conversation logs associated with the

19

 Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 25 of 25

II.

Information to be Seized by Law Enforcement Personnel
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate 'in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
b.
All images, messages, communications, calendar entries, search terms,
and contacts, including any and all preparatory steps taken in furtherance of the abovelisted offenses;
c.
Communication, information, documentation and records relating to who
created, used, or communicated with the account or identifier, including records about
their identities and whereabouts;
d.

Evidence of the times the account was used;

e.
All images, messages and communications regarding wipmg software,
encryption or other methods to avoid detection by law enforcement;
f.
Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g.
Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h.
All existing printouts from original storage which concern the categories
identified in subsection II.A; and
1.

All "address books" or other lists of contacts.

20

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 1 of 31
AO 106 (Rev. 04/ 10) Application for a Search Warrant

FILED
NOV -s 2017

UNITED STATES DISTRICT COURT
for the

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

District of Columbia
In the Matter of the Search of
(Briefly describe the prop erty to be searched
or identi.fj, the p erson by name and address)

INFORMATION ASSOCIATED WITH THE TWITTER
ACCOUNTS

Case: 1: 17-mj-00a21
Ass!gned To : Howell, Beryl A
Assign. Date : 11/6/2017
.
Description: Search and Seizure Warrant

)
)
)
)
)
)

APPLICATION FOR A SEARCH WARRANT
I , a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A.
located in the

Northern

- - - ' - - - - - --

District of

_ _ __

California

__.:....c.;c.:,c.;:_;_:--=--

---

, there is now concealed (identi.fj, the

p erson or describe the property to be seized) :

See Attachment 8.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more) :

~ evidence of a crime;

~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. § 1030
18 U.S.C. § 371, § 2
50 U.S.C. § 30121

Offense Description
Fraud and Related Activities in Connection with Computers
Conspiracy Against the United States, Aiding and Abetting
Foreign Contribution Ban

The application is based on these facts:
See attached Affidavit.

~ Continued on the attached sheet.

a;-~!:;

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ __ _ _

Rev:.::~~::::/::::::fue b~is ofwhich isset
IAaron Zelinsky (ASC)

) is requested

Amy Anderson, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

11/6/2017

City and state: Washington , D.C.

Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 2 of 31

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

NOV -s 2017

Clerk us 0 . .
Courts fo.r the ';~ntc~ & Bankruptcy

is net ot Columbia

IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH THE
TWITTER ACCOUNT
AND

Case: 1: 17-mj-00821
Ass!gned To : Howell, Beryl A
Assign. Date : 11/6/2017
Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

I.

I make this affidavit in support of an application for a search warrant for

information associated with the Twitter Accounts
and

(hereafter "Target Account 1")

(hereafter "Target Account 2"), that is stored at premises owned,

maintained, controlled, or operated by Twitter, a social-networkin? company headquartered in
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(I )(A).
2.

I am a Special Agent with Federal Bureau oflnvestigation ("FBI") working

directly with the Special Counsel's Office. I have been a Special Agent with the FBI since 2010.
Since then, l have conducted national security investigations of foreign intelligence services,
espionage, and counter proliferation matters. I have training and experience related to espionage,
foreign intelligence services, and national security investigations. I have conducted and
participated in various investigations involving multiple threat countries as well as national
security threats and applicable criminal violations.

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 3 of 31

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that certain individuals with whom the Target Accounts were
in communication have committed violations of 18 U..S.C. § I 030 (fraud and related activities in
connection with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S .C. § 2 (aiding
and abetting), 18 U.S.C. § 371 (conspiracy to commit an offense against the United States), and
that communications related to these violations will be found on the Target Accounts. There is
therefore probable cause to search the information described in Attachment A for evidence of
these crimes and contraband or fruits of these crimes, as described in Attachment B.
5.

As detailed further below, from on or about June 22, 20 I 6, through at least on or

about July 17, 2016, Target Account 1, belonging to WikiLeaks, exchanged numerous direct
messages concerning hacked information with Guccifer 2.0, which was a Twitter account used
by the Russian Government to release data obtained through hacking accounts of U.S. users.

Target Account 1 also sent direct messages via Twitter concerning a "guessed" password for the
website "

Target Account 2 belongs to Julian Assange,

" to

the founder of WikiLeaks. Beginning no later than on or about July 2016, former Campaign
adviser Roger Stone was in contact with Assange via an intermediary regarding upcoming leaks
of hacked information obtained by WikiLeaks. In addition, Assange, using Target Account 2,
communicated directly with Stone beginning no later than on or about April 7, 2017. Stone
stated to Target Account 2 that he was "doing everything possible to address the issues [related
2

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 4 of 31

to WikiLeaks] at the highest level of Government," and that he and Target Account 2 "must be
circumspect in this forum as experience demonstrates it is monitored."
JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraph 9.
PROBABLE CAUSE
A. Background on the Target Accounts, Julian Assange, and Roger Stone.
7.

Target Account 1 is the public account of WikiLeaks. As detailed further below,

it frequently has been used to release hacked information, including during the 2016 election.
Target Account 2 is the public account of Julian Assange. Target Account 2 has over 500,000
followers, but only follows one account, Target Account 1. Target Account 2 frequently
tweets information related to WikiLeaks and tags Target Account 1.
8.

Julian Assange is the founder of WikiLeaks. According to the publicly-accessible

profile of Target Account 2, Assange currently is the "Publisher @WikiLeaks [Target Account
1]." Target Account 2's profile contains a link to the website " IamWikiLeaks.org\donate."
According to publicly-available press reporting, Assange began hacking secure computer
systems when he sixteen years old, in 1987. On or about December 1996, Assange pied guilty in
Australia to twenty-five charges related to hacking secure computer systems. In 2006, Assange
and others established WikiLeaks, and he previously described himself as WikiLeaks's Editor3

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 5 of 31

in-Chief. Assange has stated in public interviews that he is deeply involved in running
WikiLeaks. Referring to the DNC emails, Assange stated in an August, 2017 interview that, "We
had quite some difficulties to overcome, in terms of the technical aspects, and making sure we
were comfortable with the forensics," and that "You have to get close and interact with it, then
you start to get a feel." Assange indicated that only a small number of people, including himself,
worked on the release of the DNC emails. Assange stated in August 20 16 to a news organization
that, "We are working around the clock. We have received quite ·a lot of material."
9.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics sine~ 1975. Stone officially worked on the presidential
campaign of Donald J. Trump (the "Campaign") until August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump' s presidential campaign. After
Stone's public departure from the Campaign, Stone continued to correspond with individuals
related to the Campaign, including Paul Manafort (who worked for a time as Campaign
manager), Rick Gates (a campaign adviser), and Jason Miller (Campaign spokesman). As
discussed further below, Stone made a number of public references to WikiLeaks, Julian
Assimge, and the release of DNC-related emails.

B. The DNC Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
Disseminate Hacked Information.
10.

According to the public and unclassified intelligence report prepared by the

United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence

4

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 6 of 31

Directorate or "GRU") probably began cyber operations aimed at the U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other
Democratic Party officials and political figures. By in or about May 2016, the GRU had
exfi ltrated large volumes of data from the DNC. The DNC headquarters is located at 43 0 South
Capitol Street SE, Washington, D.C. 20003.
11 .

The public and unclassified intelligence report assessed that:
a.

The GRU used a Twitter account, "Guccifer 2.0" and the website

DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in
exclusives to media outlets and relayed material to WikiLeaks.
b.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made

multiple contradictory statements and false claims about hi s likely Russian identity
throughout the election.
c.

Content that was taken from e-mail accounts targeted by the GRU in

March 2016 appeared on DCLeaks.com starting in June 20 16.
d.

The GRU relayed material it acquired from the DNC and senior

Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not
contain any evident forgeries.
e.

The Kremlin 's principal international propaganda outlet RT (formerly

Russia Today) has actively collaborated with WikiLeaks. RT's editor-in-chief visited
WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August
2013, where they discussed renewing his broadcast contract with RT, according to
Russian and Western media. Russian media has subsequently announced that RT had
5

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 7 of 31

become "the only Russian media company" to partner with WikiLeaks and had received
access to "new leaks of secret information."
f.

On or about August 6, 2016, RT published an English-language video

called "Julian Assange Special: Do WikiLeaks Have the E-Mail That'll Put Clinton in
Prison?" and an exclusive interview with Assange entitled "Clinton and ISIS Funded by
the Same Money."
12.

On or about June 14, 2016, the Washington Post reported that "Russian

government hackers" had penetrated the DNC computer network and stole opposition research
on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.
13.

On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack

and began posting hacked documents.
14.

As detailed further below, on or about June 22, 2016, Guccifer 2.0 and Target

Account 1 initiated communication via Twitter private messaging regarding the transfer and
release of hacked information, including the hacked email accounts related to the DNC.
15.

On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from

the DNC. Using Target Account 1, WikiLeaks publicly tweeted: "WikiLeaks releases thousands
of documents about Clinton and internal deliberations" and linked to a Washington Post article
and www.wiki leaks .org/dnc-emails/.
I 6.

On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers

and email addresses from the files of the Democratic Congressional Campaign Committee
(DCCC).
17.

On or about August 21, 20 16, Roger Stone directed a publicly-available tweet at

John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon

6

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 8 of 31

the [sic] Podesta's time in the barrel. #CrookedHi llary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a '" mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
18.

On or about September 13, 2016, Target Account 1 tweeted a public message

stating, "678.4 MB of new ' DNC documents' from @Guccifer_2," with a link to a publicly
available file.
19.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
20.

Approximately a half hour later, at 4:32 P.M., Target Account 1 sent out a Tweet

reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing
a link to approximately 2,050 emai ls that had been hacked from John Podesta's personal emai l
account. WikiLeaks, via Target Account 1, continued to release John Podesta's hacked emails
throughout October 10-14, 2016.

C. Communications Between the Target Account 1 and Guccifer 2.0
21 .

On July 7, 2017 Magistrate Judge Maria-Elena James of the Northern District of

California issued a search warrant for the Twitter Account associated with Guccifer 2.0. The
communications obtained from the account are detailed further below.

7

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 9 of 31

22.

On or about June 22, 2016, WikiLeaks sent Guccifer 2.0 sent a direct message

(OM) stating "Do you have secure communications?" Target Account 1 stated, "Send any new
material here for us to review and it will have a much higher impact than what you are doing. No
other media will release the full material." Guccifer 2.0 replied, "what can u suggest for a secure
connection? Soft, keys, etc? I'm ready to cooperate with you, but I need to know what's in your
archive 80gb? Are there only HRC emails? Or some other docs? Are there any DNC docs? If it's
not secret when you are going to release it?" Target Account 1 wrote back, "You can send us a
message in a .txt file here," and attached a web link. Guccifer 2.0 responded, "do you have
GPG?" I know from my training and experience that "GPG" refers to a program for exchanged
encrypted information.
23.

On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, "How can

we chat? Do u have jabber or something like that?" I know from my training and experience that
"Jabber" is an instant messaging service. Target Account 1 wrote back, "Yes, we have
everything. We' ve been busy celebrating Brexit. You can also email an encrypted message to
office@wikileaks.org. They key is here." 1 A web link was attached to the message. I know from
my training and experience that an encryption "key" is a string of information created for
scrambling and unscrambling data.
24.

On or about June 27, 2016, Guccifer 2.0 wrote to Target Account 1, "Hi, [I]'ve

just sent you an email with a text message encrypted and an open key." Target Account 1 wrote
back, "Thanks." Guccifer 2.0 replied, "waiting for ur response. I send u some interesting piece."

1

Target Account I sent each sentence as a separate message, though close in time. These messages have been
consolidated into a single quote for ease of reading. The same is done below with other close in time messages.

8

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 10 of 31

25.

On or about July 4, 2016, Guccifer 2.0 wrote to Target Account 1, "hi there,

check up r email, waiting for [r]eply."
26.

On or about July 6, 2016, Guccifer 2.0 wrote to Target Account 1, "have u

received my parcel?" Target Account 1 responded, "Not unless it was very recent. [we haven't
checked in 24h]." 2 Guccifer 2.0 replied, "I sent it yesterday, an archive of about 1 gb. via
[website link]. [A]nd check your email." Target Account 1 wrote back, "Wil[l] check, thanks."
Guccifer 2.0 responded, " let me know the results." Target Account 1 wrote back, "Please don't
make anything you send to us public. It' s a lot of work to go through it and the impact is severely
reduced if we are not the first to publish." Guccifer 2.0 replied, "agreed. How much time will it
take?" Target Account 1 responded, " likely sometime today." Guccifer 2.0 wrote back, "will u
announce a publication? and what about 3 docs [I] sent u earlier?" Target Account 1 responded,
" I don' t believe we received them. Nothing on 'Brexit' for example." Guccifer 2.0 wrote back,
"wow. have you checked ur mail?" Target Account 1 replied, "At least not as of 4 days ago . . . .
For security reasons mail cannot be checked for some hours." Guccifer 2.0 wrote back, "fuck, [I]
sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I]
spent the whole day uploading 1 gb." I know from my training and experience that the term "gb"
is an abbreviation for "gigabyte," a unit of measurement of information stored on a computer.
27.

Target Account 1 wrote back, "We can arrange servers l00x as fast. The speed

restrictions are to anonymise the path. Just ask for custom fast upload point in an email."
Guccifer 2.0 wrote, "will u be able to check ur email?" Target Account 1 responded, "We're
best with very large data sets. e.g. 200gb. these prove themselves since they're too big to fake. "

2

The brackets appear in the original message.

9

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 11 of 31

Guccifer 2.0 responded, "or shall I send brexit docs via submission once again?" Target
Account 1 responded, "to be safe, send via [web link]."
28.

On or about that same day, Guccifer 2.0 wrote, "can u confirm u received dnc

emails?" Target Account 1 wrote back several messages later, "for security reasons we can 't
confirm what we' ve received here. e.g., in case your account has been taken over by us
intelligence and is probing to see what we have." Guccifer 2.0 responded, "then send me an
encrypted email." Target Account 1 wrote back, "we can do that. but the security people are in
another time zone so it will need to wait some hours." Target Account 1 wrote, "what do you
think about the FBl ' s failure to charge? To our mind the clinton foundation investigation has
always been the more serious. we would be very interested in all the emails/docs from there. She
set up quite a lot of front companies. e.g in sweden." Guccifer 2.0 responded, "ok, [l]'ll be
waiting for confirmation. [A]s for investigation, they have everything settled, or else I don' t
know how to explain that they found a hundred classified docs but fail to charge her. " Target
Account 1 responded, "She' s too powerful to charge at least without something stronger. [A]s
far as we know, the investigation into the clinton foundation remains open[.] [W]e hear the FBI
are 4nhappy with Loretta Lynch over meeting Bill, because he' s a target in that investigation."
29.

On or about that same day, Guccifer 2.0 wrote to Target Account 1, "[D]o you

have any info about marcel lazar? There've been a lot of rumors of late." "Marcel Lazar" is the
name of a Romanian Hacker who used the pseudonym "Guccifer," and who pied guilty on May
25, 2016 in the Eastern District of Virginia to hacking the personal accounts of a variety of
victims, including a former U.S. president. According to publicly available reporting, in May
20 16, Lazar also claimed to have hacked the email served belonging to then-candidate Clinton.
Lazar stated, " For me, it was easy ... easy for me, for everybody." Lazar's claims have not been
10

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 12 of 31

substantiated, and the undersigned is not aware of evidence indicating Lazar accomplished the
hack.
30.

Target Account 1 wrote back, "the death? [A] fake story." Target Account 1

messaged: "His 2013 screen shots of Max Blumenthal's inbox prove that Hillary secretly deleted
at least one email about Libya that was meant to be handed over to Congress. So we were very
interested in his co-operation with the FBI." Guccifer 2.0 wrote back, "some dirty games behind
the scenes [I] believe[.] Can you send me an email now?" Target Account 1 wrote back, "No;
we have not been able to activate the people who handle it. Still trying." Guccifer 2.0 replied,
"what about tor submission? [W]ill u receive a doc now?" Target Account 1 replied, "We will
get everything sent on [weblink]." [A]s long as you see \"upload succseful\" at the end. [I]fyou
have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the
DNC is approaching and she will solidify bernie supporters behind her after." Guccifer 2.0
responded, "ok. I see."
31.

Target Account 1 wrote, " [W]e think the public interest is greatest now and in

early october." Guccifer 2.0 responded, "do u think a lot of people will attend bernie fans rally in
philly? Will it affect the dnc anyhow?" Target Account 1 wrote, "bernie is trying to make his
own faction leading up to the DNC. [S]o he can push for concessions (positions/policies) or, at
the outside, if hillary has a stroke, is arrested etc, he can take over the nomination. [T]he question
is this: can bemies supporters+staff keep their coherency until then (and after). [O]r will they
dis[s]olve into hillary's camp? [P]resently many of them are looking to damage hilary [sic]
inorder [sic] to increase their unity and bargaining power at the DNC. Doubt one rally is going to
be that significant in the bigger scheme. [I]t seems many of them will vote for hillary just to
prevent trump from winning."

11

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 13 of 31

32.

On or about that same day, Guccifer 2.0 sent Target Account 1 a message

reading, "sent brexit docs successfully." Target Account 1 responded, ":)))." Target Account 1
wrote back, "we think trump has only about a 25% chance of winning against hillary so conflict
between bernie and hillary is interesting." Guccifer 2.0 responded, "so it is." Target Account 1
wrote, "also, it' s important to consider what type of president hillary might be. If bernie and
trump retain their groups past 2016 in significant number, then they are a restraining force on
hillary."
33.

On or about July 7, 2016, Target Account 1 wrote, "All good?" Guccifer 2.0

responded, "yeah, what about u? is smth wrong?" I know from my training and experience that
"smth" is used as an abbreviation for "something." Target Account 1 wrote back, "No. All
good." Guccifer 2.0 wrote back, "are working with the emails [I] sent u? [C]heck ur email. [I]
sent u a check archive from another email box. fuck, mail undelivered. [D]o you have another
way to receive large volumes of data? [B]esides for tor submission form?"
34.

On or about July 11, 2016, Guccifer 2.0 wrote to Target Account 1, "sent it via

ur submission. check it."
35.

On or about July 13, 2016, Guccifer 2.0 wrote, "r u there?" On or about July 14,

2016, Guccifer 2.0 wrote, "ping. Check ur email. sent u a link to a big archive and a pass."
Target Account 1 replied, "great, thanks; can' t check until tomorrow though ."

36.

On or about July 17, 2016, Guccifer 2.0 wrote, "what bout now?" On or about

July 18, 2016, Target Account 1 responded, "have the 1Gb or so archive." Guccifer 2.0
responded, "have u managed to extract the files?" Target Account 1 responded, "yes. turkey
coup has delayed us a couple of days. [O]therwise all ready[.]" Guccifer 2.0 responded, "so
when r u about to make a release?" Target Account 1 wrote back, "this week. [D]o you have
12

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 14 of 31

any bigger datasets? [D]id you get our fast transfer details?" Guccifer 2.0 wrote back, "i'll check
it. did u send it via email? Target Account 1 responded , "yes." Guccifer 2.0 replied, "to [web
link]. [I] got nothing." Target Account 1 wrote, "check your other mail? this was over a week
ago." Guccifer 2.0 wrote back, "oh, that one, yeah, [I] got it."
37.

On or about July 18, 20 16, Target Account 1 wrote, "great. [D]id it work?"

Guccifer 2.0 wrote back, " [I] haven't tried yet." Target Account 1 responded, "Oh. We arranged
that server just for that purpose. Nothing bigger?" Guccifer 2.0 wrote back, "let's move step by
step, u have released nothing of what [I] sent u yet." Target Account 1 replied, "How about you
transfer it all to us encrypted. [T]hen when you are happy, you give us the decrypt key. [T]his
way we can move much faster. (A]lso it is protective for you if we already have everything
because then there is no point in trying to shut you up." Guccifer 2.0 wrote back, "ok, i' ll ponder
it."

D. Contacts Involving the Julian Assange, Roger Stone, and the Target Accounts
38.

Approximately eight days after the last communication between Guccifer 2.0 and

WikiLeaks described above, on or about July 25, 2016, Stone sent an email to Jerome Corsi, an
author and political commentator, with the subject line, "Get to Assange." 3 The body of the
message read: "Get to Assange [a]t Ecuadorian Embassy in London and get the pendin~
wiki leaks emails ... they deal with Foundation, allegedly."
39.

On or about A:ugust 2, 2016, Corsi emailed Stone, " Word is friend in embassy

plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging

3

1.
On August 7, 20 17, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for
Roger Stone's Twitter account, @RogerJStoneJr. On September 11, 2017, Chief Judge Beryl A. Howell of the
The relvant
District of Columbia issued a search warrant for Stone's Hotmail address,
results of those search warrants are summarized in the paragraphs which fo llow.

13

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 15 of 31

... Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting
HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump
focus, setting stage for Foundation debacle." Based on my training, experience, and review of
materials in this case, it appears that Corsi's reference to a "friend in embassy [who] plans 2
more dumps" refers to Julian Assange (the user of Target Account 2), the founder of
WikiLeaks, who resided in Ecuador's London Embassy in 2016.
40.

On or about August 16, 2016, Corsi emailed Stone a link to a piece Corsi had

written about Stone titled, "Trump Adviser: Wikileaks Plotting Email Dump to Derail Hillary."
41.

As discussed above, on or about August 21, 2016, Roger Stone directed a

publicly-available tweet at John Podesta, Hillary Clinton' s presidential campaign manager,
stating: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary."
42.

On or about August 31, 2016, Corsi emailed Stone: "Did you get the PODESTA

write-up." STONE replied "Yes."
43.

On or about September 6, 2016, Corsi emailed: "Roger[,] Is NY Post going to use

the Pedesta [sic] stuff?"
44.

On or about October 7, 2016, WikiLeaks began releasing emails hacked from

John Podesta' s account.
45.

WikiLeaks continued to release John Podesta' s hacked emails throughout October

I 0-21, 2016. On October 12, 2016, John Podesta argued publicly that " [it is] a reasonable
assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there' s at least a reasonable belief that [Assange] may have passed this
14

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 16 of 31

information on to [Stone]." Commenting to the Miami Herald on or about that same date, Stone
responded: "I have never met or spoken with Assange, we have a mutual friend who ' s traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I .have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
46.

On or about that same day, October 12, 2016, Corsi emailed Stone on both the

with a subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER
STONE podesta talking points Oct 12 2016.docx." The "talking points" included the statement
that, "Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation." Corsi followed
up several minutes later with another email titled, "Podesta talking points," with the text "sent a
second time just to be sure you go it." Stone emailed Corsi back, "Got them and used them."
47.

On or about the next day, October 13, 20 I 6, Stone sent a private direct message to

Target Account 1 stating, "Since I was all over national TV, cable and print defending
wikileaks and assange against the claim that you are Russian agents and debunking the false
charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking
me- cordially R." Target Account 1 responded, "We appreciate that. However, the false claims
of association are being used by the democrats to undermine the impact of our publications.
Don't go there if you don't want us to correct you."
48.

On or about October 16, 2016, Roger Stone wrote to Target Account 1, "Ha! The

more you \"con-ect\" me the more people think you're lying. Your operation leaks like a sieve.
You need to figure out who your friends are."
15

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 17 of 31

49.

On or about October 17, 2016, Corsi emailed Stone with the subject, "Fwd:

ASSANGE ... URGENT . .. " Corsi wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is he has a set of dead man files that include Hillary. It's
what they used to call a ' Mexican stand offt.]' Only hope is if Trump speaks out to save him[ .)
Otherwise he's dead anyway, once he' s dropped what he has. If HRC wins, Assange can kiss his
life away. Interesting gambit Assange has to play out. He' s called Podesta's bluff and raised him
the election."
50.

The presidential election was held on November 8, 2016.

51.

On or about November 9, 2016, Target Account 1 messaged Roger Stone,

" Happy?" and then wrote, "We are now more free to communicate."
52.

On or about March 27, 2017, Target Account 1 wrote to Roger Stone, "FYI,

while we continue to be unhappy about false \"back channel\" claims, today CNN deliberately
broke our off the record comments."
53.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: " Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true. "

16

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 18 of 31

54.

On or about April 7, 2017, Roger Stone wrote to Target Account 1, " I am JA's

only hope for a pardon the chances of which are actually (weirdly) enhanced by the bombing in
Syria (which I opposed) . You have no idea how much your operation leaks. Discrediting me
only hurts you. Why not consider saying nothing? PS- Why would anyone listen to that asshole
Daniel Ellsberg." Based on my training, experience, and review of materials in this case, I
believe that "JA" refers to Julian Assange, the user of Target Account 2.
55.

On or about April 19, 2017, Assange, using Target Account 2, wrote to Stone,

"Ace article in infowars. Appreciated. But note that U.S. intel is engages in slight of hand
maoevers [sic]. Listen closely and you see they only claim that we received U.S. election leaks
\"not directly\" or via a \"third party\" and do not know \"when\" etc. This line is Pompeo appears
to be getting at with his \"abbeted\". This correspnds to the same as all media and they do not
make any allegation that WL or I am a Russia asset."
56.

On or about June 4, 2017, Roger Stone wrote back to Target Account 2, "Still

nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." Target Account 2
responded, "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
57.

On or about June 10, 2017, Roger Stone wrote to Target Account 2, "I am doing

everything possible to address the issues at the highest level of Government. Fed treatment of
17

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 19 of 31

you and Wikileaks is an outrage. Must be circumspect in this forum as experience demonstrates
it is monitored. Best regards R ." Target Account 2 wrote back, "Appreciated. Of course it is!"
E. Target Account 1 Sends the "Guessed" Password to "

58.

" to

During the events described above, Target Account 1 also engaged in a separate

proviate conversation regarding a "guessed" password to the non-public website
"PutinTrump.org." On or about September 20, 2016, at approximately 9:07PM, Target Account

1 publicly tweeted, " ' Let's bomb Iraq' Progress for America PAC to launch 'PutinTrump.org' at
9:30.a m . Oops pw is
59.

putintrump.org."

On or about September 20, 2016, at approximately 11 :59PM, Target Account 1

sent a private message to a high level individual associated with the Campaign (the "high-level ·
Campaign individual"). 4 The message stated: "A PAC run anti-Trump site '

' is

about to launch. The PAC is a recycled pro-Iraq war·PAC. We have guessed the password. It is
'. See 'About ' for who is behind it. Any comments?"
60.

According to publicly available reporting, at approximately 9:31AM on or about

September 21 , 2016, the website "

" was launched. The website was run by

individuals who stated they wanted to focus attention to what they described as the "dangerous
and unprecedented ties" between Vladimir Putin and Donald J. Trump.
61.

On or about September 21, 2016, at approximately I I :50AM (approximately two

hours after PutinTrump.org went " live" according to publicly available press accounts), the high-

4

These records were obtained via a search warrant signed by Chief Judge Beryl A. Howell of the District of
Columbia on October 12, 2017.

18

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 20 of 31

level Campaign individual sent Target Account 1 a private message: "Off the record I don't
know who that is but I' ll ask around. Thanks."
INFORMATION CONCERNING TWITTER
62.

Twitter owns and operates a free-access social-networking website of the same

name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
described in more detail below.
63.

Upon creating a Twitter account, a Twitter user must create a unique Twitter

usemame and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
usemame, password, and name without having to open a new Twitter account.
64.

Twitter asks users to provide basic identity and contact information, either during

the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
65.

A Twitter user can post a personal photograph or image (also known as an

"avatar") to his or her profile, and can also change the profile background or theme for his or her
19

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 21 of 31

account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.
66.

Twitter also keeps IP logs for each user. These logs contain information about the

user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed hi s or her profile.
67.

As discussed above, Twitter users can use their Twitter accounts to post "Tweets"

of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user' s username (i.e., a list
of all "mentions" and "replies" for that username).
68.

Twitter users can include photographs or images in their Tweets. Each Twitter

account also is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
69.

Twitter users can also opt to include location data in their Tweets, which will

reveal the users' locations at the time they post each Tweet. Thi s "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.
70.

When Twitter users want to post a Tweet that includes a link to a website, they

can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.

20

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 22 of 31

71 .

A Twitter user can "follow" other Twitter users, which means ~ubscribing to

those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that _user (i.e., the user' s "followers" list) and a list of people whom that user follows

(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into " lists" that display on the right
side of the user' s home page on Twitter. Twitter ilso provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
72.

In addition to posting Tweets, a Twitter user can also send DMs to one of his or

her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the in boxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
are stored on Twitter's database.
73.

Twitter users can configure the settings for their Twitter accounts in numerous

ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
will not be sent to the user's phone.
74.

Twitter includes a search function that enables its users to search all public

Tweets for keywords, usemames, or subject, among other things. A Twitter user may save up to
25 past searches.
21

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 23 of 31

75.

Twitter users can connect their Twitter accounts to third-party websites and

applications, which may grant these websites and applications access to the users' public Twitter
profiles.
76.

If a Twitter user does not want to interact with another user on Twitter, the first

user can "block" the second user from following his or her account.
77.

In some cases, Twitter users may communicate directly with Twitter about issues

relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
from using Twitter' s services.
78.

As explained herein, information stored in connection with a Twitter account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user' s account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This " user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, profile contact information, communications,
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
22

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 24 of 31

used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
automatically added to "tweeted" communications. This geographic and timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner' s motive and intent to commit a crime (e.g., information indicating a criminal
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal
evidence from law enforcement).
79.

Therefore, the computers of Twitter are likely to contain all the material described

above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED
80.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
23

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 25 of 31

particularly described in Section I of Attachment B. Upon receipt of the information described in
Section I of Attachment B, government-authorized persons will review that information to locate
the items described in Section II of Attachment B.

CONCLUSION
81.

Based on the forgoing, I request that the Court issue the proposed search warrant.

82.

Pursuant to 18 U.S .C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
83.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

~

AmyArson~

Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this(; ~ay of November, 2017.

&~~

The Honorable Beryl A. Howell
Chief United States District Judge

24

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 26 of 31

ATTACHMENT A
Property to Be Searched
All information that is associated with the Twitter profile with usernames from the period
from July 1, 2015 to the present:
@Wikileaks (twitter.com/wikileaks) (Target Account 1)
@JulianAssange(twitter.com/JulianAssange) (Target Account 2)
that is stored at premises owned, maintained, controlled, or operated by Twitter, a company
headquartered in San Francisco, California.

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 27 of 31

ATTACHMENT B
Particular Things to be Seized
I.

Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following information to the
government for each account listed in Attachment A:
a.

All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers;

b.

All past and current usernames, account passwords, and names associated with
the account;

c.

The dates and times at which the account and profile were created, and the
Internet Protocol ("IP") address at the time of sign-up;

d.

All IP logs and other documents showing the IP address, date, and time of each
login to the account;

e.

All data and information associated with the profile page, including photographs,
"bios," and 'profile backgrounds and themes;

f.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 28 of 31

g.

All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account

(i.e., "mentions" or "replies");
h.

All photographs and images in the user gallery for the account;

1.

All location data associated with the account, including all information collected
by the "Tweet With Location" service;

J.

All information about the account' s use ofTwitter's link service, including all
longer website links that were shortened by the service, ·all resulting shortened
links, and all information about the number of times that a link posted by the
account was clicked;

k.

All data and information that has been deleted by the user;

I.

A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user' s "following" list and "followers" list);

m.

A list of all users that the account has "unfollowed" or blocked;

n.

All "lists" created by the account;

o.

All information on the " Who to Follow" list for the account;

p.

All privacy and account settings;

q.

All records of Twitter searches performed by the account, including all past
searches saved by the account;

r.

All information about connections between the account and third-party websites
and applications;

2

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 29 of 31

s.

All records pertaining to communications between Twitter and any person
regarding the user or the user' s Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.

3

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 30 of 31

II.

Information to be seized by the government
All information described above in Section I that constitutes fruits, evidence, and

instrumentalities of violations of 18 U .S.C. § 1030 (fraud and related activities in connection
with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting) since
March 1, 2016 including, for each user ID identified on Attachment A, information pertaining to
the following matters:
a. Any correspondence regarding hacked emails or other data from:
1.

11.

111.

the Democratic National Committee (DNC)
the email belonging to John Podesta ("the email hack")
any other individual related to the 2016 United States election.

b. Any communications between the Target Accounts and individuals
associated with the DNC email hack;
c. Any communications indicating any advance knowledge or direction,
planning, or control of the email hack;
d. Any communications related to the website PutinTrump.Org.
e. Evidence indicating how and when the Twitter account was accessed or used,
to determine the chronological and geographic context of account access, use,
and events relating to the crime under investigation and to the Twitter account
owner;
f.

Evidence indicating the Twitter account owner's state of mind as it relates to
the crime under investigation;

4

 Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 31 of 31

g. The identity of the person(s) who created or used the user ID, including
records that help reveal the whereabouts of such person(s).
h. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.

5

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 1 of 35

AO 93 (Rev. I l/13) Search and Seizure Warrant

UmrBI STATBS DTSTruCT COURT
for the

District of Columbia
In the Matter of the Search

of

)

(Briefly describe the property to be searched
or identify the person by name and address)

Case: 1'.17-mj-00982
Assigned To . Howell, BerylA.
Assign. Date : 1211912017
Description: Search and Seizure Warrant

)
)
)
)
)

INFORMATION ASSOCIATED WITH

SEARCH AND SEIZURE WARRANT

To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
California
Northern District of
of the following person or propefty located in the
(identify the person or describe the property to be searched and give its location)',

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search

will reveal Qdentifu the person

or describe the property to be seized):

See Attachment B

ilf

January 2, 2018
fuot to exceed t 4 days)
YOU ARE COMMANDED to execute this warrant on or before
in the daytime 6:00 a.m. to 10:00 p.m. ü at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the propefty was taken, or leave the copy and receipt at the place where the
property was taken.

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
Hon. BervlA. Howell
as required by law and promptly return this warrant and inventory to
(United States Magisffate Judge)

ü

Pursuant to 18 U.S.C. $ 3103a(b), I find that immediate notification may have an adverse result listed in l8 U.S'C'
(except
for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
2705
$
property, will be searched or seized þheck the appropriate box)

fl for_days
Date and time issued:

(nottoexceed30)

il

2ù/

until,thefactsjustifying,thelaterspecificdateof

¿//h

//ntu
Judge's signature

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 2 of 35
AO 93 (Rev. I l/13) Search and Seizure Wanant (Page 2)

Return
Case No.:

Inventory made in the presence

Date and time warrant executed

Copy of warrant and inventory left with

of

Inventory ofthe properfy taken and name ofany person(s) seized:

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing

ffi cer's

s

ignature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 3 of 35
AO l0ó (Rev. 04/10) Application

t-or a Search

Warrant

UmreD

STATES

DrsrRrcr Counr

0Ec Í e 20P

for the
Disfrict of Columbia
In the Matter of the Search

of

ûlerk,

üourts

å:-å5iifiåjÍ#,ffiffi*

Case: 1'.17-mi-O0982
Assigned To : Howell, BerYlA.
Assign. Date : 1211912017
Description: Search and Seizure Warrant

(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WTH

APPLICATION FOR A SEARCH WARRANT

, l, à federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the followiñg person or prdperty (identifu the person or describe the
property to be searched and give its location):

See Attachment A.

located in

the

District of

Northern

California

, there is now concealed (dentifu the

person or describe Íhe property to be seized)i
See Attachment B.

This warrant is sought pursuant to

l8 U.S.C. $$ 2703(a), 2703(bX1XA),

The basis for the search under Fed. R. Crirn. P. a I (c) is

and 2703(cXlXA).

(check one or more):

devidence of a crime;
dcontraband, fruits of crime, or other items illegally possessed;

dproperry designed for use, intended for use, or used in committing a crime;
ü a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section
18 U.S.C. S 1030
18 U.S.C. S 371; 2

F ra ud a nd re ated activiti es h !#{:&3:iííK33i 0r,"'.,
Conspiracy against the United States; Aídíng and abetting
Foreign contribution ban
I

52 U.S.C. S 30121

The application is based on these facts:
See attached Affidavit.

f,
f,

Continued on the attached sheet.
Delayed notice of
under l8 U.S.C. $

(give exact ending date if more than 30 days
3 I 03 a, the basis of which is set forth on the attached sheet.

_...._ days

Reviewed by AUSA/SAUSA
Aaron Zelinsky (ASC)

) is requested

Applicant's signature

Amy Anderson, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

12t19t2017

%2",æ
's signature

City and s1¿1s; Washington, D'C

Hon. BerylA. Howell, Chief U.S. District J udge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 4 of 35

FTI.EÞ
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTzuCT oF'r-oT IT]\IRIÁ
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

case:

1

:1

DEC

Ig

20t7

lfå?åTifrå:fffi#mil:' -

7-mj

'onrpffi*
BerYlA.
Assigned To : Howell,
:
1211912017
Date
Assign.
Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy A. Anderson, being first duiy sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT B ACKGROIINT)

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following email account (hereafter the Target Account),
described in more detail in Attachments A and B:

o

(the "Target Account") an email address associated

with

, described further in Attachment A, maintained by

Google;
The information to be disclosed by Google (hereafter "the Provider") and searched by the

government is described in the following paragraphs and in Attachments A and

B. This affidavit

is made in support of an application for a search warrant under 18 U.S.C. $$ 2703(a),
27 03

(b)(I)(A), and 2703 (cX 1 XA).

2.

I am a Special Agent with Federal Bureau of Investigation ("FBI")

assigned to

FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations

of

foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 5 of 35

I have conducted and participated in various investigations involving multiple threat countries

well

as

as

national security.threats and appiicable criminal violations

3.

The facts in this affidavit come fi'om my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended

to show merely that there is sufficient probable cause ftrr the requested warrant and does not set

forth all of my knowledge about this matter.

4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contáins communications relevant to

violations of 18 U.S.C. $ 1030 (fraud and related activities in connection with computers), 52
U.S.C. $ 30121 (foreign contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense
against the United States), and 18 U.S.C. $ 2 (aiding and abetting).

JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as deftned by 18 U.S.C. ç2711.

/d.

$$ 2703(a), (bX1XA), & (cX1XA).

Specifically, the Court is "a district court of the United States (including a magistrate judge

of

such a courl) . . . that has jurisdiction over the offense being investigated." 18 U.S.C.
$

2711(3XAXi). The offense conduct included activities in Washington, D.C.,

including in paragraph

1

as detailed below,

1.

SUMMARY

6.

On or about July 25,2016, Roger STONE emailed Jerome CORSI to "Get to

Assange" in person at the Ecuadorian Embassy and "get pending Wikileaks emails[.]" On or
about August I,2016, STONE also instructed CORSI to have

(the user

of

tlre Target Account) contact Julian ASSANGE. On or about August 2,2016, CORSI responded
2

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 6 of 35

to STONE that the "word is fi'iend in embassy IASSANGE] plans 2 more dumps. One shortly
after I'm

b ack.

2nd in October. Impact planned 1o be. very .damaging.

exposed as in bed w enemy if they are not ready to drop

..

. Time to let Podesta to be

I{RC." Information disclosures

subsequently occurred on or about the times CORSI predicted: On or about August 12,2016, the
day CORSI was scheduled to return to the United States ("shortly after I'm back"), Guccifer 2.0
released hacked information related to the Democratic Congressional Campaign Committee

(DCCC). On October 7 ,2016 ("in October"), Wikileaks began releasing emails hacked from
John Podesta's email account.

7.

, using the Target Account,

On or about November 13,2016,

emailed Stone to congratulate him on "tak[ing] the country back," and stating, "You deserve a

lot of credit and working with you and Jeri Corsi, who is with me now in London has been
great

joy."

a

using the Target Account emailed

On or about January 7,2017,

recipients about John Podesta going "phishing."

PROBABLE CAUSE.

A. Background

i.
8.

on Relevant Individuals
Roger STONE

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the

J

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 7 of 35

Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
.GATES

ii.
g.

Jerome CORSI

Jerome CORSI is a political commentator who, according to publicly available

information, serves as the "'Washington Bureau Chief for Inforwars.com." According to
publicly-available sources, from2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a"/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described fuither below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures
hacked information by Wikileaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

iii.
10.

4

of

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 8 of 35

B.

Disclosure of Hacked Information by Wikileaks During the 2016 Presidential
Campaign
1

1.

According to the public and unclassified intelligenòe report prepared by the

United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June

2016. By March 20I6,the Russian military intelligence (General Staff Main Intelligence
Directorate or "GRU") probably began cyber operations aimed atthe U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other

Democratic Party officials and political figures. By in or about }/ray 20ï6, the GRU had
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South
Capitol Street SE, Washington, D.C. 20003.

12.

The public and unclassified intelligence report assessed that:

a.

The GRU used a Twitter account, "Guccifer 2.0" andthe website

DCleaks.com to release the U.S. victim data obtained in cyber operations publicly and in
exclusives to media outlets and relayed material to Wikileaks.

b.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made

multiple contradictory statements and false claims about his likely Russian identity
throughout the election.

c.

Content that was taken from e-mail accounts targeted by the GRU in

March 2016 appeared on DCleaks.com starting in June 2016.

5

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 9 of 35

d.

The GRU relayed material it acquired from the DNC and senior

Democratic officials to Wikileaks. Wikileaks .was mostly likely, chosen.because of its
self-proclaimed reputation for authenticity. Disclosures through Wikileaks did not
contain any evident forgeries.

e.

The Kremlin's principal international propaganda outlet RT (formerly

Russia Today) has actively collaborated with Wikileaks. RT's editor-in-chief visited

Wikileaks founder Julian ASSANGE at the Ecuadorian Embassy in London in August
z}I3,where they discussed renewing his broadcast contract with RT, according to
Russian and Vy'estern media. Russian media has subsequently announced that RT had
become "the only Russian media company" to partner with V/ikileaks and had received
access to "new leaks

13.

of secret information."

On or about June 14, 2016, the Washington Post reported that "Russian

government hackers" had penetrated the DNC computer network and stole opposition research

on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.

14.

On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack

and began posting hacked documents.

15.

On or about JuIy 22,20ì6,V/ikileaks published about 20,000 emails stolen from

the DNC.

16.

On or about August 12,2016, Guccifer 2.0 released personal cellphone numbers

and email addresses from the files of the Democratic Congressional Campaign Committee

(DCCC).

17.

On or about August 2I,2016, Roger STONE sent a publicly-available tweet

referring to John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it
6

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 10 of 35

will

soon the [sic] Podesta's time in the barrel.

,same day, Stone reiterated that because

#CrookedHillary." In

a C-SPAN interview that

of the work of a "imutual acquaintancel.of both his and

whistleblower in the form
[Assange], the public fcould] expect to see much more from the exiled
of strategically-dun'rped Clinton email batches." He added: "'Well, first of all, I think Julian
Assange is a hero... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the

Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."

18.

On Friday, October 7,2016,at approximately 4:03 P.M., the V/ashington Post

published an article containing a recorded conversation from a2005 Access Hollywood shoot in

which Mr. Trump had made a series of lewd remarks.

lg.

Approximately

a

half hour later, at 4:32 P.M., Wikileaks sent out a public Tweet

reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing
a

link to approxim

ately 2,050 emails that had been hacked from John Podesta's personal email

account. V/ikileaks continued to release John Podesta's hacked emails throughout October 10-

14,2016.

C. Roger STONE's Private Twitter

Messagbs with Guccifer 2.0,

Wikileaks, and Julian

ASSANGE.

20.

As discussed above, on or about July 22,2016, Wikileaks published

approximately 20,000 emails stolen from the DNC.

21.
ooDear

On August 5,2076,Roger Stone published an article on Breitbart.com entitled,

Hillary: DNC Hack Solved,

So

Now Stop Blaming Russia." Stone wrote: "It doesn't

seem to be the Russians that hacked the

DNC, but instead

Guccifer 2.0."

7

a hacker

who goes by the name of

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 11 of 35

22.

On August 12,2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the,leal #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign

Committee (DCCC).

'¿3.

On August

l3,2olti,

Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 hadbeen banned from Twitter. The next day, Guccifer 2.0's

Twitter account was reinstated.

24.

On August 14,20l6,Stone sent a private message on Twitter using

handle
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter
reinstated after having been suspended.l

25.

On August 15,2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating:

"wow. thank u for writing back, and thank u for an article about me!!! did you find an¡hing
interesting in the docs I posted."

26.

On August 16,2016, Stone sent a private message using @RogerJStoneJr asking

Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.

27.

On August 17,2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me

28.

if I can help u anyhow. it would

be

a

greatpleasure to me."

On August 18,2016, Paul Manafoft, Stone's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that

I On or about August7,2017, Chief Judge Beryl A. Howell issued a search warant for the Twitter account
@RogerJStoneJr.

8

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 12 of 35

Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukrairre.

29.
Podesta,

On August 2L,2016, using @RogerJStoneJR, Stone directed a tweet at John

Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the

lsicl Podesta's time in the barrel. #CrookedHillary."

30.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.

And that of course will answer the question of exactly what was erased on that email server."
3

1

.

On Saturday, October 1,2016, using @RogerJStoneJr, Stone Tweeted,

"Wednesday @ Hillary Clinton i s done. #Wiki Leaks.

32.

"

On Sunday, October 2,20\6,MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from

the

balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement

which was part of V/ikileaks' 1O-year anniversary celebration

:

-

- Stone told Infowars that his

intermediary described this release as the "mother load."

33.

On Tuesday, October 4,2016, Stone used @RogerJStoneJr to tweet: "Payload

coming. #Lockthemup."

34.

As discussed above, on Friday, October 7,2016, Wikileaks began to release

emails that had been hacked from John Podesta's personal email account.

35.

On or about October 12,2016, John Podesta

-

referring back to Stone's August

2I,2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that fStone] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
9

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 13 of 35

think there's at least

a reasonable

belief that fAssange] may have passed this information on to

[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I

know is through that channel of communications. I'm not implying I have any influence with

him or that I have aclvanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl

Mills, the Clinton aides, thought were

deleted. I hear that through my emissary."

36.

On or about the next day, Octòber 13, 2016, @RogerJStoneJr sent a private direct

message to the Twitter account

@Wikileaks. The message read: "Since I was all over national

TV, cable and pri.nt defending Wikileaks and
agents and debunking the false charges

assange against the claim that you are Russian

of sexual assault as trumped up bs you may want to

rexamine the strategy of attacking me- cordially

R."

Less than an hour later, @wikileaks

responded by direct message: "We appreciate that. However, the false claims of association are

being used by the democrats to undermine the impact of our publications. Don't go there if you
don't want us to correct you."

37.

On October 16,2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!

The more you \"correct\" me the more people think you're lying. Your operation leaks like a
sieve. You need to figure out who your friends are."

38.

On November 9,2016, one day after the presidential election, @wikileaks sent a

direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately

followed up with another message less than a minute later:
communicate."

10

ooWe

are now more free to

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 14 of 35

39

.

On March 70, 2Al7 , Stone spoke with The Washington Times and acknowledged

he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact

with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's

private message system to do so. Stone provided a copy of the private messages to The
Washington Times.

40.

On or about March 27 ,2017 ,CNN reported that a representative of Wikileaks,

writing from an email address associated with'Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since

I never communicated with Wikileaks, I guess I must be innocent of

charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing

or scope oftheir subsequent disclosures. So I am clairvoyant orjust a good guesser because the

limited things I did predict (Oct disclosures) all came true."

4I.

On or about June 4, 2017,@RogerJStoneJr directly messaged @JulianAssange,

an address associated with Julian Assange in numerous public reports, stating:

"Still

nonsense.

As a journalist it doesn't matter where you get information only that it is accurate and authentic.
The New York Times printed the Pentagon Papers which were indisputably stolen from the

government and the courts ruled it was legal to do so and refused to issue an order restraining the
paper from publishing additional articles.

If the US government moves on you I will bring down

the entire house of cards. V/ith the trumped-up sexual assault charges dropped I don't know
any crime you need to be pardoned for - best regards.

R." That Same day,

of

@JulianAssange

responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most

strongly from those obsessed with taking down Trump trying to squeeze us into a deal."

11

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 15 of 35

42.
reading:

On or about June i0, 2017, @RogerJStoneJr sent a direct message to @wikileaks,

"l am doing everything possible

to address the issues at the highest level of

Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this

forum as experience demonstrates it is monitored. Best regards R."

D. Roger S'l'ONl-'s !-maits with Jerome CORSI and

43.
issued a search

On September 11, 2017 " Chief Judge Beryl A. Howell of the District of Columbia
Emails

l address,

warant for STONE's

recovered pursuant to that search warrant indicated the following:

44.

, using the Target Account, emailed

On or about June 20, 20 6,

STONE and Paul MANAFORT, the Campaign Chairman, asking to "know imrnediately how I
can help" the Campaign.

also wrote that his "research on Rhodes House" was

nearing completion. The "Rhodes House" research appears to be a reference to STONE's

previous tweet on or about October T3,2015 that,

"In

Bill Clinton was expelled from

." Rhodes House is the headquarters of the

Oxford for raping nineteen-year-old
Rhodes Trust, and STONE mentioned

1969,

a month later, as

again to

discussed below.

45.

, using the Target Account, emailed Stone

On or about luly 7,2016,

that he had "my tickets to Cleveland[.] [D]o you have my credential pack?"

appears

to be referencing the Republican National Convention held in Cleveland.

46.

, using the Target Account, forwarded

On or about July 25,20ì6,

an email to STONE and CORSI with the subject line: "Fwd: The

Bill

createa campaign for Donald J Trump in Turkey."

wrote: "Do you want to have a

Gates of Turkey wants to

talk about this? Turkey is for Trump!" Below was a forwarded message sent to the Target
12

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 16 of 35

Account from an individuat who stated that he had been contacted by the "Bill Gates of Turkey,
in regards to creating a robust campaign for Mr Donald J Trump'"

47.
Wikileaks

On or about that same day, .Tuly 25,2016, (approximately three days after

began releasing emaiis hacked from the DNC),

emailed Roger

STONE with the subject line, "You need to get to Assange." The body of the message read: "At
Ecuadorian Embassy in London and get the pending wikileaks emails...they deal with

Foundation, allegedly."

48.

, approximately ninety

According to records

minutes later STONE called CORSI and they spoke for 26 minutes.

49.

Less than two hours after the phone call to CORSI, STONE emailed CORSI at

with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending Wikileaks emails...they deal with Foundation,

allegedly." It appears that STONE cut and pasted the email from

50.

to CORSI.

On or about July 27,2016, then-candidate Donald Trump stated in a press

conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see
that happens. That

51.

if

will be next."

On or about July 28, 2016, Roger STONE called Richard GATES (then the

deputy-chair of the Campaign). The two spoke for approximately twelve minutes.

52.

On or about July 30, 2016, Paul MANAFORT (then the Chairman of the

Campaign) called STONE. The two spoke for approximately one hour and seven minutes. The
Government has analyzedtoll records from January 1,2016 to November 9,2016. Sixty-seven

13

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 17 of 35

minutes is the longest call (by almost a halÊhour) that took place between STONE and

MANAFORT in this time period.

53.

On or about July 31,2016, STONE called GATES and the two spoke for

approximately 5 minutes. Approximately ninety minutes later, STONE emailed CORSI at with
the subject [ine, "Call me MON."'l'he tsody read:

should see Assange[.]

should find Bemie sanders brother who called Bill a Rapist

-

should find

54.

turn him for Trump[.]

or more proof of Bill getting kicked out."
On or about August 2,2016(approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE: "V,/ith family, 25th

wedding anniversary Aug 9. Return Home Aug12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2ndinOct. Impact planned to be very damaging . . .Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,

memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
case,

it appears that CORSI's reference to

a

o'friend in embassy
[who] plans 2 more dumps"

refers to Julian ASSANGE; the founder of Wikileaks, who resided in Ecuador's London

Embassy in2016. As discussed above, Guccifer released information hacked from the DCCC on

August 12,2016 (the date CORSI identified as when he would "return home.").

55.

On or about August 16,2016, CORSI, emailed STONE a link to a piece CORSI

had written about STONE titled, "Trump Adviser:

Hillary."

T4

Wikileaks Plotting Email Dump to Derail

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 18 of 35

56.
.

On or about August 3I,2016, CORSI, using emailed STONE: "Did you get the

Podesta writeup." STONE replied "yes."

57.

On or about September 6,2016, CORSI, emailed STONE: "Roger[,] Is NY Post

going to use the Pedesta [sic] stuff?"

58.

On or about October 7,2016, Wikileaks began releasing the Podesta emails.

59.

On or about October 12,2016,the same day on which Podesta accused STONE of

having advance knowledge of the publication of his emails, CORSI emailed STONE with the
subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that,
"Podesta is at the heart of a Russian-government money laundering operation that benefits

financially Podesta personally and the Clintons through the Clinton Foundation." CORSI
followed up several minutes later with another email to STONE titled, "Podesta talking points,"

with the text "sent a second time just to be sure you go it." STONE emailed CORSI, "Got them
and used them."

60.

On or about October 17,2016, CORSI emailed STONE with the subject, "Fwd:

ASSANGE...URGENT..." CORSI wrote, 'oFrom

a

very trusted source," and forwarded an email

with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them

if

they move to extradite him. My guess is that he has a set of dead man files that include Hillary.

It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he'd dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
15

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 19 of 35

6I.

, using the Target Account, emailed

On or about November 1,2016,

CORSI and STONE with the subject: "Turkey is

a'GO'- FULL GREEN LIGHT."

wrote: "My good friend Husyein will be caking [sic] you he is in the Presidents office. The call
is a go. He has all the information you and DJT need for an article and another October surprise."

CORSI emailed back to the'l'arget Account and S'I'ON.tr: "And I have everything in progress

for

a phone

call tomorrow with DJT. I'm working with Roger Stone to accomplish this

-

Roger

is copied above so he is up to date on status."

62.

using the Target Account, wrote to

On or about November 2,20\6,

STONE and CORSI: "The message from President Erdogan has been sent to you for DJT has

just been sent wrapped in an article about baseball as header. If there is a response please let me

know."

63.
emailed Stone.

, using the Target Account,

On or about November 13,2016,

wrote, o'Well, we did it and now have an opportunity of a lifetime to

take the country back. God is good and we are well placed to steer things well. You deserve a lot

of credit and working with you and Jeri Corsi, who is with me now in London has been a great

joy."

64.

emailed STONE, and

On or about January 7,2017 ,

(using the Target Account) with the subject line, "in case you need his

mail.

.

......." Attached to the message

hours later,

was a scan of a business card for John Podesta. Several

, using the Target Account, replied to all recipients, "Ha... maybe

he

wants to go phishing with us?"

65.

I know from my training and experience that the term'ophishing" is used to refer

to the practice of sending emails purporting to be from a reputable party in order to induce

I6

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 20 of 35

individuals to reveal personal information, including passwords. Public reports indicate that
Podesta's emails were obtaining through a "phishing" scheme.

E.

Use of the Target Account to Communicate

with Other Campaign

Officials

66.

According to documents produced by the Campaign (both voluntarily
has used the Target Account to correspond

)

with

individuals throughout the Campaign. For example, on or about October 23,2015,

,

using the Target Account, emailed
stated that

"[it] was so good talking to you earlier in the week

-

it has sustained me all week.

Thank you for your contribution to this campaign and to our great country. I look forward to

working with you on

67.

a host

of things."

, using the Target Account, emailed

On or about February 28,2016,

, with the subject line "Trump on Putin." The text of the
message read: "Pass this to Donald," and contained an article by CORSI about how Putin

"fear[ed] impact on his plans if Trump takes victory."

68.

On or about

April4, 20ì6,

to introduce an individual who was interested in working with the Trump Campaign.

69.

emailed the Target Account about a book

On or about }r/ray 25,2016,

he was "toying with the idea of

wrote back noting that, "Roger Stone is

writing."

getting me on the list to go to Cleveland [the site of the Republican National Convention]."

70.

, using the Target Account, emailed

On or about August 30, 106

Steve BANNON to report that he had been

writing ¿'op-eds" and strategy pieces, "laboring non

stop for the Trump campaign even though I am all the way over here in Oxford."
T7

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 21 of 35

wïote that he had been "in constant touch with the campaign, Roger Stone, and Jeri Corsi."
suggested a "clever idea

for . . . the first debate." In his idea, then-candidate Trump

would present then-candidate Clinton with a "Writ of Indictment," for "undeniable crimes
against America, destruction of evidence in the form of mails, and theft of funds to your own
personal benefit and enrichment."

71.

, using the Target Account, emailed

On or about October 25,2016,
regarding a piece

had written about how

BACKGROUND CONCERNING EMAIL

72.

In my training and experience, I have learned that the Providers provide avatiety

of on-line services, including electronic mail ("email") and search engines (in the case of Google
and Yahoo), to the

public. The Providers allow subscribers to obtain email accounts at the

domain names identified in the email addresses contained in Attachment

A.

Subscribers obtain

an account by registering with the Providers. During the registration process, the Providers ask

subscribers to provide basic personal information. Therefore, the computers of the Providers are

likely to contain stored electronic communications (including retrieved and unretrieved email)
for their subscribers and information concerning subscribers and their use of services, such as
account access information, email transaction information, and account application information.

In my training and experience, such information may constitute evidence of the crimes under
investigation because the information can be used to identify the account's user or users.

73.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identif ing information when registering for an email account. Such

information can include the subscriber's full name, physical address, telephone numbers and
18

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 22 of 35

other identifiers, alternative email addresses, and, for paying subscribers, means and source

of

payment (including any credit or bank account number). In my training and experience, such
informatio

\

may constitute evidence of the crimes under investigation because the information

can be used to identify the account's user or users. Based on my training and my experience, I

know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identit¡', location' or illicit activities'

74.

tn my training and experience, email providers typically retain certain

transactional information about the creation and use of each account on their systems. This

information can include the date on which the account was created, the length of service, records
of log-in (l.e., session) times and durations, the types of service utilized, the status of the account

(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage

of the account. In addition, email providers often have records of the Internet Protocol address

("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access

the email account.

75.

In my training and experience, in some cases, email account users will

communÍcate directly with an email service provider about issues relating to the account, such as

technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a

result of the communications. In my training and experience, such information may constitute

I9

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 23 of 35

evidence of the crimes under investigation because the information can be used to identify the

account's user or users.

76.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, wh¡t, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
infiormation stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia

of

occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and

time) may indicate who used or controlled the account at a relevant time. Further,

information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the Internet Protocol

(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline

information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may fuither indicate the geographic location of the
account user at a particular time (e.g.,location information integrated into an image or video sent

via email). Last, stored electronic datamay provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit acúme (e.g.,
20

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 24 of 35

communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them fiom law enforcement).

77.

In my training and experience, information such as search history can help to

show the state of mind of an individual atthe time the search was made, as well as the

individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

INFORMATION TO BE SEARCHED AND THING TO BE SEIZED

78.

.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. $$ 2703(a),2703(b)(l)(A) and 2703(c)(I)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information

(including the content of communications) associated with the account in Attachment A and
particularly described in Section I of Attachment B. Upon receipt of the information described

in Section I of Attachments B, government-authorized persons will review that information to
locate the items described in Section II of Attachment B. The items identified in Attachments A

will also be screened by reviewers not on the prosecution team to identify

and filter out

privileged material.

CONCLUSION

79.

STONE instructed CORSI to "Get to Assange" at the Ecuadorian Embassy

regarding upcoming leaks. STONE then instructed CORSI to have

(the user of the

Target Account) talk to ASSANGE. CORSI subsequently emailed STONE that'oword is friend
in embassy IASSANGE] plans 2 morc dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." Two releases, one from Guccifer and the other from
2T

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 25 of 35

Wikileaks, occuned at the times predicted by CORSI. CORSI later emailed STONE "talking
(using the Target Account), STONE, and

points" about Podesta. In January,

CORSI received an email from an individual regarding Podesta, and

wrote back,

using the Target Account, "Ha... maybe he wants to go phishing with us?"

I request that the Court issue the proposed search warant.

80.

Based on the forgoing,

81.

Pursuant to 18 U.S.C. $ 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

nnQunsr ron snÀuNi

82.

I further

request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not

known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously je opardízethat investigation.

Respectfully submitted,

E.

Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me

on tn¡, Íl1of

Decemb er,2017

The Honorable Beryl A. Howell
Chief United States District Judge

22

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 26 of 35

ATTACHMENT A
This warrant applies to information associated with the following Google account:

1.
that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business

with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043'

23

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 27 of 35

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. $ 2703(Ð, the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:

a.

The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and the size and length of each e-mail;

b.

All existing printouts from original storage of all of the electronic

mail

described above in Section I.A. above;
c

All internet search

data including all queries and location data;

d.

All transactional information of all activity of the account described above
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
andlor locations;

e.

All records or other information stored by an individual using the account,

including address books, contact and buddy lists, calendar data, pictures, and files;

f.

All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;

g.

All

records indicating the services available
electroniç mail address described above in Section I.A.;

24

to

subscribers

of

the

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 28 of 35

il.

Information to be Seized by Law Enforcement Personnel

a.

Any and all records that relate in any way to the account described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of l8 U.S.C. $ 1030
(fraud and related activities in connection with computers), 52 U.S.C. $ 30121 (foreign
contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense against the United
States), and 18 U.S.C. g 2 (aiding and abetting) for the period from January 1,2015 to the
present, including:

a.

All records, information, documents or tangible materials that reiate in any
way to communications regarding hacking, release of hacked material, communications
with persons or entities associated with Wikileaks, including but not limited to Julian
Assange;

b.

All records, information, documents or tangible materials that relate in any
, Jerome Corsi, Roger
way to communications or meetings between
Stone, and individuals associate with Wikileaks or Turkey;

b.

All

images, messages? communications, calendar entries, search terms,
and contacts, includingaîy and all preparatory steps taken in fuitherance of the abovelisted offenses;

c.

Communication, information, documentation and records relating to who
created, used, or communicated with the account or identifier, including records about
their identities and whereabouts;

d.

Evidence of the times the account was used;

messages and communications regarding wiping software,
encryption or other methods to avoid detection by law enforcement;

e.

All images,

f.

Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;

g.

Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;

h.

All existing printouts from original

storage which concern the categories

identified in subsection II.A; and

All "address books" or other lists of contacts.

25

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 29 of 35

IN THE LINITED STATES DISTRICT COURT
FOR THE DISTRICT OF' COI,I IMRIA

Case: 1.17-mj-0o982
Assigned To : Howell, BerylA.
Assign. Date : 1211912017
Description: Search and Seizure Warrant

IN THE MATTER OF THE SEARCH OF
TNFORMATION ASSOCI-ATED WITH

MOTION TO SEAL W ARRANT AND REI,ATEI)

IMtr,NTS AND
2705

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit

in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from

notiffing any person of the Warrant pursuant to 18 U.S.C.

$

2705(b). In regard to the non-

disclosure, the proposed Order would direct Google, an electronic communication and/or remote

computing services provider headquartered in Mountain View, California not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further ãrder of the Court.

JURISDICTION AND LEGAL BACKGROUND

l.

The Court has the inherent power

to seal court fìlings when appropriate,

including the Warrant. lJnited States v. Hubbard,650 F.2d 293,

31 5-

l6 (D.C. Cir.

1980) (citing

Nixonv. llarner Communications, 1nc.,435 U.S. 589, 598 (1978)). The Court may also

seal the

Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality

the Warranf . See lI/ashington Post v. Robinson, 935

2.

F

of

.2d 282,287 -89 (D.C. Cir. 1991).

In addition, this Court has jurisdiction to issue the requested order because it is'oa

court of competent jurisdiction" as defined by 18 U.S.C. ç 2711. Specifically, the Court is a
"district court of the United States . . . that

- has jurisdiction over the offense

being investigated."

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 30 of 35

l8'U.S.C. ç2711(3XAXi). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occurred within Washington, D.C. See 18 U.S.C. ç 3237.

3.
U.S.C.

$

Further, the Court has authority to require non-disclosure of the Warrant under

2705(b). Google provides an "electronic communications service,"

as defined

l8

in l8

U.S.C. $ 2510(15), and/or "remote computing service," as defined in 18 U.S.C.ç 271l(2). The
Stored Communications Act ("SCA"), 18 U.S.C. çç2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search

warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain

basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other

"non-content" information using

a court order, and Section 2703(a)-(bXlXA) allows

the

Government to obtain contents of communications using a search warrant. See 18 U.S.C. 5 2703.

4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,

Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such

notification. In relevant part, Section 2705(b) provides as follows:l

A governmental
(b) Preclusion of notice to subject of governmental access.
commanding
for
an
order
a
court
may
apply
to
2703
..
.
entity acting under section
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to noti$ any other person of the existence of the warrant,
subpoena, or couft order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result
(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;

in-

I Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
process
$ 2703(bX I )(B), but the Government does not seek to use the proposed Order for any legal

under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 31 of 35

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying atrial
18 U.S.C. $

2705(b). The United States District Court for the District of Columbia has made clear

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [slc] fìnds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under $ 2705(b), the

court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under $ 2705(b), the court is required to
issue the non-disclosure order.

In re Applicationfor Order of Nondisclosure Pursuant to I8
Subpoena #GJ2014031422765,41 F. Supp. 3d

5.

U.S.C. S 2705(b)

for

Grand Jury

l, 5 (D.D.C. 2014).

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Google not to notify any other person (except attorneys for Google for the purpose

of

receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Couft.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6.

At the present time, law

enforcement officers

of the FBI are conducting

an

investigation into violations related to 1S U.S.C. $ 1030 (fraud and related activities in connection

with computers), 52 U.S.C. $ 30121 (foreign contribution ban), l8 U.S.C. $ 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. $ 2 (aiding and abetting), arising out
, and others. The investigation in ongoing, and

of the conduct of Roger Stone,

individuals associated with these offenses are not aware of the investigation. If they are made
awaro of the existence and contents of this search warrant, they may seek to delete additional
information contained in online platforms or otherwise destroy records related to the investigation.
3

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 32 of 35

REOUEST FOR SEALING AND NON-DISCLOSURE
7

.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal

advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the

full scope of which

is neither

public nor known to the targets of the investigation, and its disclosure may aleft these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potentialtargets would

be immediately prompted to destroy or conceal incriminating evidence, alter their operational
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid

future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potentia

I targetcould quickly

and easily destroy or encrypt digital

evidence relating to their criminal activity.

8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this

confidential investigation

will

continue

for the next year or longer. However,

should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no

longer needed, the Government will notif, the Court and seek appropriate relief.

9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses.

,See

l8 U.S.C.

$ 2705(bX2)-(5). Because of such potential jeopardy to the investigation, there also exists

4

a

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 33 of 35

compelling governmental interest in confidentiality to justify the government's sealing request.
See

Robinson, 935 F.2d at 287 -8g.

10.

Based on prior dealings with Google the United States is aware that, absent a court

order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is

Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer

of the existence of the warrant prior to producing the material sought.

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and fufthermore, that the Court command

Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or

until further order of the Court.
Respectfully subm itted,

ROBERT S. MUELLER, III
Special Counsel

Dated:

lzlltt¿r,l?

By:
Aaron S.J.
The Spec
(202)-s

5

's Office
37

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 34 of 35

FTI.EÞ
DEC

I g 20r

COURT ctsrk, u,s. Disrricr & Bankrunrcv
IMRTA {;ourté
for ttreÐistrietof Cotirünlia:

IN THE trNtrED STATES DISTRICT
FOR THE DISTRICT oF COt.I

Case: 1 .17 -mj-A0982
Assigned To : Howell, BerylA.
Assign. Date : 1211912017
Description: Search and Seizure Warrani

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

ORDER

The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application arrd affidavit in support thereof (collectively the "Warrant"),

and

to

require Google, an electronic communication and/or remote computing service

headquartered

s

at 1600 Amphitheatre Parkway, Mountain View, California not to disclose the

existence or contents of the Warrant pursuant

to l8 U.S.C.

$ 2705(b)'

The Court finds that the United States has established that a compelling governmental
interest exists

tojustiS the requested

sealing, and that there is reason to believe that notification

of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate

witnesses. See t8 U.S.C..$ 2705(bX2)-(5).

IT IS TIIEREFORE ORDERED that the motion is hereby GRANTED,

and that the

warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 35 of 35

IT IS FURTHER ORDERED

that, pursuant

to l8 U.S.C. $ 2705(b), Google and its
the Warrant to any ôtliei' þilrion' (eiðêþt

or

attorneys for Google for the purpose of receiving legal advice) for a period of one year or until

further order of the Court.

LE BERYL A. HOWELL
THE HON
CHIEF UNITED STATES DISTRICT JUDGE

J /f

talf

2

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 1 of 38

AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)
)

INFORMATION ASSOCIATED WITH VARIOUS APPLE
ACCOUNTS

)
)
)

Case: 1:18-sc-00662
Assigned To : Howell, Beryl A.
Assign. Date : 3/14/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A.

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search wi 11 reveal (identify the person or describe the property to be seized):
See Attachment B.

YOU ARE COMMANDED to execute this warrant on or before
March 28, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Be I A. Howell
(United States Magistrate Judge)

0 Pursuant to 18 U .S.C. § 3103a(b), I find that immediate notification may have an adverse result Iisted in 18 U .S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30)
until, the facts justifying, the later specific date of

•

Date and time issued:

;:;/J f/ Z£J ;g a,;f ~ 'f_zf;n_ __~-----~t'/_•~-¼
-~---- Judge 's signature

City and state:

Washington, DC

- -- - - - - - -- - - -

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 2 of 38

AO 93 (Rev. l J/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 3 of 38

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Apple Accounts:

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
with offices located at 1 Infinite Loop, Cupertino, California 95014.

26

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 4 of 38

ATTACHMENT B
Particular Things to be Seized

I.

Information to be disclosed by Apple

To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
a.

All records or other information regarding the identification of the account, to

include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, methods of connecting, and means and source of payment
(including any credit or bank account numbers);
b.

All records or other information regarding the devices associated with, or used in

connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
27

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 5 of 38

Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.

The contents of all emails associated with the account, including stored or

preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.

The contents of all instant messages associated with the account, including stored

or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;

,.
e.

The contents of all files and other records stored on iCloud, including all iOS

device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address

28

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 6 of 38

books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
device settings, and bookmarks;
f.

All activity, connection, and transactional logs for the account (with associated IP

addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g.

All records and information regarding locations where the account was accessed,

including all data stored in connection with Location Services;
h.

All records pertaining to the types of service used;

1.

All records pertaining to communications between Apple and any person

regarding the account, including contacts with support services and records of actions taken; and

J.

All files, keys, or other information necessary to decrypt any data produced in an

encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

29

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 7 of 38

II.

Information to be Seized by Law Enforcement Personnel
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
b.
All images, messages, communications, calendar entries, search terms,
and contacts, including any and all preparatory steps taken in furtherance of the abovelisted offenses;
c.
Communication, information, documentation and records relating to who
created, used, or communicated with the account or identifier, including records about
their identities and whereabouts;
d.

Evidence of the times the account was used;

e.
All images, messages and communications regarding w1pmg software,
encryption or other methods to avoid detection by law enforcement;
f.
Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g.
Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h.
All existing printouts from original storage which concern the categories
identified in subsection II.A; and
1.

All "address books" or other lists of contacts.

30

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 8 of 38
AO I 06 (Rev 04/10) App lication for a Search Warran t

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly de.rcrih the proper/JI rob.~ .1·eardred
or idem ify 1h person by na111e ar,d address)

INFORMATION ASSOCIATED WITH VARIOUS APPLE
ACCOUNTS

)
)
)
)
)
)

MAR f 4 2018
_Glerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1: 18-sc-00662
Assigned To : Howell, Beryl A
Assign. Date : 3/14/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A.

located in the

District of
Northern
- -- - - -- -

person or describe the property to be seized):

-- - --California
- - ----- , there is now concealed (identify the

See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A), and 2703(c)(1 )(A).

The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
ref evidence of a crime;

ref contraband, fruits of crime, or other items illegally possessed;
rJ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

ode Section
18 U.S.C. §§ 2, 3, 4, 371, 1343
and 1349; and
52 U.S.C. § 30121(a)(1)(C)

Offense Description
Aiding & Abetting (§2); Accessory after the Fact (§3); Misprison of a Felony (§4);
Conspiracy (§371 ); Computer Fraud (§1030); Wire Fraud (§1343); Attempt and
Conspiracy to Commit Wire Fraud (§1349); and Foreign Expenditure Ban (§30121)

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days:
under 18U.S.C.§3103a, the basis of which is set forth on the attached sheet.

&-4 /44~

Reviewed by AUSA/SAUSA:
!Aaron Zelinsky (ASC)

) is requested

=

Curtis Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

3/14/2018
Judge 's signature

City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 9 of 38

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH
VARIO US APPLE ACCOUNTS

MAR 14 2018
Clerk , -·-·
,, c: ..,,oo
1~+•/~• • a .
v, a anM. t
Court11 tor th ·District at·Col~~ik-----

Case: 1: 18-sc-00662
Assigned To : Howell, Beryl A,
Assign . Date : 3/14/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
INTRODU TION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the following Apple Accounts:

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
with offices located at llnfinite Loop, Cupertino, California 95014. The information to be
disclosed by Apple and searched by the government is described in the following paragraphs and
in Attachments A and B. This affidavit is made in support of an application for a search warrant.
2.

I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of

investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 10 of 38

4.

Based on my training and experience and the facts as set forth in this affidavit,

---- - - - -----there is-probable-Gause-t0-believe-that-the-T'-arget--Accounts--00ntain--eommunications relevant-to -- - --- - ---- violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy),, 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349
(attempt and conspiracy to commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution
ban) (the "Subject Offenses"). 1
5.

As set forth below, Roger STONE communicated directly via Twitter with

WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used to disseminate hacked
information. STONE, using his

Account, also emailed instructions to Jerome CORSI to

"Get to Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]"
CORSI emailed STONE back that it was "Time to let more than Podesta to be exposed" (before
any of Podesta's emails were leaked). After Podesta's emails were leaked, CORSI emailed
STONE "talking points" about Podesta. CORSI also emailed Stone to convey information "from
a very trusted source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures.
BANNON also sent text messages to STONE discussing potential upcoming leaks by
ASSANGE. The Target Accounts are STONE's iCloud accounts, which are registered to the
email accounts STONE used to communicate with CORSI.

JURISDICTION

1

Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent
expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id. § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").

2

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 11 of 38

6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

------- ----c-0mpetent-jur-isdieti0n?2-as-de-fined--by-l--8--{:1.,.S"G,--§--2'.7-l--l--,-/da-§~-2-70J(aj,fbj(--1-)E-A0,&-(-G-)E-I-)(Aj.
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 271 l(J)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 7.

PROBABLE CAUSE
A. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed
Hacking Activity during the 2016 Presidential Election
7.

On October 7, 2016, the U.S. Department of Homeland Security and Office of the

Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. 2 In the report, the USIC
assessed the following:
8.

The U.S. Intelligence Community (USIC) is confident that the Russian

Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to

2

"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 20 I 6, available at ttps://www.dhs.gov/news/2016/10/07 /joint-statement-departmenthomeland-security-and-office-director-national.

3

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 12 of 38

influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
- -that-only Russia's senior-most officials could have authorized these activities
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." 3 In the report, the USIC
assessed the following:
10.

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed

at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
11.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
12.

With respect to hacking activity, the USIC assessed: "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber

3

"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_2017 _ 0 l .pdf.

4

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 13 of 38

operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Paiiy officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
13.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
1.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with j oumalists.
A. Roger Stone's Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
2.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign.
3.

As discussed further below, Stone made a number of public references to

WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
Twitter with Guccifer 2.0.
4.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
· hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
5

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 14 of 38

5.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
6.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
7.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
8.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone

6

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 15 of 38

numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
9.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
Twitter account was reinstated.
10.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
11.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
12.

On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John

Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."

7

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 16 of 38

13.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
14.

On Saturday, October 1, 2016, using@RogerJStoneJr, Stone Tweeted,

"Wednesday@ HillaryClinton is done. #WikiLeaks."
15.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of WikiLeaks' 10-year anniversary celebration - Stone told Info wars that his
inten,nediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
used @RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
16.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
17.

Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
18.

WikiLeaks continued to release John Podesta's hacked emails throughout October

10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 CSP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to

8

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 17 of 38

[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who ' s traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
19.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser·because the
limited things I did predict (Oct disclosures) all came true."

B. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
20.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr.
21.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
9

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 18 of 38

22.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
23.

On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!

The more you \"correct\" me the more people think you're lying. Your operation leaks like a
sieve. You need to figure out who your friends are."
24.

On November 9, 2016, one day after the presidential election, @wikileaks sent a

direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately
followed up with another message less than a minute later: "We are now more free to
communicate."
25.

In addition, @RogerJStoneJr also exchanged direct messages with Julian

Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
messaged @JulianAssange, an address associated with Julian Assange in numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issu~ an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

10

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 19 of 38

26.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."
C. Roger Stone's Private Email and Text Messages Regarding WikiLeaks, Julian
Assange, Russia, and John Podesta

27.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

. On October

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's

address,

. Information recovered pursuant to those search warrant indicated the
following:
28.

On July 25, 2016, STONE sent an email from his

Account to Jerome

CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
WikiLeaks emails ... they deal with Foundation, allegedly."
29.

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed the

Account, "Word is

friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much
of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
11

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 20 of 38

[who] plans 2 more dumps" refers to Julian AS SAN GE, the founder of WikiLeaks, who resided
in Ecuador's London Embassy in 2016.
30.

On or about August 5, 2016,

, an associate of STONE's emailed

him a link to a poll indicated that Clinton lea Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night."

subsequently

stated to investigators that, around the same time, STONE told him he had gone to London to
meet ASSANGE.

also stated that in 2018,

told STONE he would be

interviewed by the FBI and would have to divulge the conversation about meeting AS SAN GE.
STONE told
31.

he was joking and had not actually met Assange.
On or about August 16, 2016, CORSI emailed STONE a link to a piece CORSI

had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to Derail
Hillary."
32.

On August 19, 2016, Bannon sent Stone a text message asking ifhe could talk

that morning. On August 20, 2016, Stone replied, "when can u talk???"
33.

On or about August 31, 2016, CORSI emailed STONE: "Did you get the Podesta

writeup." STONE replied "yes."
34.

On September 4, 2016, Stone texted Bannon that he was in New York City for a

few more days, and asked if Bannon was able to talk.
35.

On or about September 6, 2016, CORSI emailed STONE: "Roger[,] Is NY Post

going to use the Pedesta [sic] stuff?"
36.

On September 7, 2016, Stone and Bannon texted to arrange a meeting on

September 8, 2016 at the Warner Center in New York.

12

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 21 of 38

37.

On September 7, 2016, Bannon texted Stone asking him ifhe could "come by

trump tower now???"
38.

On September 8, 2016, Stone and Bannon texted about arranging a me~ting in

New York.
39.

On October 3, 2016, an associate of Stone emailed Stone and asked: "Assange -

what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he doesn't call me
back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled." The
associate forwarded the email to Bannon and wrote: "You should call Roger. See below. You
didn't get from me." Bannon wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
40.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the lJ.S. election process." AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next 10 weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
41.

Later that day, BANNON emailed STONE, "What was that this morning???"

STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer

13

is a big democrat."

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 22 of 38

42.

When BANNON spoke with investigators during a voluntary proffer on February

14, 2018, he initially denied knowing whether the October 4, 2017 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
43.

On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.

44.

On or about October 12, 2016, the same day on which Podesta accused STONE of

having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
email accounts, with a subject line "Podesta talking points." Attached to the email was a file
labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The "talking points"
included the statement that "Podesta is at the heart of a Russian-government money laundering
operation that benefits financially Podesta personally and the Clintons through the Clinton
Foundation." CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you go it." STONE emailed
CORSI back via the
45.

Account, "Got them and used them."

On or about October 17, 2016, CORSI emailed the STONE with the subject,

"Fwd: AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded
an email with the header information stripped out, showing only the body text. The email read,
"Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on
them if they move to extradite him. My guess is that he has a set of dead man files that include
Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out
to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins,

14

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 23 of 38

Assange can kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's
bluff and raised him the election."
46.

On or about January 7, 2017,

emailed STONE, CORSI, and

with the subject line, "in case you need his mail. ........ " Attached to the
message was a scan of a business card for John Podesta. Several hours later,

replied

to all recipients: "Ha ... maybe he wants to go phishing with us?"
47.

I know from my training and experience that the term "phishing" is used to refer

to the practice of sending emails purporting to be from a reputable party in order to induce
individuals to reveal personal information, including passwords. Public reports indicate that
Podesta's emails were obtaining through a "phishing" scheme.
D. STONE's Recent Public Statements Regarding Contact with Assange
48.

As described above, STONE stated that on October 12, 2016 that he was in

contact with ASSANGE via a "a mutual friend who's traveled to London several times," and that
"everything I know is through that channel of communications."
49.

On March 13, 2018, the Washington Post published an article about STONE's

previous claims of contact with Assange. 4 The cited an anonymous source who claimed to have a
conversation with STONE in the "spring of 2016" where STONE indicated that he had learned
from "Julian Assange that his organization had obtained emails that would torment senior
Democrats such as John Podesta," and that the conversation occurred before it became publicly
known that hackers had obtained the "emails of Podesta and of the Democratic National

4

https://www.washingtonpost.com/politics/roger-stone-claimed-contact-with-wikileaks-founder-julian-assange-in20 l 6-according-to-two-associates/20 l 8/03/l 3/a263 f842-2604- l l e8-b79d-t3d93 I db7f68_ story.html?hpid=hp_rhptop-table-main_ stone-656am%3Ahomepage%2Fstory

15

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 24 of 38

Committee." The article also cited

statements that STONE stated he had spoken to

ASSANGE. The article cited STONE denying any advance notice about the hacked emails or
any "contact with Assange." The Article stated that STONE "said he only recalled having one
conversation with anyone in which he alluded to meeting the WikiLeaks founder - a comment he
said he made as a joke to Nunberg." STONE was quoted as stating, "The allegation I met with
Assange, or asked for a meeting or communicated with Assange, is provably false."
50.

The article also stated that STONE told the House Intelligence Committee in

September 2017 that his August 21 tweet was meant as a prediction that Podesta's business
opportunities would come under scrutiny after Paul MANAFORT was forced to resign amid
allegations about his work for a pro-Russian party in Ukraine. MANAFORT resigned from the
Campaign on or about August 19, 2016. CORSI's email to STONE about WikiLeaks and "Time
to let more than Podesta to be exposed as in bed w_enemy if they are not ready to drop HRC,"
occurred on August 2, 2016, over two weeks before MANAFORT's resignation.
E. STONE's use of the Target Accounts

51.

On November 21, 2017, Chief Judge Beryl A. Howell signed an order pursuant to

18 U.S.C. §2703(d) for header information related to the Target Accounts. Pursuant to that
order, Apple prov_ided the following information:
52.

Target Account 1 has the Apple ID

, an email address

associated with STONE discussed above. The associated email address is
. The company registered as the account user is Citroen Associates, a
company linked to STONE by investigators. Additionally, the "rescue email" is
, which is STONE's

account. IP login information shows that the

account was in use as of the time of the service of the Order According to Apple, the system has
16

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 25 of 38

been set to a "Full iCloud" backup. I know from my training and experience that a full iCloud
backup can include other databases and messaging features, including third party messaging
programs. Often individuals are unaware that the information is being stored in their iCloud, and
therefore the iCloud may contain additional communications not contained in the standard mail
accounts. STONE's email account (

) also contains messages regarding

his iCloud account, including an indication that iCloud storage was "full." STONE also used
Target Account 1's associated iCloud email account,

, to send an email

in March, 201 7.
53.

Target Account 2 has the Apple ID

, an email address

associated with STONE. Target Account 2 is registered to "Roger Stone," and according to
information provided by Apple pursuant to the§ 2703(d) order, contains a full iCloud backup as
well. The account is currently locked.

INFORMATION REGARDING APPLE ID AND iCLOUD 5
54.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.

The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htlp://images.applc.com/ privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://suppo11.apple.co111/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/;
"iCloud: iCloud storage and backup overview," available at https://suppo1i.apple.com/kb/PT-l l 25 L9; and "iOS
Security," available at lmp://images.app le.com/privacy/docs/iO, Security Guide.pdf.

17

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 26 of 38

55.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the serv,ices include email, instant messaging, and file storage:
a.

Apple provides email service to its users through email addresses at the

domain names mac.com, me.com, and icloud.com.
b.

iMessage and FaceTime allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
c.

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
d.

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs enables iCloud to be used
to synchronize webpages opened in the Safari web browsers on all of the user's Apple devices.
iWorks Apps, a suite of productivity apps (Pages, Numbers, and Keynote), enables iCloud to be
used to create, store, and share documents, spreadsheets, and presentations. iCloud Keychain

18

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 27 of 38

enables a user to keep website usemame and passwords, credit card information, and Wi-Fi
network information synchronized across multiple Apple devices.
e.

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
f.

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices.
g.

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
h.

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and dow11loaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased .through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.
56.

Apple services are accessed through the use of an "Apple ID," an account created

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
57.

An Apple ID takes the form of the full email address submitted by the user to

create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a

19

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 28 of 38

third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
58.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
59.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, and "mail logs" for activity over an Apple-provided email

20

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 29 of 38

account. Records relating to the use of the Find My iPhone service, including connection logs
and requests to remotely lock or erase a device, are also maintained by Apple.
60.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, arid information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
61.

Apple provides users with five gigabytes of free electronic space on iCloud, and

users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWorks and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
21

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 30 of 38

videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, and other data. Records and data associated with third-party apps
may also be stored on iCioud; for example, the iOS app for WhatsApp, an instant messaging
service, can be configured to regularly back up a user' s instant messages on iCloud. Some of
this data is stored on Apple's servers in an encrypted form but can nonetheless be decrypted by
Apple.
62.

In my training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
63.

The stored communications and files connected to an Apple ID may provide

direct evidence of the offenses under investigation. For example, stored iMessage
communications, voicemails, and emails may contain conversations with foreign government
officials similar to those described above in PAPADOPOULOS 's Linkedin and Gmail accounts.
Based on my training and experience, instant messages, emails, voicemails, photos, videos, and
documents are often created and used in furtherance of criminal activity, including to
communicate and facilitate the offenses under investigation.
64.

In addition, the user's account activity, logs, stored electronic communications,

and other data retained by Apple can indicate who has used or controlled the account. This "user
22

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 31 of 38

attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, subscriber information, email and messaging logs,
documents, and photos and videos (and the data associated with the foregoing, such as geolocation, date and time) may be evidence of who used or controlled the account at a relevant
time. As an example, because every device has unique hardware and software identifiers, and
because every device that connects to the Internet must use an IP address, IP address and device
identifier information can help to identify which computers or other devices were used to access
the account. Such information also allows investigators to understand the geographic and
chronological context of access, use, and events relating to the crime under investigation.
65.

Account activity may also provide relevant insight into the account owner's state

of mind as it relates to the offenses under investigation. For example, information on the account
may indicate the owner's motive and intent to commit a crime (e.g., information indicating a
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort
to conceal evidence from law enforcement).
66.

Other information connected to an Apple ID may lead to the discovery of

additional evidence. For example, the identification of apps downloaded from App Store and
iTunes Store may reveal services used in furtherance of the crimes under investigation or
services used to communicate with co-conspirators. For instance, ifthere are secured and
encrypted communication applications downloaded from the App Store, that can show an
attempt to hide information from investigators. In addition, emails, instant messages, Internet
activity, documents, and contact and calendar information can lead to the identification of coconspirators and instrumentalities of the crimes under investigation.
23

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 32 of 38

67.

Therefore, Apple's servers are likely to contain stored electronic communications

and information concerning subscribers and their use of Apple's services. In my training and
experience, such information may constitute evidence of the crimes under investigation including
information that can be used to identify the account's user or users.

CONCLUSION
68.

STONE instructed CORSI to "Get to Assange" at the Ecuadorian Embassy

regarding upcoming leaks, and CORSI emailed Stone on the

Account that it was "Time

to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC."
STONE also texted and emailed BANNON about potential forthcoming leaks from ASSANGE
and WikiLeaks. There is therefore probable cause to believe that evidence of the DNC hack and
the hacking of other emails associated with the 2016 election will be found in the information
associated with the Target Accounts.
69.

Based on the forgoing, I request that the Court issue the proposed search warrant.

70.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

24

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 33 of 38

REQUEST FOR SEALING
71.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
, ·t.

4 -

d/{,,. . .

• ----

li-s-Heide
Special Agent
Federal Bureau oflnvestigation

Subscribed and sworn to before me on this

d .faf

of March, 2018.

~;/~

The Honorabl Beryl A. Howell
Chief United States District Judge

25

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 34 of 38

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Apple Accounts:

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
with offices located at 1 Infinite Loop, Cupertino, California 95014.

26

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 35 of 38

ATTACHMENT B
Particular Things to be Seized

I.

Information to be disclosed by Apple

To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
a.

All records or other information regarding the identification of the account, to

include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, methods of connecting, and means and source of payment
(including any credit or bank account numbers);
b.

All records or other information regarding the devices associated with, or used in

connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
27

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 36 of 38

Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.

The contents of all emails associated with the account, including stored or

preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.

The contents of all instant messages associated with the account, including stored

or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;

,.
e.

The contents of all files and other records stored on iCloud, including all iOS

device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address

28

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 37 of 38

books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
device settings, and bookmarks;
f.

All activity, connection, and transactional logs for the account (with associated IP

addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g.

All records and information regarding locations where the account was accessed,

including all data stored in connection with Location Services;
h.

All records pertaining to the types of service used;

1.

All records pertaining to communications between Apple and any person

regarding the account, including contacts with support services and records of actions taken; and

J.

All files, keys, or other information necessary to decrypt any data produced in an

encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

29

 Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 38 of 38

II.

Information to be Seized by Law Enforcement Personnel
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
b.
All images, messages, communications, calendar entries, search terms,
and contacts, including any and all preparatory steps taken in furtherance of the abovelisted offenses;
c.
Communication, information, documentation and records relating to who
created, used, or communicated with the account or identifier, including records about
their identities and whereabouts;
d.

Evidence of the times the account was used;

e.
All images, messages and communications regarding w1pmg software,
encryption or other methods to avoid detection by law enforcement;
f.
Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g.
Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h.
All existing printouts from original storage which concern the categories
identified in subsection II.A; and
1.

All "address books" or other lists of contacts.

30

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 1 of 35
AO 93 (Rev. l l/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE GOOGLE
ACCOUNT

,
)

Case: 1:18-sc-01518
Assigned To : Howell, Beryl A.
Assign. Date: 5/4/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A.

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property

described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B.

YOU ARE COMMANDED to execute this warrant on or before
May 18, 2018
(not to exceed 14 days)
';$ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the awropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
Judge 's signature

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 2 of 35
AO 93 (Rev 11/13) Search and Seizure Warrant (Page 2)

Return
Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 3 of 35

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THE GOOGLE ACCOUNT

Cferk, U.S. District & Bankrupicy
Gourts for tirn District of Columbl&

Case: 1: 18-sc-01518
Assigned To : Howell, Beryl A.
Assign. Date: 5/4/2018
Description: Search & Seizure Warrant

ORDER

The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Google LLC, an electronic communication and/or remote computing services with
headquarters in Mountain View, California, not to disclose the existence or contents of the Warrant
pursuant to !8 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the

warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

Page 1 of2

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 4 of 35

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year unless
otherwise ordered by the Court.

Date

41/Y>lf

THE HONORABLE BERYL A. HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

Page 2 of2

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 5 of 35
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the

MA\t
•'II·\!

District of Columbia

•

!,

·r

2018

,,t,c,rk, U.S. District & Bankruptcy

In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THE GOOGLE
ACCOUNT

)
)
)
)
)
)

,,gurt~ lar 1hli-•D1strlctof Gollf/nh]•
C ase.1:18-sc-01518
·'
.

Ass!gned To: Howell, Beryl A
·
Assign. Date: 5;412018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give ifs location):

See Attachment A.
located in the

Northern

District of _____C,-_a-,.l"'if.=o,..rn~ia..__ _ _ , there is now concealed (identijj, the

person or describe the property to be seized):

See Attachment B.

The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):

~ evidence of a crime;

ief contraband, fruits of crime, or other items illegally possessed;
r'lf property designed for use, intended for use, or used in committing a crime;
D a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. § 2
· et al.

Offense Description
aiding and abetting
see attached affidavit

The application is based on these facts:
See attached Affidavit.

r;/

Continued on the attached sheet.

D Delayed notice of _ _ days (give exact ending date if more than 30 days: ______ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:

~44

•Aaron Zelinsky (Special Counsel's Office)

Andrew Mitchell, Supervisory Special Agent, FBI

Appbcant's signature

Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 6 of 35

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THE GOOGLE ACCOUNT

MAY · · ti 1018
Clerk, LLS. District & Bar1i<ruptcy
Gourts !or tirn District of Co\urntHfl

Case: 1:18-sc-01518
Assigned To : Howell, Beryl A
Assign. Date: 5/4/20 18
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF AN
APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, having been first duly sworn, hereby depose and state as follows:
1.

I make this affidavit in support of an application for a search warrant for

information associated with the following Google Account:

(hereafter

the "Target Account 1"), that is stored at premises owned, maintained, controlled or operated by
Google, Inc., a social networking company headquartered in Mountain View, California
("Google"). The information to be searched is described in the following paragraphs and in
Attachments A and B. This affidavit is made in support of an application for a search warrant
under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A)to require Google to disclose to
the government copies of the information (including the content of communications) further
described in Attachment A. Upon receipt of the information described. in Attachment A,
government-authorized persons will review that information to locate the items described in
Attachment B.
2.

I am a Special Agent with the Federal Bureau of Investigation (FBI), and have

been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 7 of 35

to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision ofa felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a
false statement); 18 U.S.C. §1651 (perjury); 18 U.S.C. § 1030 (unauthorized access ofa
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"). 1
5.

As set forth below, in May 2016, Jerome CORSI provided contact information for
to Roger STONE. In July 2016,

needed to meet with then-candidate Trump "alone." In August 2016,

also told STONE that he
told STONE

that there was an "OCTOBER SURPRISE COMING" and that Trump, "[i]s going to be defeated
unless we intervene. We have critical intel." In that same time period, STONE communicated
directly via Twitter with WikiLeaks, Julian AS SANGE, and Guccifer 2.0. On July 25, 2016,
STONE emailed instructions to Jerome CORSI to "Get to Assange" in person at the Ecuadorian
Embassy and "get pending WikiLeaks emails[.]" On August 2, 2016, CORSI emailed STONE
back that,"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging." On August 20, 2016, CORSI told STONE that they
needed to meet with.

1

to determine "what if anything Israel plans to do in Oct."

Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent

expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").

2

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 8 of 35

(the Target Account) is

Google Account, which

used to communicate with STONE and CORSI.

JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a comt of

competent jurisdiction" as defined by l8 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisc\iction over the offense being investigated." 18 U.S.C.
§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,

including in paragraph 8.

PROBABLE CAUSE
A.

U.S. Intelligence Community (USIC) Assessment of Russian GovernmentBacked Hacking Activity during the 2016 Presidential Election

7.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 20 l 6 presidential election. In the report, the USIC
assessed the following, with emphasis added:
8.

The U.S. Intelligence Community (USIC) is confident that the Russian

Government directed the recent compromises of e mails from US persons and institutions,
including from US poiitical organizations. The recent disclosures of alleged hacked e mails on
sites like DC Leaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to

3

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 9 of 35

influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
9.

On January 6, 2017, the US[C released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the repoti, the USIC
assessed the following:
10.

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed

at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
11.

The USIC also described, at a high level, some of the techniques that the Russian

government employed during its interference. The USIC summarized the efforts as a "Russian
messaging strategy that blends coveti intelligence operations-such as cyber activity-with
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries,
and paid social media users or 'trolls.'"
12.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political

4

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 10 of 35

figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
foreign intelligence agency.
13.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Gucci fer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
14.

Gucci fer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
B.

15.

· Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks.

Roger Stone is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. On August
7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account
@RogerJStoneJr.
16.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
17.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.

5

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 11 of 35

18.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
19.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
.· October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
20.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).

6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 12 of 35

21.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
Twitter account was reinstated.
22.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
23.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
24.

On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John

Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work ofa '"mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
25.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."

7

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 13 of 35

26.

On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted,

"Wednesday@ HillaryC!inton is done. #WikiLeaks."
27.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
used @RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
28.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
29.

Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
30.

WikiLeaks continued to release John Podesta's hacked emails throughout October

10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone'~ August 21, 2016 CSP AN and Twitter references - argued publicly that "[it is J a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with

8

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 14 of 35

him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
31.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email·(speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
C.

· Roger Stone's Private Twitter Direct Messages with WikiLeaks and Jnlian
Assange.

32.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
33.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."

9

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 15 of 35

34.

On October 16, 2016, @RogerJStoneJr sent a direct message to@wikileaks: "Ha!

The more you \"correct\" me the more people think you're lying. Your operation leaks like a
sieve. You need to figure out who your friends are."
35.

On November 9, 2016, one day after the presidential election, @wikileaks sent a

direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately
followed up with another message less than a minute later: "We are now more free to
communicate."

36.

In addition, @RogerJStoneJr also exchanged direct messages with Julian

Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
messaged @JulianAssange, an address associated with Julian Assange in.numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
37.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

JO

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 16 of 35

D.

39.

Emails with Stone and Corsi

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's

On October
address,

On March 14, 2018, Chief Judge Beryl A. Howell issued a search
warrant for STONE's iCloud account. On April 23, 2018, Chief Judge Beryl A. Howell signed
an order pursuant to 18 U.S.C. §2703(d) for the Target Accounts. Information recovered
pursuant to those search warrants and orders indicated the following:
40.

On or about February 2 and February 3, 2016,

Account 1, sent two emails to

using Target

, an email address associated with

II

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 17 of 35

41.

On or about February 5, 2016,

received two emails on Target

Account l from an account associated with
On or about April 6, 2016, CORSI and

42.

(on Target Account 1)

exchanged seven emails. On or about April 7, CORSI email
1. On or about April 8, 2016,

on Target Account

mailed CORSI. On or about April 10,

and CORSI exchanged two emails. On or about April 18, 2016, CORSI sent
an email.
43.

On or about May 1, 2016, CORSI emailed

three times and

(on Target Account 1)

sent him two responses. On or about May 2, 2017,

(on Target Account 1) emailed CORSI.
44.

On or about May 17, 2016, STONE emailed Jerome CORSI, "send me

mail address." CORSI wrote back, "Roger[,]

(Target

"4

Account 1) also seems to work as

45.

e-

That same day, STONE emailed

at Target Account 1. STONE

wrote that he would have to move "our meeting to Wednesday. I am uncomfortable meeting
without Jerry." As described further below, it appears that "Jerry" is Jerome CORSI. STONE
exchanged additional emails about setting up dinner, and

and

emailed back, "RS[,] Confirming dinner Wednesday at 7PM at Club 21, JC included."
46.

On or about that same day, May 17, 2016,

n Target Account 1,

emailed CORSI.

4

47.

On or about June 3, 2016, CORSI emailed

E.

Stone, and Corsi's Text Messages about "October Surprise" and
"Critical Intel."

The period in a

email account is not read as a character. Therefore,
are the same account.

12

on Target Account 1.

and

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 18 of 35

48.

On or about May 17, 2016,

messaged STONE, "Hi Roger, I hope

all is well. Our dinner tonight for 7PM is confirmed. I arrive at 4PM. Please suggest a good
restaurant that has privacy. Thank you. See you soon,

" STONE responded,

'See e-mail."

49.

messaged STONE, "Hi Roger, It Was

On or about May 19, 2016,

Great Seeing You Again Last Night At Dinner. Did You Talk To Trump This Morning? Any
News? Thank You. Best,

." STONE responded, "Contact made - interrupted
nd STONE continued to text about arranging a meeting with

- mood good."
then-candidate Trump.
50.

messaged STONE, "RS: Secret I

On or about.June 21, 2016,

CabinetMinister

in NYC Sat. June 25. Available for DJT meeting.

to publicly-availabe information, during this time
portfolio in the
51.

" According

was a Minister without

cabinet dealing with issues concerning defense and foreign affairs.
On or about June 25, 2016,

messaged Stone, "Roger, Minister left.

Sends greetings from PM. 5 When am I meeting DJT? Should I stay or leave Sunday as planned?
Hope you are well.
52.

"

On or about June 26, 2016, STONE messaged

I am better but

turn out to have been poisoned. Completely out of action for 3 days-apologize to Minister for
me. I would not leave as we hope to schedule the meeting mon or tues."
53.

messaged STONE, "RETURNING TO

On or about June 28, 2016,

DC AFTER URGENT CONSULTATIONS WITH PM IN ROME.MUST MEET WITH YOU
WED. EVE AND WITH DJ TRUMP THURSDAY IN NYC.

5 Based on

statements here and below, I belie-Ve "PM" refers to the"

13

Prime Minister.

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 19 of 35

54.

On or about Jun 29, 2016, STONE responded, "Monday meeting collapsed after

DJT cleared his schedule to deal with the money crisis. lam waiting the new schedule. Will try
for Thursday."
55.

On or about June 30, 2016, STONE messaged

"Revised - meeting

now I pm July 6."
56.

On or about July l, 2016,

wrote back, "Thank you my friend. I

will plan to be back in NYC on July 5th for the meeting with DJT on the 6'h at l pm.THAY YOU
ROGER." STONE responded, "Sorry this took so long. R."
"·

57.

On July 5, 2016,

messaged STONE, "Roger, I am here, ready for

the meeting with DJ Trump at 1PM tomorrow. Let's you and I meet at 10.30AM at the St. Regis
Lobby. Thank you.
58.

"

On July 6, 2016,

messaged STONE, "At St Regis With Lt General.

Waiting For You Thank You.

" STONE wrote back, "

- I am down

with a nasty cold. and too ill to travel- I have a1rnnged for Jerri to take u in at I rather than lose
the appointment- please connect with Jerri - Let me know how the meeting goes .DJT
expecting u. R" Based on STONE's contacts and emails described above, investigators believe
that the "Jerri" referenced in the message refers to Jerome CORSI.
59.

wrote back, "Thank U Very Much[.] I Have To Meet Trump Alone

After A Brief Introduction by Jerry Thanks Roger." STONE wrote back, "As long as u get the
meeting-lam very sorry I cannot !jtlend- have a high fever and no voice."

2oy

-z.o.1~

60.

On July 8,

lt<:1

essaged STONE, "Hi Roger. Have you

rescheduled the meeting with DJT? The PM is putting pressure for a quick decision. Thank you
for all your help!

14

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 20 of 35

61.

On or about July 8, 2016, STONE wrote back, "T not in NYC again before the

convention. I have pneumonia and may be hospitalized later today. I can get this back on track
post convention when I can attend. Sorry about the fiasco last week, however you can't just bring
the General without tell me - R."
62.

On or about July 25, 2016, STONE sent an email from his

Account to

Jerome CORSI with the subject line, "Get to Assange." The body of the message read: "Get to
Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with
Foundation, allegedly."
63.

On or about July 29, 2016,

sent a messaged to STONE, "HI

ROGER, I HOPE YOU ARE WELL. HAVE YOU SET UP A NEW MEETING WITH
TRUMP? 1 PLAN TO BE BACK IN THE US NEXT WEEK. PLEASE ADVISE. THANK
YOU.
64.

On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call

me MON." The body of the email read: "

.should see Assange[.]

Bernie [S]anders brother who called Bill a Rapist- turn him for Trump[.]

should find
should find

or more proof of Bill getting kicked out."
65.

On or about August 2, 2016 (approximatelyl9 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed the STONE, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very
damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's

15

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 21 of 35

reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian ASSANGE, the
founder of WikiLeaks, who resided in Ecuador's London Embassy in 2016.
'66.

On or about August 9, 2016,

messaged STONE, "Roger-As per PM

we have one last shot before moving on. Can you deliver? History will not forgive us. TRUMP
IN FREE FALL. OCTOBER SURPRISE COMrNG !
67.

On or about August 12, 2016,

messaged STONE, "Roger, hello

from Jerusalem. Any progress? He is going to be defoated unless we intervene. We have critical
intell. The key is in your hands! Back in the US next week. How is your Pneumonia? Thank you.
STONE replied, "I am well. Matters complicated. Pondering. R."

wrote

back, "Thank You." No additional messages appear in STONE's iCloud between STONE and
until October 30, 2016.
68.

As described above, on October 7, 2016, WikiLeaks began releasing the emails

hacked from John Podesta's account.
69.

On October 26, 2016,

emailed

Account. On or about October 27, 2016,

on the Target
emailed

three

times on the Target Account.
70.

messaged S~ONE: "Roger, you are doing a

On October 30, 2016,

great job !!! I am in NY-met with DJT and helping. Victory is in sight. HK says hello. Thanks,

71.

On Thursday, November 3,'2016,

messaged STONE: "Roger,

European country ready to release secret tapes to DESTROY objective. Can we meet ASAP? 4
star General will join.
thurs."

" STONE responded, "Yes let's talk
wrote back, "Must meet in NYC Thursday AM."

16

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 22 of 35

72.

On or about November 7, 2016

messaged STONE,

"ROGER,JERRY- SORRY, BUT DUE TO AN UNEXPECTED EMERGENCY I HAVE TO
CANCEL TODAY'S MEETING AT 9. THANKS
STONE responded, "Take care of yourself."

.. HAVING a TIA. Early Stroke."
wrote back, "Tnaks Xou RGer. Blury

Virson." STONE replied, "You can't die until after we elect Donald."
F.

Stone's HPSCI Testimony and Subsequent Conversations

73.

According to publicly-available reporting, Stone testified before the House

Permanent Select Intelligence Committee (HPSCI) on September 26, 2017. STONE released his
prepared remarks to the media. In his remarks, Stone stated that he had learned Assange was in
possession of the DNC emails via Twitter, and that he asked a "journalist" to "independently
confirm this report." Stone stated his "intermediary" had "assured me that WikiLeaks would
release this information in October and continued to assure me of this throughout the balance of
August and all of September." Stone denied knowledge in advance of Podesta's emails being
hacked. Accordingly to publicly-available news reports, Stone subsequently informed HPSCI
that his .intermediary was Randy Credico, an American radio host.
74.

On or about November 24, 2017, Credico .texted Stone, "I told you to watch his

Tweets in October not before that I knew nothing about the DNC stuff. I just followed his
Tweets." Stone responded, "U never said anything about the DNC but it was August." Credico
replied, "It was not August because I didn't interview him or meet him until August 261h."
75.

Credico and Stone continued to exchange messages, and on December 1, 2017,

Credico wrote: "I don't know why you had to lie and say you had a back Channel now I had to
give all ofmy forensic evidence to the FBI today what a headache. You could have just told him
the truth that you didn't have a back channel they now know that I was not in London until

17

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 23 of 35

September of this year. You had no back-channel and you could have just told the truth. You
want me to cover you for perjury now." 6 Stone responded, "What the fuck is your problem?
Neither ofus has done anything wrong or illegal. You got the best press of your life and you can
get away with asserting for 5th amendment rights ifu don't want talk about[.] And if you turned
over anything to the FBI you're a fool." Credico replied, "You open yourself up to six counts of
perjury. But I'm sure that wasn't sworn testimony so you're probably clear ... You should go
back in a minute your testimony and tell them the truth ... You need to amend your testimony
before I testify on the 15 1h." Stone wrote, "If you testify you're a fool. Because of tromp [sic] I
could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee
you you are the one who gets·indicted for perjury if you're stupid enough to testify." Stone and
Credico continued to correspond, and according to publicly available news reports, on December
13, 2017, Credi co asse1ted his Fifth Amendment right not to testify before the HPSCI.
76.

On January 25, 2018, Credico texted Stone, "You lied to the house Intel

committee. But you'll get off because you're friends with Trump so don't worry. I have. all the
forensic evidence. I was not a ba[ck] Channel and I have all those emails from September of
2016 to prove it."
INFORMATION REGARDING GOOGLE

77.

Google provides numerous free services to the users with a Google profile. Some

of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user's Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
6

Contrary to his statement, Credico had not provided any information tot.he FBI.

18

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 24 of 35

storage, file sharing, and collaborative editing. Google+ Photos (fo1merly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view and share videos. Google also retains a record of searches conducted by the user, as
well as location data for the use of some of the services described above. All of these services
may record information uploaded, inputted, or gathered from the user.
CONCLUSION
78.

Based on the forgoing, I request that the Court issue the proposed search warrant.

19

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 25 of 35

REQUEST FOR SEALING
79.

I further request that the Court order that all papers in support of this application,

including the application, affidavit and search warrant, be sealed until further order of the Court.
These documents discuss an ongoing criminal investigation that is neither public nor known to
all of the targets of the investigation. Accordingly, there is good cause to seal these documents
because their premature disclosure may give targets an opportunity to flee/continue flight from
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates,
or otherwise seriously jeopardize the investigation.

rew T. Mitchell
Special Agent
. Federal Bureau of Investigation
ft!.

Subscribed and sworn to before me on this ~ y of May, 2018.

~i~

The Honorak~~l A. Howell
Chief United States District Judge

20

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 26 of 35

ATTACHMENT A
Property to Be Searched

This warrant applies to information associated with the Google account
hat is stored at premises owned, maintained, controlled, or operated
by Google, Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View,
CA 94043.

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 27 of 35

ATTACHMENT B
ATTACHMENT B
Particular Things to be Seized
I.
Files and Accounts to be produced by Google, Inc. betwceu January 1, 2016 and
the Present.
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a.
The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and destination
e-mails sent addresses associated with each e-mail, the date and time at which each e-mail was
sent, and the size and length of each e-mail; 1
b.
All existing printouts from original storage of all of the electronic mail described
above in Section I.A. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above in
Section I.A, .including log files, dates, times, methods of connecting, ports, dial ups, and/or
locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address, telephone
numbers and other identifiers, records of session times and durations, the date on which the
account was created, the length of service, the types of service utilized, the IP address used to
register the account, log-in IP addresses associated with session times and dates, account status,
alternative e-mail addresses provided during registration, all screen names associated with
subscribers and/or accounts, all account names associated with the subscriber, methods of
connecting, log files, means and source of payment (including any credit or bank account
number), and detailed billing records;
g.
All records indicating the services available to subscribers of the electronic mail
address described above in Section I.A.;
h.

Google+ subscriber information, circle information, including name of circle and

I This Search warrant applies on to email sent, received, or drafted on or after May 26, 20 I 7.

2

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 28 of 35

members, contents of posts, comments, and photos, to include date and timestamp;
i.

Google Drive files created, accessed or owned by the account;

J.

YouTube subscriber information, private videos and files, private messages, and

comments;

le
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l.

Google Talk and Google Hangouts conversation logs associated with the account.

3

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 29 of 35

II.

Information to be Seized by Law Enforcement Personnel
a.
Any and all records that relate in any way to the account described in Attachment
A which is evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a false statement); 18 U.S.C. §1651
(pe1jury); 18 U.S.C. § 1030 (unauthorized access ofa protected computer); 18 U.S.C. § 1343
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),, and 52 U.S.C.
§ 30121 (foreign contribution ban) from Jan l, 2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications with foreign government officials or agents of a foreign power,
or discussions with others regarding those actions, or plans or attempts at
undertaking such actions:

b.
All images, messages, communications, calendar entries, search terms, and
contacts, including any and all preparatory steps taken in furtherance of these crimes;
c.
Communication, information, documentation and records relating to who created,
used, or communicated with the account or identifier, including records about their identities and
whereabouts;
d.

Evidence of the times the account was used;

e.
All images, messages and comm_unications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;
f.
Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g.
Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h.
All existing printouts from original storage which concern the categories
identified in subsection II.A; and
1.

All "address books" or other lists of contacts.

4

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 30 of 35

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THE GOOGLE ACCOUNT

Case: 1:18-sc-01518
Assigned To : Howell, Beryl A.
Assign. Date: 5/4/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS
AND TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 270S(B)

The United States ofAmerica, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to non-disclosure,
the proposed Order would direct Google LLC, an electronic communication and/or remote
computing services provider with headquarters in Mountain View, California, not to notify any
other person (except attorneys for Google for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year unless otherwise ordered of the Court.
JURISDICTION AND LEGAL BACKGROUND

I.

The Court has the inherent power to seal court filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the

Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991 ).
2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a

Page 1 of6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 31 of 35

"district court of the United States ... that- has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in fmtherance of the offense
under investigation occmTed within Washington, D.C. See 18 U.S.C. § 3237.

3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b). Google provides an "electronic communications service," as defined in 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows:. 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
1

Section 2705(b) contains additional requirements for legal process obtained pursuant to
18 U.S.C. § 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any
legal process under that provision.

Page 2 of6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 32 of 35

deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an ~rder if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in (1)

endangering the life or physical safety of an individual;

(2)

flight from prosecution:

(3)

destruction of or tampering with evidence;

(4)

intimidation of potential witnesses; or

(5)

otherwise seriously jeopardizing an investigation or unduly delaying
a trial.

18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sicJfinds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Warrant for a period of one year unless othe1wise
ordered by the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6.

At the present time, law enforcement officers of the FBI are conducting an

investigation into violations related to 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory

Page 3 of6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 33 of 35

after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C.
§ 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C.

§ 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign

contribution ban) arising out of the conduct of various unknown persons that operated and
controlled the subject accounts. It does not appear that these individuals are currently aware of the
nature and scope of the ongoing FBI investigation.
REQUEST FOR SEALING AND NON-DISCLOSURE

7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year unless otherwise ordered by the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, ap.d its disclosure may alert these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would
be immediately prompted to destroy or conceal incriminating evidence, alter their operational
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potential target could quickly and easily destroy or encrypt digital
evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that _the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should circumstances

Page 4 of6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 34 of 35

change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed,
the Government will notify the Comt and seek appropriate relief.
9.

There is, therefore, reason to believe that notification of the existence of the Warrant

will seriously jeopardize the investigation, including by giving the targets an opportunity to flee
from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2}-(5). Because of such potential jeopardy to the investigation, there also exists a

compelling governmental interest in confidentiality to justify the government's sealing request.
See Robinson, 935 F.2d at 287-89.

10.

Based on prior dealings with Google, the United States is aware that, absent a court

order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
of the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant

Page 5 of6

 Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 35 of 35

(except attorneys for Google for the purpose of receiving legal advice) for a period of one year
unless otherwise ordered by the Court.

Respectfully submitted,
ROBERTS. MUELLEf, III
Special Co)lnsel
/
By:-~~~""'\,:.-_-t_-~~-···-·~/-_-_···--~-----

. Ktle Freeny
··
Specia:l Counsel's
G
Office (202) 616-0800

Page 6 of6

 Case Document 29-8 Filed 04/28/20 Page 1 of 23

A0 106 (Rev. 04/10) Application fora Search Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Massachusetts

111 the Matter of the Search of

(Brie?y describe the property to be searched
or idenn? The person by name and address)

CaseNo. W466
The Person of?

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (idenn?! the person or describe the
property 1?0 be searched and give its location):

See Attachment A

located in the District of Massachusetts there is now concealed (idenrijj) [he

 

 

person or describe the property to be seizer?:
See Attachment B.

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
Erevidence of a crime; 
Efcontraband, fluits of crime, or other items illegally possessed;
at property designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section Offense Description
18 U.S.C. 2, 3, 4, 371, Aiding Abetting Accessory after the Fact Misprison of a Felony 
1030, 1343 and 1349 Conspiracy 371); Computer Fraud 1030); Wire Fraud 1343); Attempt and

Conspiracy to Commit Wire Fraud 1349).

The application is based on these facts:

See attached Affidavit.

Ef Continued on the attached sheet.

CI Delayed notice of days (give exact ending date if more than 30 days: is requested
under 18 U.S.C. 310321, the basis of which is set forth on the attached sheet.

44%;


Applicant ?5 Signature

?Curtis-Hgide', Special Agent, FBI

Printed name and rifle

 

Sworn to before me and signed in my presence.

    

Lamont:

City and state: Boston, Massachusetts United States Magistratetjudge Marianne B. Bowler
Printed name and rifle

Date: 03/27/2018

 

. iw 
. "Judge .3 

 

 

Case Document 29-8 Filed 04/28/20 Page 2 of 23

A0 106 (Rev. 04/10) Application fora Search Warrant

 

UNITED STATES DISTRICT COURT

for the

District of Massachusetts

In the Matter of the Search of

(Brie?y describe the property to be searched
or irlein?i?) f/Ie person by name and address)

APPLICATION FOR A SEARCH WARRANT

CaseNo. [56? 



I, a federal law enforcement officer or an attorney for the govemment, request a search warrant and state under
penalty of peljuiy that I have reason to believe that on the followmg person or property (Idenn?: rhe person or describe the
property to be searched and give its location):

See Attachment A

located in the District of Massachusetts there is now concealed (identi?) the

person or describe the property to be seized):

 

 

See Attachment B.

The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more):
Erevidence of a crime;
Elf contraband, fruits of crime, or other items illegally possessed;
Mproperty designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a Violation of:

Code Section O?ense ipi?ion
18 U.S.C. 2, 3, 4, 371, Aiding Abetting Accessory after the Fact Misprison of a Felony 
1030, 1343 and 1349 Conspiracy 371); Computer Fraud 1030); Wire Fraud 1343); Attempt and

Conspiracy to Commit Wire Fraud 1349).

The application is based on these facts:

See attached Affidavit.

i2], Continued on the attached sheet.

Cl Delayed notice of days (give exact ending date if more than 30 days: is requested
under 18 U.S.C. 3103a, the basis of which is set forth on the ttached sheet.

mm A7, ZAA


Applicant ?9 signature

Cums i-ieide,- SpeCIal Agent FBI

 

(J
?raj-J. PI infed name and title

Sworn to before me and signed in my presence.

Date: 03/27/2018

 

 

City and state: Boston, Massachusetts United States Jud . Marianne B. Bowler
PI I'm?ea? name and rifle

 

 

Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 3 of 23

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MASSACHUSETTS
IN THE MATTER OF THE SEARCH OF
THE PERSON OF

Case No. J 'if-/V()-ol l'1c). -A-t_B~
Filed Under Seal

IN THE MATTER OF THE SEARCH OF
THE BAGGAGE OF

Case No.

I 1J - fVl:S"" _ ~ 11 '!> _ Mt3B,

Filed Under Seal

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR SEARCH WARRANTS
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for search and seizure warrants

under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of
(the Target Person) (described further in that warrant's
Attachment A), and any baggage associated with him (described further in that warrant's
Attachment A), and the seizure of the electronic devices and media described in Attachment B
(the Target Devices). I anticipate this search will be executed after
International Airport at approximately

lands at Logan
This warrant is for the

seizure of the devices only; the Government will seek a warrant to search any seized devices at a
later point in time.
2.

I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of

investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 4 of 23

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my lrnowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that ROGER STONE, JEROME CORSI and others have
committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the
fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C.

§ 1349 (attempt and conspiracy to commit wire fraud) (the "Subject Offenses").
JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because, as described

further below, it is anticipated that

and his baggage will be located in the District of

Massachusetts on
SUMMARY

6.

As set forth below,

(the Target Person) was in contact with Roger

STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have
obtained advance lrnowledge of the release by WikiLeaks of illegally hacked emails for the
benefit of the presidential campaign of Donald J. Trump (the "Campaign"). In July 2016,
STONE instructed CORSI to have
WikiLeaks, and

talk with Julian AS SANGE, the founder of

served as CORSI's conduit to ASSANGE to discuss hacked

information.

2

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 5 of 23

7.

More specifically, on or about July 25, 2016, STONE emailed CORSI to "Get to

Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or
about July 31, 2016, STONE instructed CORSI to have
time,

"see ASSANGE." At the

lived in London, where Assange was located at the Ecuadorian Embassy. On

or about August 2, 2016, CORSI told STONE that the "word is friend in embassy [ASSANGE]
plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned to be very
damaging .... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC." Information disclosures subsequently occurred on or about the times CORSI predicted.
8.

On or about August 10, 2016,

began emailing CORSI multiple news

articles regarding AS SANGE and alleged Russian involvement in the election.
November 13, 2016,

On or about

emailed STONE to congratulate him on "tak[ing] the country

back," and stating, "You deserve a lot of credit and working with you and Jeri Corsi, who is with
me now in London has been a great joy." On or about January 7, 2017,

emailed

STONE and CORSI to joke about John Podesta going "phishing." As stated below, I know from
my training and experience that the term "phishing" is used to refer to the practice of sending
emails purporting to be from a reputable party in order to trick individuals to reveal to the sender
personal information, including passwords.
PROBABLE CAUSE TO BELIEVE THAT A FEDERAL CRIME WAS COMMITTED
A. Background on Relevant Individuals
i. Roger STONE
9.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the Campaign until August
2015. Although STONE had no official relationship with the Campaign thereafter, STONE
3

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 6 of 23

maintained his support for Trump and continued to make media appearances in support of the
Campaign. As described further below, STONE also maintained contact with individuals
employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy
chairman Rick GATES.
ii. Jerome CORSI

10.

Jerome CORSI is a political commentator who, according to publicly-available

information, serves as the "Washington Bureau Chief for Infowars.com." According to publiclyavailable sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for the
website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of books
regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

4

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 7 of 23

B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed
Hacking Activity during the 2016 Presidential Election
12.

On October 7, 2016, the U.S. Department of Homeland Security and Office of the

Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. 1 In the report, the USIC
assessed the following:
13.

"The U.S. Intelligence Community (USIC) is confident that the Russian

Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities."
14.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,

1

"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-departmenthomeland-security-and-office-director-national.

5

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 8 of 23

"Assessing Russian Activities and Intentions in Recent US Elections."2 In the report, the USIC
assessed the following:
15.

"[] Russian President Vladimir Putin ordered an influence campaign in 2016

aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
16.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
17.

With respect to hacking activity, the USIC assessed: "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."

2

"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_ 2017_ 0 l .pdf.

6

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 9 of 23

18.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
19.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with journalists.
C. Roger STONE's Disclosed Interactions with Guccifer 2.0 and WikiLeaks.

20.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was
fired in August 2015. Although STONE had no official relationship with the Campaign
thereafter, STONE maintained his support for Trump and continued to make media appearances
in support of Trump's presidential campaign.
21.

As discussed further below, STONE made a number of public references to

WikiLeaks and its release ofDNC-related emails. STONE has also stated that he was in contact
via Twitter with Guccifer 2.0.
22.

On June 14, 2016, news reports indicated that the computer systems of the DNC

had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June
21, 2016 release of hacked documents.
23.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.

7

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 10 of 23

24.

On August 5, 2016, Roger STONE published an article on Breitbart.com entitled,

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." STONE wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." STONE embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." STONE also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
25.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard to
the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be a number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with Assange, he had a close
friend who served as an intermediary.
26.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJSTONEJr thanks

that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal
cellphone numbers and email addresses from the files of the Democratic Congressional
Campaign Committee (DCCC).

8

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 11 of 23

27.

On August 13, 2016, STONE posted a tweet using@RogerJSTONEJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
28.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJSTONEJr paying

you back." Guccifer also sent a private message to @RogerJSTONEJr stating "i'm pleased to say
u r great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
29.

On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,

resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
30.

On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John

Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
31.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly
soon. And that of course will answer the question of exactly what was erased on that email
server."
9

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 12 of 23

32.

On Saturday, October 1, 2016, using@RogerJSTONEJr, STONE Tweeted,

"Wednesday@HillaryClinton is done. #WikiLeaks."
33.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, STONE
used @RogerJSTONEJr to tweet: "Payload coming. #Lockthemup."
34.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
35.

Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
36.

WikiLeaks continued to release John Podesta's hacked emails throughout October

10-21, 2016. On October 12, 2016, John Podesta-referring back to STONE's August 21, 2016
C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the Miami Herald, STONE responded: "I have never met or spoken
with Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
10

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 13 of 23

him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
37.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. Roger STONE's Private Twitter Direct Messages with WikiLeaks and Julian
Assange.
38.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJSTONEJr.
39.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account ofWikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."

11

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 14 of 23

40.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you/'
41.

On October 16, 2016, @RogerJSTONEJr sent a direct message to @wikileaks:

"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
a sieve. You need to figure out who your friends are."
42.

On November 9, 2016, one day after the presidential election, @wikileaks sent a

direct message to @RogerJSTONEJr containing a single word: "Happy?" @wikileaks
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
43.

In addition, @RogerJSTONEJr also exchanged direct messages with Julian

Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJSTONEJr directly
messaged @JulianAssange, an address associated with Julian Assange in numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

12

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 15 of 23

44.

On Saturday, June 10, 2017, @RogerJSTONEJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

E. Roger STONE's Emails with Jerome CORSI and
and WikiLeaks
45.

about Assange

On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of

Columbia issued a search warrant for STONE's

address

On

or about October 17, 2017 Chief Judge Howell issued a warrant for STONE's

address,

On or about December 12, 2017, Chief Judge Howell issued a warrant
for

Gmail address,

Emails recovered pursuant to that

search warrant indicated the following:
46.

On or about May 23, 2016,

emailed STONE with the subject,

"Trump Campaign," to offer his assistance to the Campaign.

wrote that he was "on

to the notorious Oxford case already!" He also stated that he was "available, literally, as needed,
to contribute in ways the campaign sees fit. I'd like to go to Cleveland and pitch in, raise money
and work for you. Can you use me?" Cleveland, Ohio was the location of the 2016 Republican
National Convention, held July 18-21, 2016.
47.

On or about June 4, 2016, STONE emailed

telling him to "Plan on

going to Cleveland. Will need your help. Can handle credentials."
48.

On or about June 20, 2016,

emailed STONE and MANFORT, asking

to "know immediately how I can help" the Campaign.

also wrote that his "research

on Rhodes House" was nearing completion. Rhodes House is the headquarters of the Rhodes

13

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 16 of 23

Trust, which provides scholarships to Oxford University, and the "Rhodes House" research
appears to be a reference to STONE' s previous tweet on or about October 13, 2015 that, "In
1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old

."

a month later, as discussed below. The

STONE mentioned Wellstone again to

"Rhodes House" research seems to be the same as the "notorious Oxford case" referenced by
above.
49.

On or about July 7, 2016,

emailed STONE that he had "my tickets to

Cleveland[.] [D]o you have my credential pack?"
50.

On or about July 25, 2016, (approximately three days after WikiLeaks began

releasing emails hacked from the DNC),

, a commentator who had publicly accused

the Clinton Foundation of fraud, emailed STONE with the subject line, "You need to get to
Assange." The body of the message read: "At Ecuadorian Embassy in London and get the
pending wikileaks emails ... they deal with Foundation, allegedly."
51.

According to

approximately ninety

minutes later STONE called CORSI and they spoke for 26 minutes.
52.

Less than two hours after the phone call to CORSI, STONE emailed CORSI with

the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with Foundation,
allegedly." It appears that STONE cut and pasted the email from Ortel to CORSI.
53.

On or abou~ July 27, 2016, then-candidate Donald Trump stated in a press

conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if
that happens. That will be next."
14

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 17 of 23

54.

On or about July 28, 2016, Roger STONE called Richard GATES (then the

deputy-chair of the Campaign). They spoke for approximately twelve minutes.
55.

On or about July 30, 2016, Paul MANAFORT (then the Chairman of the

Campaign) called STONE. They spoke for approximately one hour and seven minutes. The
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven
minutes is the longest call (by almost a half-hour) that took place between STONE and
MANAFORT in this time period.
56.

On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call

me MON." The body of the email read: "

should see Assange[.]

should find

Bernie sanders brother who called Bill a Rapist- turn him for Trump[.]

should find

or more proof of Bill getting kicked out."
57.

On or about August 2, 2016, CORSI emailed STONE: "With family, 25th

wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging ... Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
case, it appears that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
refers to AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016. On or about August 12, 2016, Guccifer publicly released information hacked from the
DCCC (the date CORSI identified as when he would "return home.").

15

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 18 of 23

58.

On or about August 10, 2016,

emailed CORSI an article titled,

"Assange Warns of 'Triangle of Terror'- Clinton, Pentagon & Google."
59.

On or about August 13, 2016,

emailed CORSI a news article titled,

"Assange Implies Murdered DNC Staffer Was WikiLeaks' Source."
60.

On or about August 16, 2016,

emailed CORSI an email with the

subject line, "Vladimir Putin Has Already Won Our Election." The body of

email

contained two words: the word "VENONA" and the word "Observer." According to publicly
available information, the "Venona Project" was a top-secret U.S. intelligence effort to gather
and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13,
2016, the Observer had published an article titled, "Vladimir Putin Has Already Won Our
Election" (the subject of the email). The subtitle of the article stated: "It's time to face facts:
Kremlin spies and hackers are undermining American politics." The article further discussed
how, "WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined
DNC emails that were stolen by Russian intelligence." The article also stated that the "Kremlin is
weaponizing stolen information for political effect."
61.

On or about August 30, 2016,

emailed Steve Bannon, who had

become chief executive of the Campaign when MANAFORT left the Campaign on or about
August 19, 2016, with STONE and CORSI cc'd.

wrote offering his assistance and

stating he had been "labouring non stop for the Trump campaign- even tho[u]gh I am all the
way over here in Oxford.... I have been in constant touch with the campaign, Roger Stone and
Jeri Corsi."
62.

On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.

16

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 19 of 23

63.

On or about November 13, 2016,

emailed STONE.

wrote, "Well, we did it and now have an opportunity of a lifetime to take the country back. God
is good and we are well placed to steer things well. You deserve a lot of credit and working with
you and Jeri Corsi, who is with me now in London has been a great joy."
64.

On or about January 7, 2017, an individual named

STONE, CORSI, and

emailed

with the subject line, "in case you need his mail. ........ "

Attached to the message was a scan of a business card for John Podesta. Several hours later,
replied: "Ha ... maybe he wants to go phishing with us?"
65.

I know from my training and experience that the term "phishing" is used to refer

to the practice of sending emails purporting to be from a reputable party in order to trick
individuals to reveal to the sender personal information, including passwords. Public reports
indicate that Podesta's emails were obtaining through a "phishing" scheme.

F.

U.K.-Based Email Account
66.

address,

In addition to his Gmail account,

also uses a U.K.-based email

Investigators found emails with this address in

Gmail account. The U.K. email address was also listed in messages

sent as a means

of reaching him. A publicly-available database lists the U.K. email address as belonging to
The U.K. email address is housed outside the United States, and investigators
anticipate it may take substantial time to retrieve the messages on the account via a potential
treaty request. In addition, it is possible that emails may have been deleted or no longer
maintained. I know from my training and experienced that users often download and store emails
on their phones, tablets, and laptops, such as the Target Devices. Even if information has been
deleted by the user, the Government may be able to employ forensic tools to recover information
17

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 20 of 23

from his devices. In addition, as described further below, the Target Devices may include a
variety of other stored communications, including voicemail, text message, and other third party
messaging systems which

may have used to communicate with CORSI, STONE,

and others regarding WikiLeaks.

THE PERSON AND BAGGAGE TO BE SEARCHED CONTAIN EVIDENCE, FRUITS,
AND INSTRUMENTALITIES
67.

I also have probable cause to believe that the person and baggage to be searched

contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above,
as described in the warrants' respective Attachments A and B.
68.

Records indicate that

has purchased a ticket on

I know from my training and experience that individuals often carry electronic devices and
storage media of the type described in Attachment B with them when they travel both on their
persons and in their baggage. These devices and media include but are not limited to cellular
phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives.
69.

From my training and experience, I am also aware that personal computer systems

are generally capable of creating, receiving, and otherwise processing computer files such as email, word-processing documents, photographs, and spreadsheets. As evidenced by the emails
above,

uses computer systems to communicate with CORSI and STONE regarding

WikiLeaks.
70.

Based on my training, experience, and information provided by other law

enforcement officers, I know that many smartphones (which are included in Attachment B) can
now function essentially as small computers. Smartphones have capabilities that include serving

18

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 21 of 23

as a wireless telephone, digital camera, portable media player, GPS navigation device, sending
and receiving text messages and e-mails, and storing a vast range and amount of electronic data.
Examining data stored on devices of this type can uncover, among other things, evidence that
reveals or suggests who possessed or used the device.
71.

Based on my knowledge, training, experience, and information provided to me by

other agents, I know that computer files or remnants of such files can be recovered months or
years after they have been written, downloaded, saved, deleted, or viewed locally or over the
Internet. This is true because:

•

Electronic files that have been downloaded to a storage medium can be stored for
years at little or no cost. Furthermore, when users replace their computers, they
can easily transfer the data from their old computer to their new computer.

•

Even after files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person "deletes" a file on a
computer, the data contained in the file does not actually disappear; rather, that
data remains on the storage medium until it is overwritten by new data, which
might not occur for long periods of time. In addition, a computer's operating
system may also keep a record of deleted data in a "swap" or "recovery" file.

•

Wholly apart from user-generated files, computer storage media, in particular,
computers' internal hard drives, contain electronic evidence of how the computer
has been used, what it has been used for, and who has used it. This evidence can
take the form of operating system configurations, artifacts from operating system
or application operation, file system data structures, and virtual memory "swap"
19

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 22 of 23

or paging files. It is technically possible to delete this information, but computer
users typically do not erase or delete this evidence because special software is
typically required for that task.
•

Similarly, files that have been viewed over the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache." The
browser often maintains a fixed amount of hard drive space devoted to these files,
and the files are overwritten only as they are replaced with more recently viewed
Internet pages or if a user takes steps to delete them.

CONCLUSION
72.

Based on the forgoing, there is probable cause to believe that one or more people

have violated the statutes specified above and that electronic devices and media containing
evidence, fruits, and instrumentalities of those crimes, are contained on the person of
(described further in that warrant's Attachment A) and his baggage (described
further in that warrant's Attachment A), and for the seizure of the electronic devices and media
described in further in Attachment B.

REQUEST FOR AUTHORIZATION TO EXECUTE THEWARRANTS BEFORE
6 AM OR AFTER 10 PM
73.

In addition, I request that the search warrants authorize searches and seizures

before 6 AM and after 10 PM. Although

flight is scheduled to land at

I am aware that flight departure and arrival times can vary widely from those announced
because of adverse weather or other delays throughout the airline transportation system. If
because of a flight delay

flight landed at 10:01 PM, a warrant without the

20

 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 23 of 23

requested authorization could not be executed for another 8 hours, requiring me to either obtain a
new warrant or to detain

and his baggage until 6 AM the next morning. The

requested authorization will allow the searches and seizures to progress as efficiently as possible,
with minimal delay to

and any other person with whom he is travelling.

REQUEST FOR SEALING
74.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Sworn to under the pains and penalties of perjury,

Curtis Heide
Special Agent
Federal Bureau of Investigation

21

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 1 of 58

AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property lo be searched
or identij)' the person by name and address)

INFORMATION ASSOCIATED WITH

Case: 1 :18-sc-02401
Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or prope1iy located in the
Northern
District of
California
·--------~
(identify the person or describe the property to be searched and give its location):

See Attachment C.

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identijj1 the person or describe the property to be seized):
See Attachment D.

YOU ARE COMMANDED to execute this warrant on or before
July 26, 2018
___ (,10110 exceed 14 days)
oif in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
propeiiy was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to .....
Hon. Beryl A. Howell
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose

property, will be searched or seized (check the appropriale box)
0 for
days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

1j'l 2;/A?/i'ef f':{J-//J
_W_a_sh_i_n~g_to_n_,_D_C_ _ _ _ _ _ __

~-~
'Judge's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

/

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 2 of 58
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
E.x:ecuting officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 3 of 58

ATTACHMENT C
Property to be Searched

This warrant applies to infonnation associated with the following Apple account:
1.

that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
One Apple Park Way, Cupertino, California 95014.

37

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 4 of 58

ATACHMENTD
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such infmmation is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
a.
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification info1mation for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
38

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 5 of 58

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and
j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

39

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 6 of 58

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fiuits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian
Assange, or any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, and
contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created,
used, or communicated with the account or identifier, including records about
their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories
identified in subsection II.A; and

J.

All "address books" or other lists of contacts.

40

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 7 of 58

FILED
JUL 12 2018

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

Clerk, us Dis .
Courts ta'r ihe 0\~ct t & Bankruptcy
net ot Columbia

Case: 1:18-sc-02401
Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Apple, Inc. ("Apple") an electronic communication and/or remote computing
service headquartered at a company headquartered at I Infinite Loop, Cupertino, CA not to
disclose the existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opp01tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 8 of 58

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
further order of the Comi.

THE HONORABLE BERYL A. HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

2

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 9 of 58
AO 106 (Rev. 04/10) Application for a Search Warrant

FltED

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identijj, the person by name and address)

INFORMATION ASSOCIATED WITH

l
)
)

l

JUL f 2 2018
Clerk, U.S. District & Barikruptc
Courts for the District of Columbia

Case: 1:18-sc-02401
Assigned To : Howell, Beryl A
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal Jaw enforcement officer or an attorney for the government, request a search wan-ant and state under
penalty of perjury that I have reason. to believe that on the following person or properly (identify the person or describe the
property to be searched and give its location):

See Attachment C.
located in the

California
Northern
===--- District of ---------'===~--

, there is now concealed (identify the

person or describe the property Lo be seized):

See Attachment D.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1){A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):

ref evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. § 371
18 U.S.C. § 1030

Offense Description
Conspiracy
Unauthorized Access of a Protected Computer

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days: ___ _
) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth o n ~

Reviewed by AUSA/SAUSA:
haron Zelinsky(ASC)

Applicant's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

7/12/2018

~/~~
Judge's signature

City and state: Washingto'n, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 10 of 58

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

Case No. J 'i- SC

JUL 12 2018
Clerk, U.S. District & Bankruptcy
Courts tor the District of Columbia

- c.. '-Id(

Filed Under Seal

AMENDED AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following:
a. The email account

maintained by CSC Holdings ("Target

Account 1 "), described further in Attachment A.
b. The Apple Account (including email) associated with

, maintained

by Apple, Inc. (Target Account 2), described further in Attachment C.
c. The email accoun

maintained by Windstream Communications

('Target Account 3"), described further in Attachment E.
The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
2.

I, Andrew Mitchell, am a Special Agent with the Federal Bureau oflnvestigation

(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 11 of 58

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

.Before the submission of this warrant application, the Special Counsel's Office

complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
members of the news media, 28 C.F.R. 50.10.
5.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a
protected computer).
JURISDICTION

6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 19.

SUMMARY
7.

On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to

Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
31, 2016, STONE.also instructed CORSI to have
2

contact Julian

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 12 of 58

ASSANGE. On or about August2, 2016, CORSI responded to STONE that the "word is friend
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in
the barrel. #CrookedHillary."
8.

Information disclosures subsequently occurred on or about the times CORSI

predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthencandidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
9.

Furthermore, on the day of the Access Hollywood video disclosure, there were

phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
first release of emails hacked from John Podesta.

3

!

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 13 of 58

PROBABLE CAUSE.

A. Background on Relevant Individuals
i. Roger STONE
11.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.
ii. Jerome CORSI

4

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 14 of 58

12.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staffreporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of20I6 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed
Hacking Activity during the 2016 Presidential Election

5

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 15 of 58

14.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following, with emphasis added:
15.

The U.S. Intelligence Community (USIC) is confident that the Russian

Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
16.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
17.

"Russian President Vladimir Putin ordered an influence campaign in 2016 aimed

at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
18.

The USIC also described, at a high level, some of the techniques that the Russian
6

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 16 of 58

government employed during its interference. The USIC summarized the efforts as a "Russian
messaging strategy that blends covert intelligence operations-such as cyber activity-with
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries,
and paid social media users or 'trolls.'"
19.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
foreign intelligence agency.
20.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US .victim data obtained in cyber operations publicly and in exclusives to media outlets."
21.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
C. Additional Hacking Activity by Individuals Associated with the GRU

22.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
7

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 17 of 58

23.

For example, in or around September 2016, these individuals successfully gained ·

. access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
24.

On or about September 4, 2016, individuals associated with the GRU stole the

· emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
25.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

D. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks
26.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
27.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
28.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,
8

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 18 of 58

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
29.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
30.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
31.

On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
9

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 19 of 58

Twitter account was reinstated.
32.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
33.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34.

On August 21, 2016, using @RogerJStoneJR, Stone tweeted stating: "Trust me, it

will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a '"mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
35.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fair!y soon. And that of course will answer the question as to what exactly what was erased on
that email server."
36.

On Saturday, October 1, 2016, using@RogerJStoneJr, Stone Tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
37.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
10

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 20 of 58

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part of WikiLeaks' I 0-year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
@RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
38.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
39.

Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
40.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, John Podesta- referring back to Stone's August
21, 2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [StoneJ had advanced warning [of the release of his
emailsJ and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [AssangeJ may have passed this information on to
[Stone]." Connnenting to the NBC News, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
11

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 21 of 58

41.

On March 27, 2017; CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.

42.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account@RogerJStoneJr.
43.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
44.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
45.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
12

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 22 of 58

46.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
47.

In addition, @RogerJStoneJr also exchanged direct messages with Julian

Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
messaged @JulianAssange, an address associated with Julian Assange in numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
48.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

F. CORSl's Communications with STONE,
Forthcoming Leaks.

13

and Others Regarding

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 23 of 58

49.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's

address,

On or about December 19, 2017 Chief Judge Beryl A. Howell issued a
search warrant for

mail account. On or about March 14, 2018, Chief Judge Beryl

A. Howell issued a search warrant for STONE's iCloud account. Information recovered pursuant
to those search warrants indicated the following:
50.

On or about May 15, 2016,

emailed CORSI at Target Account 3:

"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
meet Manafort -guarantee nothing."
51.

On or about May 16, 2016,

emailed CORSI on Target Account 3:

"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSI responded, "I will work on
other meetings today."

replied, "Do you [want] me to bring you anything from the

Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52.

On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE

with the Title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
14

I

I

II

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 24 of 58

53.

On July 25, 2016, STONE sent an erriail to CORSI at Target Account 1 with the

subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54.

On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the

subject line, "Call me MON." The body of the email read: "

should see Assange[.]

should find Bernie [S]anders brother who called Bill a Rapist - turn him for Trump[.]
should find
55.

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in preseason games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian AS SANGE, the
founder of WikiLeaks, who resided in Ecuador's London Embassy in 2016.
56.

an associate ofSTONE's, emailed

On or about August 5, 2016,

him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night."
15

subsequently

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 25 of 58

stated to investigators that, around the same time; STONE told him he had gone to London to
meet ASSANGE.

also stated that in 2018,

told STONE.he would be

interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
STONE told
57.

he was joking and had not actually met Assange.
On or about August 15, 2016, CORSI messaged STONE using Target Account

3: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not

over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
58.

On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:

"Did you get the PODESTA writeup." STONE replied "yes."
59.

On or about August 31, 2016, CORSI, using Target Account 2, messaged

STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
reveals Podesta hired by S[b]erbauk, Russia's largest financial institution-Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."
60.

On or about September 6, 2016, CORSI emailed STONE using Target Account

3: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
61.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday

and spoke to him about it again today."

wrote back, "Awaiting secret file.

Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
responded, "Keep me posted about file[.]" In a subsequent meeting with investigators,
16

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 26 of 58

indicated this conversation concerned possible derogatory information he was trying ·
to obtain from Turkey.
62.

On or about October 3, 2016, an associate of STONE emailed STONE and asked:

"Assange-what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
63.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
64.

On or about October 4, 2016, CORSI messaged STONE using Target Account 2,

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
65.

That same day, BANNON emailed STONE, "What was that this morning???"

STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer

17

is a big democrat."

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 27 of 58

66.

When BANNON spoke with investigators during a voluntary proffer on February

14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails·
Are Released.

67.

According to a publicly available news article, 1 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
Trump's campaign, 'Access Hollywood' and NBC for reaction."
68.

According to phone records

, at approximately

11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
69.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
70.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
71.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-

on/2016/10/07/3 ld74714-8ce5-l le6-875e-2c 1bfe943b66_story.html

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 28 of 58

72.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
73.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
74.

At approximately 6:27PM,

sent STONE an email titled,

"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE forwarded

message to CORSI at Target

Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
H. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After
STONE Is Accused of Advance Knowledge of the Leak
75.

On or about October 8, 2016, STONE messaged CORSI at Target Account 2,

"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
comments, attacking bad job numbers."
76.

On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE

emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need your BEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 29 of 58

complicated. Two articles in length. I can give you in raw form ihe stuff I got in Russiau
trauslated but to write it up so it's easy to understand will take weekend. Your choice?"
77.

On or about that same day October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that "Podesta is at the heart of a Russian-govermnent
money laundering operation that benefits financially Podesta personally aud the Clintons through
the Clinton Foundation."
78.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them aud used them."
79.

On or about Thursday, October 13, 2016, CORSI, using Target Account 3,

emailed STONE: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russiaus launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

20

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 30 of 58

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
80.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA." The text
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or data from Wikileaks." The post then asked, "Just how much
money did

, a controversial Russian billionaire investor with ties to the

Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99 .978 percent by

with the money transferred via Deutsche Bank and

Trust Company Americas in New York City, with the money ending up in a private bank
account in the Bank of America that is operated by the Clinton Foundation?"
81.

On or about October 14, 2016, CORSI sent a message using Target Account 2 to

STONE, "i'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
82.

On or about October 17, 2016, CORSI messaged STONE using Target Account

2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

21

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 31 of 58

I

I

I

83.

On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE

with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
called Podesta' s bluff and raised him the election."
84.

On or about October 18, 2016, CORSI messaged STONE using Target Account

2, "Pis call. Important."
85.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
86.

On or about November 8, 2016, the United States presidential election took place.

87.

On or about November 9, 2016, CORSI, using Target Account 2, messaged

STONE, "Congratulations, Roger. He could not have done it without you."
88.

On or about November 10, 2016, CORSI messaged STONE using Target

Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm

in London. Have some interesting news for you."
22

I
!

 Case Document 29-9 Filed 04/28/20 Page 32 of 58

 

Case Document 29-9 Filed 04/28/20 Page 33 of 58

 

Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 34 of 58

· BACKGROUND CONCERNING EMAIL
96.

In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail ("email") to the public. The Providers allow
subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
97.

Inmy training and experience, email Providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
98.

In my training and experience, email Providers typically retain certain

transactional information about the creation and use of each account on their systems. This
25

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 35 of 58

information can include the date on which the account was created, the length of service, records
oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
99.

In my training and experience, in some cases, email account users will

communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result. of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
100.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of

26

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 36 of 58

occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent ( and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them from law enforcement).
101.

In my training and experience, information such as search history can help to

show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

27

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 37 of 58

INFORMATION REGARDING APPLE ID AND iCLOUD2

102.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
103.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
•

Apple provides email service to its users through email addresses at the

domain names mac.com, me.com, and icloud.com.
•

iMessage and FaceTime allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
•

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.

2
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/i0S Security Guide.pd[, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.

28

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 38 of 58

·•

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
•

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
•

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
•

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("OPS") networks, and Bluetooth, to determine a
user's approximate location.
•

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and downloaded through App Store on iOS devices, or

29

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 39 of 58

through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.
104.

Apple services are accessed through the use of an "Apple ID," an account created

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
105.

An Apple ID takes the form of the full email address submitted by the user to

create the account; it can later be changed. Users can submit an Applesprovided email address
(often ending in@icloud.com, @me.com,or @mac.com)or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iC!oud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
106.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records oflog-in times and durations, the types of service utilized, the status of

30

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 40 of 58

the account (including whether the account is inactive or closed), the methods used to· connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
107.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.·
108.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including

31

I

lI

1

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 41 of 58

communications regarding a particular Apple device or service, and the repair history for a
device.
I 09.

Apple provides users with five gigabytes of free electronic space on iC!oud, and

users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iC!oud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
110.

In my training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
susp1c10n.

32

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 42 of 58

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

111.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A) and 2703(c)(I )(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.
CONCLUSION

112.

Based on the forgoing, I request that the Court issue the proposed search warrant.

113.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officeris not

required for the service or execution of this warrant.

33

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 43 of 58

REQUEST FOR SEALING
114.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation

Subscribed and sworn to before me on this/)/;}ay of July, 2018.

~~~

The Honorable Beryl A. Howell
Chief United States District Judge

34

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 44 of 58

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following email account:
1.
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
1111 Stewart Avenue, Bethpage, NY 11714.

35

I

I

I
I

I

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 45 of 58

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(:f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

36

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 46 of 58

II
I

l
i

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attaclnnent A
which consists of evidence, fruits, ~r instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
c. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
·including records about their identities and whereabouts;
d. Evidence of the times the account was used;
e. All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;
f.

Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;

g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;

37

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 47 of 58

'

I
,,I

ATTACHMENT C
Property to be Searched

This warrant applies to information associated with the following Apple account:
1.
1hat is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
One Apple Park Way, Cupertino, California 95014.

38

I

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 48 of 58

ATACHMENTD
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, o~ information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(1), Apple is required to disclose the following information to the govermnent,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
a.
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI"); .
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
39

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 49 of 58

e.
The contents of all files and other records stored on iCloud, including ail iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and

j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist. txt files).

40

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 50 of 58

II.

· Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
, Julian
Assange, or any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, and
contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created,
used, or communicated with the account or identifier, including records about
their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i.

All existing printouts from original storage which concern the categories
identified in subsection II.A; and

j.

All "address books" or other lists of contacts.

41

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 51 of 58

ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following email account:

that is stored at premises owned, maintained, controlled, or operated by Windstream
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.

42

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 52 of 58

ATTACHMENT F
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(±), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment E:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Attachment E;

43

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 53 of 58

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating
to who created, used, or.
.
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified
above;

44

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 54 of 58

IN THE UNITED STATES DISTRICT COURT.
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

Case: 1:18-sc-02401
Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned waITant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct Apple Inc. ("Apple") an electronic communication
and/or remote computing services provider headquartered in Cupertino, California not to notify
m1y other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the W aITant for a period of one year or until further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when appropriate,

including the Wm-rant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589,598 (1978)). The Court may also seal the
WaITant to prevent serious jeopm·dy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
"district court of the United States ... that - has jurisdiction over the offense being investigated."

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 55 of 58

18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Corui has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b).

Apple provides an "electronic communications service," as defined in 18

U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain cetiain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of conmmnications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or corui order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result .in(!) endangering the life or physical safety of an individual;
(2) flight from prosecution;
1 Section 2705(b)

contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b )(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 56 of 58

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once .the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705{b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Apple not to notify any other person (except attorneys for Apple for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

At the present time, law enforcement officers of the FBI are conducting an

investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this waITant to Corsi could lead him to
destroy evidence or notify others who may delete information relevant to the investigation.

3

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 57 of 58

REQUEST FOR SEALING AND NON-DISCLOSURE
7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that Apple and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Wanant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may alert these targets to
the ongoing investigation and its scope. Once ale1ied to this investigation, potential targets would
be immediately prompted to destroy or conceal incriminating evidence, alter their operational
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potential target could quickly and easily destroy or encrypt digital
evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Comi and seek appropriate relief;
9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a

4

 Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 58 of 58

compelling· governmental interest in· confidentiality to justify the government's sealini request.
See Robinson, 935 F.2d at 287-89.

10.

Based on prior dealings with Apple the United States is aware that, absent a court

order under Section 2705(b) commanding Apple not to notify anyone about a legal request, it is
Apple's policy and practice, upon receipt of a wanant seeking the contents of electronically stored
wire or electronic communications for a certain account, to notify the subscriber or customer of
the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned wanant, the application and affidavit in suppmi thereof, and all attachments
thereto and other related materials be placed under seal, and furthe1more, that the Court command
Apple not to notify any other person of the existence or contents of the above-captioned wanant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or
until further order of the Court.
Respectfully submitted,
ROBERTS. MUELLER, III
Special Counsel
Dated:

J/tl/2,D/'3

By:

~-~-~

kamnS.f Zeliy

The Special Counsel's Office
(202)-514-0637

5

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 1 of 57
AO 93 (Rev. ! l/l3) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identijj1 the person by name and address)

INFORMATION ASSOCIATED WITH

)
)
)
)
)

Case: 1: 18-sc-02403
Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

)

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or prope1ty located in the
Eastern
District of
New York
(identijj1 the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the properly to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
July 26, 2018
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

<;;fin the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
prope1ty was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. _B_e_iyl A. H~o~w~e~l~I_ _ __
(UniJed States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate bmj
0 for __ days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of .. · - - -

~~A
d-'.,,y0
Judge's signature

Date and time issued:

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
----

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 2 of 57

AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

..

Executing officer's signature

-

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 3 of 57

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following email account:
1.
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
1111 Stewart Avenue, Bethpage, NY 11714.

34

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 4 of 57

ATTACHMENT B
Particular Thiugs to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, aU screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

35

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 5 of 57

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinfo1mation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
c. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
d. Evidence of the times the account was used;
e. All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;
f.

Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;

g. Credit card and other financial info1mation, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;

36

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 6 of 57

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

JUL 1 2 2018
Clerk, U.S. District & Bankruptcy

Courts for the District of Columbia

Case: 1:18-sc-02403
Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require CSC Holdings, an electronic communication and/or remote computing service s
headquartered at 1111 Stewart Avenue, Bethpage, NY 11714, not to disclose the existence or
contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Wmrnnt will seriously jeopardize the investigation, including by giving the
targets an oppo1tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Comi;
and

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 7 of 57

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), CSC Holdings and
its employees shall not disclose the existence or content of the Warrant to any other person ( except
attorneys for CSC Holdings for the purpose of receiving legal advice) for a period of one year
unless otherwise ordered by the Comi.

THE HONORABLEERYL A.HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

~/</
Date

2

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 8 of 57
AO I06 (Rev. 04/10) Application for a Search Warrant

fit!D

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH

l

l

JUL 1 2 2018
Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1 :18-sc-02403
Assigned To : Howell, Beryl A.
Assign. Date : 7/12/2018
Description: Search & Seizure Warrant

)

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the govermnent, request a search warrant and state under
penalty of pe1jury that I have reason to believe that on the following person or property (identify the person or describe the
properly to be searched and give its location):

See Attachment A.
located in the

Eastern
--~=~~~--

District of

person or describe the property to be seized):

New York
, there is now concealed (identify the
--~="-'=~--~

See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):

,!I evidence of a crime;
,!I contraband, fruits of crime, or other items illegally possessed;
r,/ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. § 371
18 u.s.c. § 1030

Offense Description
Conspiracy
Unauthorized Access of a Protected Computer

The application is based on these facts:
See attached Affidavit.
',;/ Continued on the attached sheet.
days (give exact ending date if more than 30 days: __ ___ _
O Delayed notice of
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached eet.

) is requested

Reviewed by AUSA/SAUSA:
IAaron Zelinsky (ASC)

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

7/12/2018
,.

City and state: Washington, D.C.

Judge's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 9 of 57

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

Case No.

(1,- 5C -

JUL 12 2018
Clerk, U.S. District &Bankruptcy
Courts for tile District of Columbia

c. Yo3

Filed Under Seal

AMENDED AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following:
a. The email account

maintained by CSC Holdings ("Target

Account 1"), described further in Attachment A.

b. The Apple Account (including email) associated with

maintained

by Apple, Inc. (Target Account 2), described further in Attachment C.
c. The email accoun

maintained by Windstream Communications

("Target Account 3"), described further in Attachment E.

The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
2.

I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation

(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 10 of 57

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for tbe requested warrant and does not set
forth all of my knowledge about this matter.
4.

Before the submission of this warrant application, the Special Counsel's Office

complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
members of the news media, 28 C.F.R. 50.10.
5.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a
protected computer).
JURISDICTION

6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &(c)(l)(A).
Specifically, tbe Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over tbe offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 19.
SUMMARY

7.

On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to

Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
31, 2016, STONE also instructed CORSI to have
2

contact Julian

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 11 of 57

ASSANGE. · On or about August 2, 2016, CORSI responded to STONE that the "word is friend
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta' s time in
the barrel. #CrookedHillary."
8.

Information disclosures subsequently occurred on or about the times CORSI

predicted: On or aboutAugust 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthencandidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
9.

Furthermore, on the day of the Access Hollywood video disclosure, there were

phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
first release of emails hacked from John Podesta.

3

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 12 of 57

PROBABLE CAUSE.

A. Background on Relevant Individuals
i. Roger STONE

11.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.

ii. Jerome CORSI
4

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 13 of 57

12.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed
Hacking Activity during the 2016 Presidential Election
5

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 14 of 57

14.

On October 7, 2016, the U.S. Department of Homeland Security an:d the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following, with emphasis added:
15.

The U.S. Intelligence Community (USIC) is confident that the Russian

Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior~most officials could have authorized these activities.
16.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities a:nd intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US ·Elections." In the report, the USIC
assessed the following:
17.

"Russian President Vladimir Putin ordered an influence campaign in 2016 aimed

at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
18.

The USIC also described, at a high level, some of the techniques that the Russian
6

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 15 of 57

government employed during its interference. The USIC summarized the efforts as a "Russian
messaging strategy that blends covert intelligence operations-such as cyber activity-with
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries,
and paid social media users or 'trolls."'
19.

With respect to "cyber activity," the USIC-assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
foreign intelligence agency.
20.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
21.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
C. Additional Hacking Activity by Individuals Associated with the GRU

22.

TheSpecial Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
7

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 16 of 57

23.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
24.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
25.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

D. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks
26.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
27.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
28.

On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,
8

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 17 of 57

"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
29.

On August 8, 2016, Stone addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
30.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
31.

On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
9

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 18 of 57

Twitter account was reinstated.
32.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i 'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
33.

On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34.

On August 21, 2016, using@RogerJStoneJR, Stone tweeted stating: "Trust me, it

will soon the [sic] Podesta' s time in the barrel. #CrookedHillary ." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a "'mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
35.

On September 16, 2016 Stone said in a radio interview with Boston Herald Radio

that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fairly soon. And that of course will answer the question as to what exactly what was erased on
that email server."
36.

On Saturday, October 1, 2016, using@RogerJStoneJr, Stone Tweeted,

"Wednesday@ HillaryClinton is done. #WikiLeaks."
37.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
10

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 19 of 57

tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange armouncement which was part ofWikiLeaks' 10-year armiversary celebration- Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
@RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
38.

On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
39.

Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
40.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to Stone's August
21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the NBC News, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
11

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 20 of 57

41.

· On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew a.bout the hacking ofPodesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
42.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr.
43.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
44.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
45.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
12

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 21 of 57

46.

On or about November 9, 2016, one day after the presidential election,

@wiki!eaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
4 7.

In addition, @RogerJStoneJr also exchanged direct messages with Julian

Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
messaged @JulianAssange, an address associated with Julian Assange in numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
48.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

F. CORSl's Communications with STONE,
Forthcoming Leaks.

13

and Others Regarding

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 22 of 57

49.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's

address,

On or about December 19, 2017 Chief Judge Beryl A. Howell issued a
search warrant for

email account. On or about March 14, 2018, Chief Judge Beryl

A. Howell issued a search watTant for STONE's iCloud account. Information recovered pursuant
to those search warrants indicated the following:
50.

emailed CORSI at Target Account 3:

On or about May 15, 2016,

"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
meet Manafort -guarantee nothing."
51.

emailed CORSI on Target Account 3:

On or about May 16, 2016,

"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSiresponded, "I will work on
other meetings today."

replied, "Do you [want] me to bring you anything from the

Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52.

On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE

with the Title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
14

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 23 of 57

53.

On July 25, 2016, STONE sent an email to CORSI at Target Account 1 with the

subj~ct line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54.

On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the

subject line, "Call me MON." The body of the email read: "

should see Assange[.]

should find Bernie [S]anders brother who called Bill a Rapist-turn him for Trump[.]
should find
55.

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in preseason games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
reference to a "friend in embassy [who] plans 2 more. dumps" refers to Julian ASSANGE, the
founder ofWikiLeaks, who resided in Ecuador's London Embassy in 2016.
56.

an associate ofSTONE's, emailed

On or about August 5, 2016

him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night."
15

subsequently

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 24 of 57

stated to investigators that, around the same time, STONE told him he had gone to London to
meet ASSANGE.

also stated that in 2018,

told STONE he would be

interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
STONE told
57.

he was joking and had not actually met Assange.
On or about August 15, 2016, CORSI messaged STONE using Target Account

3: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
58.

On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:

"Did you get the PODESTA writeup." STONE replied "yes."
59.

On or about August 31, 2016, CORSI, using Target Account 2, messaged

STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."
60.

On or about September 6, 2016, CORSI emailed STONE using Target Account

3: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
61.

On or about September 24, 2016

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday

and spoke to him about it again today."

wrote back, "Awaiting secret file.

Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
responded, "Keep me posted about file[.]" In a subsequent meeting with investigators,
16

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 25 of 57

indicated this conversation concerned possible derogatory information he was trying
to obtain from Turkey.
62.

On or about October 3, 2016, an associate of STONE emailed STONE and asked:

"Assange - what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
63.

.On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
64.

On or about October 4, 2016, CORSI messaged STONE using Target Account 2,

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
65.

That same day, BANNON emailed STONE, "What was that this morning???"

STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer

17

is a big democrat."

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 26 of 57

66.

When BANNON spoke with investigators during a volunt~y proffer on February

14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

67.

According to a publicly available news article, 1 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
Trump's campaign, 'Access Hollywood' and NBC for reaction."
68.

According to phone records

, at approximately

11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
69.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
70.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
71.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-

on/2016/10/07/31 d747 l 4-8ce5- l l e6-875e-2c 1bfe943b66_story.html

18

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 27 of 57

72.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
73.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
74.

At approximately 6:27PM,

sent STONE an email titled,

"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE forwarded

message to CORSI at Target

Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
H. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After
STONE Is Accused of Advance Knowledge of the Leak
75.

On or about October 8, 2016, STONE messaged CORSI at Target Account 2,

"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
comments, attacking bad job numbers."
76.

On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE

emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need yourBEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 28 of 57

complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
77.

On or about that same day October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
the Clinton Foundation."
78.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the
79.

Account, "Got them and used them."

On or about Thursday, October 13, 2016, CORSI, using Target Account 3,

emailed STONE: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
skimmed maybe billions off Skolkovo -

'
Skolkovo
kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

20

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 29 of 57

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
80.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA." The text
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or.data from Wikileaks." The post then asked, "Just
how much
;
money did

, a controversial Russian billionaire investor with ties to the

Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by

, with the money transferred via Deutsche Bank and

Trust Company Americas in New York City, with the money ending up in a private bank
account in the Bank of America that is operated by the Clinton Foundation?"
81.

On or about October 14, 2016, CORSI sent a message using Target Account 2 to

STONE, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
82.

On or about October 17, 2016, CORSI messaged STONE using Target Account

2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

21

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 30 of 57

83.

On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE

with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
called Podesta' s bluff and raised him the election."
84.

On or about October 18, 2016, CORSI messaged STONE using Target Account

2, "Pls call. Important."
85.

. On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear

it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
86.

On or about November 8, 2016, the United States presidential election took place.

87.

On or about November 9, 2016, CORSI, using Target Account 2, messaged

STONE, "Congratulations, Roger. He could not have done it without you."
88.

On or about November 10, 2016, CORSI messaged STONE using Target

Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm

in London. Have some interesting news for you."
22

 Case Document 29-10 Filed 04/28/20 Page 31 of 57

 

Case Document 29-10 Filed 04/28/20 Page 32 of 57

 

Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 33 of 57

BACKGROUND CONCERNING EMAIL
96.

In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail ("email") to the public. The Providers allow
subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
97.

In my training and experience, email Providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). ·In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
98.

In my training and experience, email Providers typically retain certain

transactional information about the creation and use of each account on their systems. This
25

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 34 of 57
I

II

f

information can include the date on which the account was created, the length of service, records

I
I
'

oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
99.

In my training and experience, in some cases, email account users will

communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
100.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of

26

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 35 of 57

occupancy" while executing a search warrant at a·residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them from law enforcement).
101.

In my training and experience, information such as search history can help to

show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

27

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 36 of 57

INFORMATION REGARDiNG APPLE ID AND iCLOUD 2

102.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
103.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
•

Apple provides email service to its users through email addresses at the

domain names mac.com, me.com, and icloud.com.
•

iMessage and FaceTime allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while Face Time enables those users to
conduct video calls.
•

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.

2

The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/iOS Security Guide.pdf, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.

28

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 37 of 57

•

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.cotn.. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
•

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
•

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
•

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
•

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and downloaded through App Store on iOS devices, or

29

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 38 of 57

through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.
104.

Apple services are accessed through the use of an "Apple ID," an account created·

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
105.

An Apple ID takes the form ofthe full email address submitted by the user to

create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in@icloud.com, @me.com, or@mac.com) or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email'.' sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
106.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition; Apple captures the date on which the account was created, the
length of service, records oflog-in times and durations, the types of service utilized, the status of
30

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 39 of 57

the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
107.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
108.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including

31

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 40 of 57

communications regarding a particular Apple device or service, and the repair history for a
device.
I 09.

Apple provides users with five gigabytes of free electronic space on iC!oud, and

users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iC!oud-connected services, including: email
(iC!oud Mail); images and videos (iC!oud Photo Library, My Photo Stream, and iC!oud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iC!oud Drive); and
web browser settings and Wi-Fi network information (iC!oud Tabs and iC!oud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iC!oud; for example, the iOS app for WbatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
110.

Inmy training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.

32

I
I

I

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 41 of 57

I
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

111.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of commuuications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will rev1ew that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.
CONCLUSION

112.

Based on the forgoing, I request that the Court issue the proposed search warrant.

113.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

33

I
'I

!
1,

I

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 42 of 57

REQUEST FOR SEALING
114.

I further request thatthe Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

~~

Andrew Mitchell
Special Agent
Federal Bureau ofinvestigation

~

Subscribed and sworn to before me on thisB day of July, 2018.

~&~~

The Honorable Beryl A. Howell
Chief United States District Judge

34

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 43 of 57

I
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following email account:

I

I!
11

II

I

I

1.

that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
1111 StewartAvenue, Bethpage, NY 11714.

35

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 44 of 57

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provideris required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

36

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 45 of 57

I
I

I

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
c. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
d. Evidence of the times the account was used;
e. All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;
f.

Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;

g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;

37

l
Ii

!

I!

I

'

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 46 of 57

ATTACHMENT C
Property to be Searched

This warrant applies to information associated with the following Apple account:
1.
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
One Apple Park Way, Cupertino, California 95014.

38

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 47 of 57

l
ATACHMENTD

l
l

Particular Things to be Seized

I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
a
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);

b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
39

I

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 48 of 57

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other recordi related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes ·
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and

j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

40

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 49 of 57

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attaclunent A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related a9tivities in connection with computers and 18 U.S.C. § 371 (conspiracy to conunit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
conununications regarding hacking, release of hacked material, conununications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or conununications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
Julian
conununications or meetings involving Roger Stone,
Assange, or any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, and
contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Conununication, information, documentation and records relating to who created,
used, or conununicated with the account or identifier, including records about
their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and conununications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i.

All existing printouts from original storage which concern the categories
identified in subsection II.A; and

J.

All "address books" or other lists of contacts.

41

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 50 of 57

ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following email account:

that is stored at premises owned, maintained, controlled, or operated by Windstream
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.

42

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 51 of 57

ATTACHMENTF
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment E:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full riame, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Attachment E;

43

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 52 of 57

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attaclnnent A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i.

All existing printouts from original storage which concern the categories identified
above;

44

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 53 of 57

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH

Case: 1:18-sc-02403
Assigned To: Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct CSC Holdings, an electronic communication and/or
remote computing services provider headquartered in Bethpage, NY not to notify any other person
(except attorneys for CSC Holdings for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing

Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wa!1"ant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See WashingtonPostv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Cami has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
"district court of the United States ... that - has jurisdiction over the offense being investigated."

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 54 of 57

18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occu1Ted within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b). CSC Holdings provides an "electronic communications service," as defined in
18 U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how CSC Holdings may
be compelled to supply communications and other records using a subpoena, court order, or search
warrant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a comi order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a cou1i order to preclude such
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider ·of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to notify any other person of the existence of the wa1Tant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
1 Section

2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 55 of 57

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S:C. § 2705(b ). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:.
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court dete1mines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Gran_d Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command CSC Holdings not to notify any other person (except attorneys for CSC Holdings for
the purpose of receiving legal advice) of the existence ofthe Subpoena for a period of one year or
until further order of the Comi.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

At the present time, law enforcement officers of the FBI are conducting an

investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to
destroy evidence or notify others who may delete info1mation relevant to the investigation.

3

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 56 of 57

REQUEST FOR SEALING AND NON-DISCLOSURE
7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that CSC Holdings and its employees be directed not to notify any other person
of the existence or cof\tent of the Warrant (except attorneys for CSC Holdings for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order ·
is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of
which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the ongoing investigation and its scope. Once ale1ied to this investigation, potential
targets would be immediately prompted to destroy or conceal incriminating evidence, alter their
operational tactics to avoid future detection, and otherwise take steps to undermine the
investigation and avoid future prosecution.

In patiicular, given that they are known to use

electronic communication and remote computing services, the potential target could quickly and
easily destroy or encrypt digital evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
9.

There is, therefore, reason to believe that notification of the existence of the

WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a

4

 Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 57 of 57

compelling governmental interest in confidentiality to justify the government's sealing request.

See Robinson, 935 F.2d at 287-89.
10.

Based on prior dealings with CSC Holdings the United States is aware that, absent

a court order under Section 2705(b) commanding CSC Holdings not to notify anyone about a legal
request, it is CSC Holdings's policy and practice, upon receipt of a warrant seeking the contents
of electronically stored wire or electronic communications for a certain account, to notify the
subscriber or customer of the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
CSC Holdings not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for CSC Holdings for the purpose of receiving legal advice) for a period
of one year or until further order of the Court.
Respectfully submitted,
ROBERTS. MUELLER, III
Special Counsel
Dated:

1/fZ/?_of'<j

By:
Aaron S.J. ZeJi
The Special G, nsel' s Office
(202)-514-0637

5

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 1 of 38

AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)

INFORMATION ASSOCIATED WITH THREE
ACCOUNT STORED AT PREMISES
CONTROLLED BY GOOGLE

)
)
)
)

case: 1:18-sc-02524
Assigned To : Howell, Beryl A.
Assign . Date: 7/27/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 10, 2018
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

(;t in the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly retum this warrant and inventory to
Hon. Beryl A Howell, Chief U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 2 of 38

AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 3 of 38

ATTACHMENT A
Property to be Searched

This warrant applies to search history information associated with the following accounts
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain
View, California:

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 4 of 38

ATTACHMENT B
Particular Things to he Seized
Files and Accounts to be produced by the Provider:

I.

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. All search history information associated with each account.

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

2

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 5 of 38

b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Information, documentation and records relating to who created, used, or communicated
with the account or identifier concerning the messages identified above, including records
about their identities and whereabouts;
e. Evidence of the times the account was used;
f. All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;
g. Evidence of passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;

I.

Review Protocols

Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

3

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 6 of 38
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT

JUL 2 7 2018

for the
District of Columbia
In the Matter of the Search of
(Briefly describe lltc property I Q be search d
or ide11tify th person by name and a ldres:;)

INFORMATION ASSOCIATED WITH THREE ACCOUNTS
STORED AT PREMISES CONTROLLED BY GOOGLE

)
)

)
)
)

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1 :18-sc-02524
Assigned To : Howell, Beryl A.
Assign. Date: 7/27/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A

located in the

Northern
- -- - --- District of - - - --California
- - -- - - - , there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):

fi evidence of a crime;
fi contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section

18 u.s.c. §§ 2, 3, 4, 371
18 u.s.c. §§ 1030, 1343, 1349
52 u.s.c. § 30121

Offense Description
Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy
Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy
Foreign Contribution Ban

The application is based on these facts:
See attached Affidavit.

t;/ Continued on the attached sheet.
0 Delayed notice of
days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth o~

Reviewed by AUSA/SAUSA:
jKyle R. Freeny (ASC)

) is requested

Applicant's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 7 of 38
rl i1

fr i

JUL 21 20!U
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY GOOGLE

Clork, U,s, Ui»trlut l"'4 Dunkruptcy
Courts for iha District of Columbia

Case: 1: 18-sc-02524
Ass!gned To: Howell, Beryl A
.
Assign. Date: 7/27/2018
Description : Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for search

history information associated with the following Google accounts
("Target Accounts"), stored at
premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a business
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The
information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments A and B.
2.

I am a Special Agent with the Federal Bureau of Investigation (FBI), and have

been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain information relevant to

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 8 of 38

violations of 18 U.S.C. § 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18
U.S .C. § 4 (misprision of a felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S .C. § l 349
(attempt and conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban)
(the "Subject Offenses").

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 19.

SUMMARY
6.

The Special Counsel's Office, with FBI's assistance, is investigating the Russian

government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump. This includes investigating Roger Stone (STONE) and others known
and unknown, in connection with the hacking of email accounts associated with the Democratic
National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and
individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent
dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks,
among others.

2

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 9 of 38

7.

On or about July 25, 2016, STONE emailed Jerome CORSI to "Get to Assange"

at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July 31, 2016,
STONE also instructed CORSI to have

contact Julian ASSANGE. On or

. about August 2, 2016, CORSI responded to STONE that the "word is friend in embassy
[ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned
to be very damaging .... Time to let more than Podesta to be exposed as in bed w enemy if they
are not ready to drop HRC." After receipt of that message, on or about August 21, 2016, using
@RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in the barrel.
#CrookedHillary."
8.

Information disclosures subsequently occurred on or about the times CORSI

predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the DCCC.
On or about October 7, 2016, the day the Washington Post published a breaking story about an
Access Hollywood videotape of then-candidate Trump making disparaging remarks about
women, WikiLeaks released emails hacked from the account of John Podesta.
9.

Furthermore, on the day of the Access Hollywood video disclosure, there were

phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story

3

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 10 of 38

regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
first release of emails hacked from John Podesta.

PROBABLE CAUSE

A. Background on Relevant Individuals
i. Roger STONE
11.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the

4

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 11 of 38

Campaign, including then-campaign chairman Paul MAN AF ORT and deputy chairman Rick
GATES.
ii. Jerome CORSI

12.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

5

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 12 of 38

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

14.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following, with emphasis added:
The U.S. Intelligence Community (USIC) is confident that the Russian Government
directed the recent compromises of emails from US persons and institutions, including
from US political organizations. The recent disclosures of alleged hacked emails on sites
like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and
disclosures are intended to interfere with the US election process. Such activity is not
new to Moscow-the Russians have used similar tactics and techniques across Europe
and Eurasia, for example, to influence public opinion there. We believe, based on the
scope and sensitivity of these efforts, that only Russia's senior-most officials could have
authorized these activities.
15.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, arid harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
16.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
6

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 13 of 38

activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls.'"
17.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
18.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
19.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
20.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
21.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
7

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 14 of 38

those accounts.
22.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
23.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
24.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the
2016 presidential election, including conspiracy to commit authorized access to protected
computers. (Case No . l:18-cr-00125).
C. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks

25.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main paii
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
26.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
27.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem ·
8

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 15 of 38

to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Gucci fer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
28.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with AS SANGE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
had a close friend who served as an intermediary.
29.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
30.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
31.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
9

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 16 of 38

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
32.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chainnan of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
33.

On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: "Trust me,

it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a '"mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
34.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
35.

On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday@ HillaryClinton is done. #WikiLeaks."
36.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
10

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 17 of 38

part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
37.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
38.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
39.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE responded: "I have never
met or spoken with Assange, we have a mutual friend who's traveled to London several times,
and everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
40.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
11

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 18 of 38

communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
41.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
42.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false ciaims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
43.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
44.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"

1

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account @RogerJStoneJr.
12

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 19 of 38

@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
45.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
46.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE
Forthcoming Leaks
4 7.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address

On October

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE'

13

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 20 of 38

addresses,

On or about December 19, 2017, Chief Judge Beryl A.

Howell issued a search warrant for

email account. On or about March 14, 2018,

Chief Judge Beryl A. Howell issued a search warrant for STONE's iC!oud account. Information
recovered pursuant to those search warrants indicated the following:
48.

emailed CORSI: "Here is my flight

On or about May 15, 2016,

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
have forwarded the message to STONE at

who replied to CORSI that,

"May meet Manafort -guarantee nothing."
49.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were·
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
50.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
51.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.]
Trump[.]

, emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist- turn him for
should find

or more proof of Bill getting kicked out."
14

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 21 of 38

52.

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact ofrigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w
'
.
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
53.

On or about August 5, 2016,

STONE at

an associate of STONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the same

time, STONE told him he had gone to London to meet AS SAN GE.
in 2018,

also stated that

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SANGE. STONE told

he was joking and

had not actually met AS SANGE.
54.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is
15

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 22 of 38

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
55.

On or about August 31, 2016, CORSI emailed STONE at
"Did you get the PODESTA writeup." STONE replied "yes."
On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

56.

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
57.

On or about September 6, 2016, CORSI emailed STONE at
: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

58.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this conversation

concerned possible derogatory information he was trying to obtain from Turkey.
59.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange-what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
16

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 23 of 38

wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
knows what Assange has. I'd say that's important."
60.

On or about October 4, 2016, AS SAN GE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out.before Election Day.
61.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
62.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer

is a big

democrat."
63.

When BANNON spoke with investigators during a voluntary proffer on February

14, 201'8, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

17

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 24 of 38

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
64.

According to a publicly available news article,2 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
Trump's campaign, 'Access Hollywood,' and NBC for reaction."
65.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
66.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
67.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
68.

At approximately 2: 18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
69.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
70.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

2

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /31d747 l 4-8ce5-l l e6-875e-2cl bfe943b66 _ story.html
18

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 25 of 38

On or about August 2, 2016, when CORSI emailed STONE on

he

wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
71.

At approximately 6:27PM,

sent STONE an email titled,

"WikiLeaks - The Podesta Emails," with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE, using

forwarded

message to CORSI without comment. STONE does not appear to have forwarded the email to
any other individual.

G. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After
STONE Is Accused of Advance Knowledge of the Leak
72.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will Jose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
73.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

using

emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
74.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

, with a subject line

19

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 26 of 38

"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
personally and the Clintons through the Clinton Foundation."
75.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
76.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I' 11 give you one more like

NOBODY YET HAS THIS[:] It looks to me

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
77.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
20

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 27 of 38

name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
78.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
79.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."
80.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
21

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 28 of 38

It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
81.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
82.

On or about October 19, 2016, STONE published an article on Breitbart.corn in

which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
83.

On or about November 8, 2016, the United States presidential election took place.

84.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
85.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

22

 Case Document 29-11 Filed 04/28/20 Page 29 of 38

 

Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 30 of 38

I. Evidence of Google Searches Relating to the Conduct Under Investigation
92.

The search history associated with the account

which was

obtained pursuant to search warrant, shows that STONE searched for terms that appear to be
related to the DNC hack and the stolen emails, including his nexus thereto, while logged into the
For example, on or about October 13, 2016, STONE searched for the
words "Roger Stone john Podesta." The search history for

appears to

have been deleted between January 18, 2016, and July 23, 2016.
93.

During the course of its investigation, the FBI has also identified a series of

searches that appear to relate to the personas Guccifer 2.0 and DCLeaks, which predate the
public unveiling of those two personas. In particular, between May 17, 2016, and June 15, 2016
24

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 31 of 38

(prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that
searches were conducted for the terms "dcleaks," "guccifer," and ''guccifer june," from IP
addresses within one of two ranges: 172.56.26.0/24, 107.77.216.0/24. 3 These IP ranges are
assigned to T-Mobile USA, Inc., and AT&T Mobility LLC, respectively, and, according to
Google, the searches were all conducted from Florida. On or about June 13, 2018, this Court
issued a search warrant for information associated with these searches and, in particular, for the
full search histories associated with the CookieIDs that conducted the search. 4 As set forth in the
affidavit submitted in support of that search warrant, IP logs obtained from Twitter showed that
STONE used multiple IP addresses within the ranges 172.56.26.0/24 and 107.77.216.0/24 to log
into his Twitter account @RogerJStoneJr. A Facebook account controlled by STONE also used
an IP address within the range 172.56.26.0/24 on or about June 13, 2016, to purchase a Facebook
advertisement.
J. The Target Accounts

94.

Subscriber records show that, in addition to

STONE

maintains at least two additional Google accounts registered in his name:
a.

("Target Account 1") was created on July 28, 2016,

and uses the recovery email address

. According to subscriber records,

Target Account 1 was last accessed on July 5, 2017. Search warrant returns for

how that on or about August 3, 2016, STONE sent an email from

3

Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range .of up to 256 IP addresses.
4

Google assigns unique CookieIDs to searches conducted while a user is not logged into a
Google account. All searches conducted from the same device and browser during a 24-hour
window are associated with the same CookieID.
25

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 32 of 38

to Target Account 1, with no subject, attaching what appears to be an
advertisement for his book tour, entitled, "Clinton's War on Women."
b.

"Target Account 2") was created on or about

October 26, 2016, and uses Target Account 1 as the recovery email. Target Account 2 was last
accessed on or about August 8, 2017.
95.

The search of STONE's Hotmail account indicates that STONE uses the address
"Target Account 3"). For example, on or about June 27, 2016, Stone

received an email in his

account from the "Gmail Team" with the subject,

"Your Gmail address,

, has been created." Subscriber records show that

Target Account 3 was created on June 27, 2016, and is registered in the name of"Swash

Buckler." On or about April 16, 2018, this Court issued an order pursuant to 18 U .S.C.

§ 2703(d) for non-content information associated with Target Account 3. Based on a review of
the header information obtained from Google pursuant to that Order, it appears that STONE
frequently used Target Account 3 to communicate with others via the classified advertisement
website Craigslist.org ("Craigslist").
96.

This warrant application seeks only search history for the Target Accounts; it

does not seek the content of email communications to and from the Target Accounts. 5 Google
maintains records of the Google searches that a user conducts while signed into a particular
Google email account (provided the user has not disabled the retention of this information). In
my training and experience, I know that users are often not aware of whether or not they are

5

The government is also contemporaneously seeking an order pursuant to 18 U.S.C. § 2703(d)
for non-content information associated with Target Accounts 1 and 2, including header
information.
26

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 33 of 38

experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
99.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with a Google account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, an account's search
history may indicate who used or controlled the account at a relevant time. Further, information
maintained by the email Providers can show how and when the account was accessed or used.
Additionally, information stored in an account's search history may indicate the geographic
location of the account user at a particular time (e.g., location information integrated into an
image or video sent via email). Lastly, stored electronic data, including search history
information, may provide relevant insight into the email account owner's state of mind as it
relates to the offense under investigation. For example, information in the email account may
indicate the owner's motive and intent to commit a crime (e.g., searches relating to the crime), or
consciousness of guilt (e.g., deleting search history in an effort to conceal information from law
enforcement).
FILTER REVIEW PROCEDURES

100.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and

28

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 34 of 38

other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
The government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team .
CONCLUSION
101.

Based on the forgoing, I request that the Court issue the proposed search warrant.

102.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING
103.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

29

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 35 of 38

Respectfully sHbmitted,

~

Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation

. 1 It',
Subscribed and sworn to before me on thisll_ day of July, 2018.

/1;t4 &irLt/
The Honorable Beryl A. Howell
Chief United States District Judge

30

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 36 of 38

ATTACHMENT A
Property to be Searched

This warrant applies to search history information associated with the following accounts
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain
View; California:

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 37 of 38

ATTACHMENT B
Particular Things to be Seized
Files and Accounts to be produced by the Provider:

I.

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, tiles, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. All search history information associated with each account.

II.

Information to be Seized by Law Enforcement Personnel
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

2

 Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 38 of 38

b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,
Julian Assange, or
any individual associated with the Trump Campaign;
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Information, documentation and records relating to who created, used, or communicated
with the account or identifier concerning the messages identified above, including records
about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;

g. Evidence of passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;

I.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

3

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 1 of 47
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Rriejly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THREE
ACCOUNTS STORED AT PREMISES
CONTROLLED BY FACEBOOK

)
)
)

)
)
)

Case: 1:18-sc-02570
Assigned To: Howell, Beryl A.
Assign. Date : 8/2/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 15, 2018
(nottoexceed /4 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
CJ at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by Jaw and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, wiJJ be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) l'.:J until, the facts justifying, the later specific date of

Date and time issued:

City and state :

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 2 of 47
AO 93 (Rev. I 1/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

11

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer 's signature

PrinJed name and title

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 3 of 47

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, lnc.
("Facebook"), a company headquartered at 1 Hacker Way, Menlo Park, California 94025:

- 1-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 4 of 47

ATTACHMENT B
I.

Information to be disclosed by Facebook

To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of Facebook Inc. ("Face book"), including any messages, records, files, logs, or
information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
following infonnation to the government for each user ID listed in Attachment A:
(a)

All contact and personal identifying infonnation, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

(b)

All activity logs for the account and all other documents showing the user's posts
and other Facebook activities;

(c)

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;

(d)

All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use of Facebook applications;

-2-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 5 of 47

(e)

All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;

(f)

All records relating to machine cookies;

(g)

All "check ins" and other location information, including records of the user's
latitude and longitude;

(h)

All IP logs, including all records of the IP addresses that logged into the account;

(i)

All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";

(j)

All information about the Facebook pages that the account is or was a "fan" of;

(k)

All past and present lists of friends created by the account;

(l)

All records of Facebook searches performed by the account;

(m)

All information about the user's access and use ofFacebook Marketplace;

(n)

The types of service utilized by the user;

(o)

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

(p)

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

(q)

All past and present Admins for the group;

(r)

The "Creator" of the group;

-3-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 6 of 47

(s)

All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

(t)

All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
services and records of actions taken;

(u)

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and queried.

II.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S .C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 7 of 47

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,

Jerome

Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

f.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

g.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

h.

The source of all funds used to purchase advertisements or make other expenditures
or disbursements in these accounts;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

-5-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 8 of 47

J.

The identity of any non-U.S. person(s)- including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

k.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

-6-

 AO 106 (Rev . 04/10)
Application
for a Search Warrant
Case
1:19-mc-00029-CRC

Document 29-12 Filed 04/28/20 Page 9 of 47

UNITED STATES DISTRICT COURT
for the

AUG - 2 2018

District of Columbia

/lark, U.S. District & Bankruptcy
ourts for the District of Cil/!!mb/a

In the Matter of the Search of

)

(Br iefly describe the p roperty to be Searched
or ;aentify 1he person by name and address)

Case: 1: 18-sc-02570
Ass!gned To : Howell, Beryl A.
Assign. Date : 8/2/2018
Description: Search & Seizure Warrant

)
)

INFORMATION ASSOCIATED WITH THREE ACCOUNTS
STORED AT PREMISES CONTROLLED BY FACEBOOK

)
,

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A

located in the

Northern

- - - -- - - -

District of

California
, there is now concealed (identify the
------

- - -- --

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
rif property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Offense Description

Code Section
18 U.S.C. §§ 2, 3, 4, 371
18 u.s.c. §§ 1030, 1343, 1349
52 U.S.C. § 30121

Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy
Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy
Foreign Contribution Ban

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

) is requested

~___-/
Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC)

Applicant's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

·

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 10 of 47

I
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE FACEBOOK ACCOUNTS
STORED AT PREMISES CONTROLLED
BY FACEBOOK, INC.

AUG - 2 2018
Clerk, U.S. District & Bankruptc
Courts for the District of Co/umbra

Case: 1:18-sc- 02570
Ass!gned To: Howell, Beryl A
Assign. Date: 8/2/2o 18
Description : Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Facebook accounts associated with the following user IDs:

which are stored at premises owned, maintained, controlled or operated by Facebook Inc., a social
networking company headquartered in Menlo Park, California ("Facebook"). The information to
be disclosed by Facebook and searched by the government is described in the following paragraphs
and in Attachments A and B.
2.

I am a Special Agent with the Federal Bureau of Investigation (FBI), and have

been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is

-1 -

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 11 of 47

intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), and
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 30121(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the
information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities
of the Subject Offenses, further described in Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) . .. that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

PROBABLE CAUSE
A. Background on Relevant Individuals

i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official

-2-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 12 of 47

relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.
ii. Jerome CORSI

7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 13 of 47

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls.'"
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to _Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 14 of 47

in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
, the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

-5-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 15 of 47

18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to comrriit authorized access to protected computers.
(Case No. 1: 18-cr-OO 125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

-6-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 16 of 47

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with AS SAN GE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
had a close friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washi1;1gton D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJR, STONE tweeted stating: "Trust me,

-7-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 17 of 47

it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a "'mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

-8-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 18 of 47

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE indicated that he had
never met or spoken with Assange, saying that "we have a mutual friend who's traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Hu'ma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

-9-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 19 of 47

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 20 of 47

from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE's
addresses,

. On or about December 19, 2017, Chief Judge Beryl A.

Howell issued a search warrant for

email account. On or about March 14, 2018,

Chief Judge Beryl A. Howell issued a search warrant for STONE's iCloud account. Information
recovered pursuant to those search warrants indicated the following:
42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI

-11-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 21 of 47

appears to have forwarded the message to STONE at

who replied to

CORSI that, "May meet Manafort -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read: "
Assange[.]
Trump[.]
46.

, emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist-tum him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w

-12-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 22 of 47

enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
· expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SAN GE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
47.

On or about August 5, 2016,

STONE at

an associate of STONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet AS SAN GE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SAN GE. STONE told

he was joking and

had not actually met ASSANGE.
48.

On or about August 15, 2016, CORSI emailed STONE at
: "Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
49.

On or about August 31, 2016, CORSI emailed STONE at
: "Did you get the PODESTA writeup." STONE replied "yes."

50.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by

-13-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 23 of 47

S [b ]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
51.

On or about September 6, 2016, CORSI emailed STONE at
: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

52.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
53.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange-what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
knows what Assange has. I'd say that's important."
54.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,

-14-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 24 of 47

information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
55.

On or about October 4, 2016, CORSI messaged STONE at his iClciud account:

"Assange made a fool of himself. Has nothing or he would have released it. Tota! BS hype."
56.

That same day, BANNON emailed STONE a

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer

is a big

democrat."
57.

When BANNON spoke with investigators during a voluntary proffer on February

14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
58.

According to a publicly available news article, 2 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage

2

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/3 ld74714-8ce5-1 le6-875e-2cl bfe943b66_story.html
-15-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 25 of 47

from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
59.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
61.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
62.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
63.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
64.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on

, he

wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
65.

At approximately 6:27PM

sent STONE an email titled,

"WikiLeaks -The Podesta Emails," with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE, using

, forwarded

message to CORSI without comment. STONE does not appear to have forwarded the email to
any other individual.

-16-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 26 of 47

G. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After
STONE Is Accused of Advance Knowledge of the Leak

66.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed -

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
67.

On or about Wednesday, October 12, 2016, at approximately 8: 17 AM, STONE,

using

emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

, with a subject line

"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
personally and the Clintons through the Clinton Foundation."
69.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."

-17-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 27 of 47

70.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more like

NOBODY YET HAS THIS[:] It looks to me

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

-18-

with the money

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 28 of 47

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72.
a..:..:uuul, 'Tm

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
iu NYC. Thinking about writing piece attacking Leer and other women. It's

basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
74.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
75.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."

-19-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 29 of 47

76.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
77.

On or about November 8, 2016, the United States presidential election took place.

78.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
79.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'1? in
London. Have some interesting news for you."

-20-

 Case Document 29-12 Filed 04/28/20 Page 30 of 47

 

Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 31 of 47

I.

Statements Regarding STONE's Use of Facebook

86.

On or about Friday, May 18, 2016,

was voluntarily interviewed

by investigators from the Special Counsel's Office.

told investigators that he became

STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
87.

According to

STONE utilized the services of several individuals to

post social media content to Facebook and Twitter, and that he
instructed these individuals about what to post.

and STONE both

stated that he purchased a couple

hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts. 3 According to

one of the individuals who did work for STONE on

Facebook in 2016 was Everett WILKINSON, a social media marketer and IT expert.
88.

further stated that STONE wanted to push out WikiLeaks content

through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
was pushed out through STONE's Facebook and Twitter accounts.

3

Facebook requires that all users of Facebook accounts use their actual name while registering
and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
-22-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 32 of 47

J. The Target Accounts
89.

According to subscriber records obtained from Facebook, Target Account 1,

with Facebook user ID

, is registered with the vanity name "rogerstone" and

the email address

Target Account 1 is associated with

. Based on search warrant returns for STONE's

account

, between on or about October 31, 2016 and November 3, 2016,
received receipts from Facebook for the purchase of a number of
advertisements associated with the Target Account, including advertisements with the following
excerpted titles (as set forth in the receipts):
•

"BREAKING: New #Wikileaks emails prove that Team ... "

•

"Roger Stone talked about WikiLeaks, Donald Trump, ... "

90.

Additionally, on or about March 31, 2017, STONE received a Facebook receipt at

his Hotmail account for advertisements associated with Target Account 1, with the following
excerpted titles (as set forth in the receipt):

91.

•

"Stone Rebuts Charge of Russian Collusion"

•

"I am not in touch with any Russians, don't have ... ,"

•

"The charge that I am working for Russian ... ,"

•

"In fullest statement yet on DNC hacking ... "

•

"ROGER STONE - NO consensus that Guccifer 2.0 is a ... "
Target Account 2, with Facebook user ID

with the vanity name "rogerstone," using the email account

, is registered
. On or

about August 13, 2017, STONE received a receipt from Facebook for several advertisements

-23-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 33 of 47

associated with Target Account 2, including an advertisement with the excerpted title, "I am not
in touch with any Russians ... "
92.

Target Account 3 has the Facebook user ID

and was created

on or about October 27, 2015. The account is registered in the name of
the email address

using

and the verified telephone number

According to a public records database, the telephone number
Search warrant returns for STONE's
Google indicating that

is linked to

account contain a notification from

is listed as the recovery email for
Search warrant returns for STONE's

contain a number of emails from Facebook to

account also
relating to Target

Account 3, which may have bee.n auto-forwarded to STONE's Hotmail account. These emails

include a notification of a password change to Target Account 3 and at least one receipt for a
Facebook advertisement associated with Target Account 3, sent on or about June 30, 2016. At
least one of these emails was then forwarded to
93.

account

.4

As explained further below, in my training and experience, I know that, in

addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
communicate with WikiLeaks and ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING FACEBOOK

94.

Facebook owns and operates a free-access social networking website of the same

name that can be accessed at http://www.facebook.com. Facebook allows its users to establish

4

told investigators that he would sometimes send emails from STONE's account.
-24-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 34 of 47

accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.
95.

Facebook asks users to provide basic contact and personal identifying information

to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
also assigns a user identification number to each account.
96.

Facebook users may join one or more groups or networks to connect and interact

with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
user's "Friends," such as profile changes, upcoming events, and birthdays.
97.

Facebook users can select different levels of privacy for the communications and

information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.

-25-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 35 of 47

98.

Facebook users can create profiles that include photographs, lists of personal

interests, and other information.

Facebook users can also post "status" updates about their

whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
who can view the user's profile.
99.

Facebook allows users to upload photos and videos, which may include any

metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
100.

Facebook users can exchange private messages on Facebook with other users.

These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a Chat feature that allows users to send and receive instant messages

-26-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 36 of 47

through Facebook. These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call.
101.

If a Facebook user does not want to interact with another user on Facebook, the

first user can "block" the second user from seeing his or her account.
102.

Facebook has a "like" feature that allows users to give positive feedback or connect

to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
particular Facebook pages.
103.

Facebook has a search function that enables its users to search Facebook for

keywords, usemames, or pages, among other things.
104.

Each Facebook account has an activity log, which is a list of the user's posts and

other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
105.

Facebook Notes is a blogging feature available to Facebook users, and it enables

users to write and post notes or personal web logs ("blogs"), or to import their blogs from other
services, such as Xanga, LiveJoumal, and Blogger.
106.

The Facebook Gifts feature allows users to send virtual "gifts" to their friends that

appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are

-27-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 37 of 47

free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.
107.

Face book also has a Marketplace feature, which allows users to post free classified

ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
108.

In addition to the applications described above, Facebook also provides its users

with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
use of that application may appear on the user's profile page.
109.

Some Facebook pages are affiliated with groups of users, rather than one individual

user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
the current status of the group profile page.
110.

Facebook uses the term "Neoprint" to describe an expanded view of a given user

profile. The "Neoprint" for a given user can include the following information from the user' s
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
and use of Facebook applications.

-28-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 38 of 47

111.

Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.

These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
from what IP address the user did so.
112.

Social networking providers like Facebook typically retain additional information

about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number).

In some cases, Facebook users may

communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications.
113.

As explained herein, information stored in connection with a Facebook account

may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,

-29-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 39 of 47

and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accuunls along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation.

Such .information allows

investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
114.

Therefore, the computers of Facebook are likely to contain all the material

described above, including stored electronic communications and information concerning
subscribers and their use of Facebook, such as account access information, transaction information,
and other account information.

FILTER REVIEW PROCEDURES

-30-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 40 of 47

115.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
kaa1," separate aml apart from the investigative team, in order to address potential privileges.
CONCLUSION

116.

Based on the forgoing, I request that the Court issue the proposed search warrant.

117.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING

118.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

-31-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 41 of 47

Respectfully submitted,

~

Andrew Mitchell
Special Agent
Federal Bureau of Investigation

8uhscrihecl flnd sworn to before me on this

·?!of August, 2018.
_Ld-ay

The Honorable eryl A. Howell
Chief United States District Judge

-32-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 42 of 47

ATTACHME NT A
Property to be Searched

This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc.
("Facebook"), a company headquartered at 1 Hacker Way, Menlo Park, California 94025:

-1-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 43 of 47

ATTACHMENT B

I.

Information to be disclosed by Facebook

To the extent that the information described in Attachment A is within the possession,
custody, or control of Facebook Inc. ("Facebook"), including any messages, records, files, logs, or
information that have been deleted but are slill available lo Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(:t), Facebook is required to disclose the
following information to the government for each user ID listed in Attachment A:
(a)

All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

(b)

All activity logs for the account and all other documents showing the user's posts
and other Facebook activities;

(c)

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;

(d)

All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use of Facebook applications;

-2-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 44 of 47

(e)

All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;

(f)

All records relating to machine cookies;

(g)

All "check ins" and other location information, including records of the user's
lalitude and longitude;

(h)

All IP logs, including all records of the IP addresses that logged into the account;

(i)

All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";

G)

All information about the Facebook pages that the account is or was a "fan" of;

(k)

All past and present lists of friends created by the account;

(1)

All records of Facebook searches performed by the account;

(m)

All information about the user's access and use of Facebook Marketplace;

(n)

The types of service utilized by the user;

(o)

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

(p)

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

(q)

All past and present Admins for the group;

(r)

The "Creator" of the group;

-3-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 45 of 47

(s)

All pnvacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

(t)

All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
services and records of actions taken;

(u)

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and queried.

II.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 46 of 47

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone,

Jerome

Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

f.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

g.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

h.

The source of all funds used to purchase advertisements or make other expenditures
or disbursements in these accounts;

i.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

-5-

 Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 47 of 47

J.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

k.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

-6-

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 1 of 189
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THREE
ACCOUNTS STORED AT PREMISES CONTROLLED
BY MICROSOFT, GOOGLE, AND APPLE

)
)
)
)
)
)

Case: 1: 18-sc-02581
Assigned To: Howell, Beryl A.
Assign. Date : 8/3/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment E

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment F

YOU ARE COMMANDED to execute this warrant on or before
August 15, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
l'J at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

l'J Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
['J for _ _ days (not to exceed 30)
['J until, the facts justifying, the later specific date of

Date and time issued:

<7/;1/~/ r ~ z :s:r/A_ ____~~
.--~
- "_A_~- - ' . ! u d ge 's signature

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 2 of 189
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 3 of 189

ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:

created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.

53

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 4 of 189

ATACHMENTF
Particular Things to be Seized

I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are stilJ available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
a.
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEi");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 5 of 189

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and

j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

55

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 6 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
56

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 7 of 189
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT

AUG -· 3 2018

for the
District of Columbia
In the Matter of the Search of
(Brie.fly describe 1/,e property lu be searched
or identify lh.e person by nam ond addres~)

)
)
)

INFORMATION ASSOCIATED WITH THREE ACCOUNTS
STORED AT PREMISES CONTROLLED BY MICROSOFT,
GOOGLE, AND APPLE
)

j

Clerk, U.S. D1strict & BankruptcJr
Courts for t~e District of Golumliia

Case: 1:18-sc-02581
Assigned To : Howell, Beryl A.
Assign. Date: 8/3/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of pe1jllly that I have reason to believe that on the following person or property (identifjl the person or describe the
properly to be searched and give its location):

See Attachment E

located in the

Northern

--------

District of

California

- - - - - - - - -- - -

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment F

The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more):
~ evidence of a crime;

~ contraband, fruits of crime, or other i~ems illegally possessed;

ref property designed for use, intended for use, or used in committing a crime;
0 a person to be an-ested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
18 U.S.C. §§ 1505, 1512, 1513
18 u.s.c. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Obstruction of justice, Witness tampering
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

r/ Continued on the attached sheet.
0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the arta ed sheet.

Reviewed by AUSA/SAUSA:
!Aaron Zelinsky {ASC)

Applicant's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 8 of 189

AUG - 3 2018
Cferk, U.S. Dlstrlci & Bankruptcy
Courts for the District of Columbia
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY
MICROSOFT, GOOGLE, AND APPLE

Case: 1:18-sc-02581
Assigned Tu : Howell, Beryl A.
Assign. Date : 8/3/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following:
a. The email account

(hereafter "Target Account 1), that is

stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
and in Attachments A and B.
b. The email account

(hereafter "Target Account 2"), that is

stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments C and D.
c. The iCloud account

associated with the Apple ~mail account

(hereafter "Target Account 3"), that is stored at premises owned,

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 9 of 189

maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupe1iino, California 95014. The information to be disclosed by Apple and searched by
the government is described in the following paragraphs and in Attachment E and F.
2.

I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation

(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses").
5.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for Roger STONE's Hotmail address,

(Target

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
Gmail address,

(Target Account 2). On or about March 14, 2018, Chief

Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This

2

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 10 of 189

warrant seeks to search those accounts from the date each respective warrant was issued to the
present.

JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraphs 14, 19, and 61.

SUMMARY
7.

This application seeks authority to search, from the date of search warrants

previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's
STONE's

account; Target Account 2, which is

account; and Target Account 3, which is STONE's iCloud account. As set

forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
witnesses, and make false statements.
8.

For example, as set forth in more detail below, in recent months STONE has

reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
campaign or were scheduled to meet with the Special Counsel's Office
. After STONE learned that one witness, Randy
CREDICO, was prepared to contradict STONE's congressional testimony, STONE repeatedly
3

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 11 of 189

urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness,

who had

done information technology work for STONE during the campaign

9.

In September 2017, STONE released a statement he said he provided to Congress

in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a.

On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get

to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
CORSI to have

contact ASSANGE. On or about August 2, 2016, CORSI

responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me,
it will soon the Podesta's time in the barrel. #CrookedHillary."
b.

Information disclosures subsequently occurred on or about the times

CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 12 of 189

Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape of thencandidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
c.

Furthermore, on the day of the Access Hollywood video disclosure, there

were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.

5

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 13 of 189

PROBABLE CAUSE.
A. Background on Relevant Individuals
i.

10.

Roger STONE

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome CORSI
11.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

6

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 14 of 189

B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking
Activity during the 2016 Presidential Election
13.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following:
a.

The U.S. Intelligence Community ("USIC") is confident that the Russian

Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were

7

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 15 of 189

intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to .
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
14.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
a.

"Russian President Vladimir Putin ordered an influence campaign in 2016

aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
b. ·

The USIC also described, at a high level, some of the techniques that the

Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-such as cyber activitywith overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
c.

With respect to "cyber activity," the USIC assessed that "Russia's

intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further,
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 16 of 189

activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
and is Russia's largest foreign intelligence agency.
d.

With respect to the release of stolen materials, the USIC assessed "with

high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
e.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made

multiple contradictory statements and false claims about his identity throughout the election.
C. Additional Hacking Activity by Individuals Associated with the GRU

15.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
17.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later posted on DCLeaks.
9

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 17 of 189

18.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
19.

On or about July 13, 2018, a grand jury in this District indicted eleven GRU

officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United

States v. Viktor Borisovich Netyksho, et al. (I: 18-cr-215) (D.D.C.). 1
D. Roger STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
20.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.

1

A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.

10

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 18 of 189

22.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
23.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24.

On August 12, 2016, Gucci fer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
25.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 19 of 189

Twitter account was reinstated.
26.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27.

On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign.
28.

As noted above, on August 21, 2016, using@RogerJStoneJR, STONE tweeted:

"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a "'mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well,
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
like the Watergate tapes."
29.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a wee~ly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
30.

On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
31.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
12

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 20 of 189

of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement- which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
32.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
33.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
35.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 21 of 189

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
36.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr. Information recovered from the search of that account
includes the following:
a.

On October 13, 2016, while WikiLeaks was in the midst of releasing the

hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. Thi~ account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
b.

Less than an hour later, @wikileaks responded by direct message: "We

appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
c.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"c01Tect\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
14

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 22 of 189

d.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
e.

In addition, @RogerJStoneJr also exchanged direct messages with

ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
f.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

15

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 23 of 189

F. STONE's Communications with STONE,
Forthcoming Leaks

37.

and Others Regarding

As indicated above, on September 11, 2017, Chief Judge Howell issued a search

warrant for STONE's

(Target Account 1); on

address,

October 17, 2017, Chief Judge Howell issued a search warrant for STONE's

address,

(Target Account 2); and on or about March 14, 2018, Chief Judge

Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
email account. Information recovered pursuant to those search warrants includes the following:
a.

On or about May 15, 2016,

emailed CORSI: "Here is my

flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
that, "May meet Manafort -guarantee nothing."
b.

On or about May 18, 2016, CORSI emailed STONE at Target Account 1

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
c.

On July 25, 2016, STONE, using Target Account 1, sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange

16

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 24 of 189

[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
d.

On or about July 31, 2016, STONE, using Target Account 1, emailed

CORSI with the subject line, "Call me MON." The body of the email read:

,should see

should find Bernie [SJ anders brother who called Bill a Rapist - turn him for

Assange[.]
Trump[.]

should find
e.

or more proof of Bill getting kicked out."

As noted above, on or about August 2, 2016 (approximately 19 days

before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shottly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.

f.

On or about August 5, 2016,

, an associate of STONE's,

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the
17

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 25 of 189

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SAN GE. STONE tol

he was joking and

had not actually met ASSANGE. 2
g.

On or about August 15, 2016, CORSI emailed STONE at Target Account

1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not

over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
h.

On or about August 31, 2016, CORSI emailed STONE at Target Account

1: "Did you get the PODESTA writeup." STONE replied "[y]es."
1.

On or about August 31, 2016, CORSI messaged STONE at Target

Account 3, "Podesta paid $I 80k to invest in Uranium One - was hired by Rosatom in Giustra

scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."
J.

On or about September 6, 2016, CORSI emailed STONE at Target

Account 1: "Roger[,] Is NY Post going to ~se the Pedesta [sic] stuff?"

k.

On or about September 24, 2016,

emailed CORSI, "I will

have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,

18

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 26 of 189

"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you

are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
posted about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

I.

On or about October 3, 2016, an associate of STONE emailed STONE at

Target Account 2 and asked: "Assange - what's he got? Hope it's good." STONE wrote back,
"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
m.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
n.

On or about October 4, 2016, CORSI messaged STONE at Target

Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total
BS hype."
19

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 27 of 189

o.

That same day, BANNON emailed STONE at Target Account 2, "What

was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer

is a

big democrat."
p.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released

38.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Pos.t reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood' and NBC for reaction."
39.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE which STONE did not answer.

3

https://www.washingtonpost.com/lifestyle/style/the-cal\er-had-a-lewd-tape-of-donald-trump-then-the-race-wason/2016/10/07/31 d74714-8ce5-l le6-875e-2c 1bfe943b66_story.html

20

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 28 of 189

40.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
41.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
42.

At approximately 2: 18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
43.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
44.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
of next dump focus, setting stage for Foundation debacle."
45.

an author who has written about the

At approximately 6:27PM,

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the .
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded

message to CORSI without comment. STONE does not appear

to have forwarded the email to any other individual.
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

46.

On or about October 8, 2016, STONE, using Target Account 3, messaged

CORSI, "Lunch postponed-have to go see T." CORSI responded to STONE, "Ok. I
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 29 of 189

a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
speech comments, attacking badjob numbers."
47.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
122016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
the Clintons through the Clinton Foundation."
49.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50.

On or about Thursday, October 13, 2016, CORSI emailed STONE at Target

Account 2: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 30 of 189

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation(.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
51.

On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent

STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how mucl:i money did

, a controversial Russian billionaire investor with

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by

, with the money transferred via Deutsche

Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52.

On or about October 14, 2016, CORSI sent a message to STONE at Target

Account 3, "I'm in.NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 31 of 189

53.

On or about October 17, 2016, CORSI messaged STONE at Target Account 3,

"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54.

On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1

and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted

source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55.

On or about October 18, 2016, CORSI messaged STONE at Target Account 3,

"Pis call. Important."
56.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
57.

On or about November 8, 2016, the United States presidential election took place.

24

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 32 of 189

58.

On or about November 9, 2016, CORSI messaged STONE at Target Account 3,

"Congratulations, Roger. He could not have done it without you."
59.

On or about November 10, 2016, CORSI messaged STONE at Target Account 3,

"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
Have some interesting news for you."

25

 Case Document 29-13 Filed 04/28/20 Page 33 of 189

 

Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 34 of 189

J. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks

61.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 35 of 189

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this repot1, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
info11nation proved to be correct. I have referred publicly to this journalist as an,
"intermediary" , "go-between" and "mutual friend." All of these monikers are equally
true.
62.

Tn a document dated March 26, 2018 titled "Minority Views," Democratic

members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: ThatQ: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
63.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."

K. STONE's Use of Target Account 3 to Message Randy CREDICO about STONE's
"Back channel"

28

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 36 of 189

64.

On November 19,2017, Randy CREDICO (who, as described further below,

STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE on Target
Account 3, "My lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the

fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
65.

On or about November 21, 2017, CREDICO messaged STONE on Target

Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a

subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?"
66.

On or about November 24, 2017, STONE, using Target Account 3, texted

CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "I told
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuffT,] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"

29

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 37 of 189

67.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
no back Channel. So now you can relax."
68.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
70.

On or about December 1, 2017, CREDICO messaged STONE on Target

Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for perjury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.

30

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 38 of 189

you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a ce1iain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify[.]"
71.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
72.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
show[.] That was my initial contact."
31

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 39 of 189

74.

On or about January 8, 2018, CREDTCO messaged STONE on Target Account 3

stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
conversations with Assange until September of last year."
75.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee ... But you'll get off because you're friends with Trump so don't wo1Ty. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
of 2016 to prove it[.]"
76.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
77.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog135911370.html

6

https ://www.motherjones.com/ po Iitics/2018/0 5/ro ger-stone-to-associate-prepare-to-die/

32

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 40 of 189

He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.

L. STONE's Use of the Target Accounts to Communicate with Individuals Related to
the Investigation
78.

On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap

devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use

Target Account 1 and Target Account 2, and that he has used them to communicate with
individuals related to the investigation.
79.

For example, STONE and

communicated twice on May 28 and May

29, 2018 using Target Account 1.

, a former associate of STONE's, was

interviewed by the Special Counsel's Office on or aboi1t May 2, 2018. Toll records _show that
and STONE communicated multiple times on May 5, 2018, and STONE
communicated with

using Target Account 1 on June 1, 2018 and June 6, 2018.

, a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
July 12, 2018.
STONE has also used Target Account 2 to communicate with individuals

80.

associated with this investigation.
a.

For example, between May 23, 2018 and the present, STONE and CORSI

exchanged at least five messages using Target Account 2. In the same time period, STONE
exchanged at least 75 emails with CREDICO using Target Account 2.

33

•

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 41 of 189

b.

Also in this same time period, STONE emailed

ten times using Target Account 2.
2018, FBI agents approached

at least

is a former employee of STONE. On May 9,
and

That day,

and again on May 10, 2018,

communicated by phone with

STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
, using Target Account 2. In addition, between on or about June 14, 2018 and

wit

and STONE exchanged five emails using Target Account 2.

June 17, 2018,

81.

STONE has also used a phone number associated with Target Account 3 to

communicate with

a private investigator hired by STONE.

was

interviewed by investigators on June 7, 2018, and subsequently info1med investigators that in
June 2018, STONE instructed him to conduct a full background investigation on
who had been employed by STONE during the Campaign as an info1mation technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary form of communication with STONE is by text
message on Target Account 3.

BACKGROUND CONCERNING EMAIL
82.

In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail ("email") to the public. The Providers allow

34

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 42 of 189

subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
83.

In my training and experience, email Providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
84.

In my training and experience, email Providers typically retain certain

transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account

35

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 43 of 189

(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address infonnation can help to identify which computers or other devices were used to access
the email account.
85.

In my training and experience, in some cases, email account users will

communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
86.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 44 of 189

infonnation maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them from law enforcement).
87.

In my training and experience, information such as search history can help to

show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

INFORMATION REGARDING APPLE ID AND iCLOUD 7

The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htip://images.apple.com/ privacy/docs/.l cgal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCioud," available at htlj ://www.apple.com/ icloud/; "What
does iCloud back up?," available at https://suppo1i .app le.corn/kb/PHJ 25 19; "iOS Security," available at

37

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 45 of 189

88.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
89.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a.

Apple provides email service to its users through email addresses at the

domain names mac.com, me.corn, and icloud.com.
b.

iMessage and FaceTirne allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
c.

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
d.

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user

https://www.appl e.com/business/docs/iOS Security Guide.pdt: and "iCloud: How Can I Use iCloud?," available at
https://suppo1t.apple.com/kb/PH26502.

38

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 46 of 189

to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
e.

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
f.

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
g.

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
h.

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and .on desktop and laptop computers running
either Microsoft Windows or Mac OS.

39

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 47 of 189

90.

Apple services are accessed through the use of an "Apple ID," an account created

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91.

An Apple ID takes the form of the full email address submitted by the user to

create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in @icloud.com, @me.com, or@mac.com) or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
92.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.

40

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 48 of 189

93.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iC!oud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.

41

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 49 of 189

95.

Apple provides users with five gigabytes of free electronic space on iCloud, and

users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
96.

In my training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
susp1c10n.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

42

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 50 of 189

97.

l anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.

CONCLUSION
98.

Based on the forgoing, I request that the Court issue the proposed search warrant.

99.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
100.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

k~___/

Andrew Mitchel l
Special Agent
Federal Bureau of Investigation
43

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 51 of 189

Subscribed and sworn to before me on this

.P'{ y

of August, 2018.

/
)/
~_./
- ~-~ /;Arr-Cz,1/

The Honorable Beryl A. Howell

Chief United States District Judge

44

,

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 52 of 189

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the email address:

created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered
at One Microsoft Way, Redmond, WA 98052.

45

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 53 of 189

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following infor1!1ation to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. AJI internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

46

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 54 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C . § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 55 of 189

1.

All existing printouts from original storage which concern the categories identified in
subsection II.a

48

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 56 of 189

ATTACHMENT C
Property to be Searched

This warrant applies to information associated with the following Google account:

created or maintained between October 17, 2017 and the present, that is stored at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
1600 Amphitheatre Parkway, Mountain View, CA 94043.

49

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 57 of 189

ATTACHMENT D
Particular Things to be Seized

I.

Files and Accounts to be produced by Google, Inc.

To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S .C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;

g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section I.A.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;
50

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 58 of 189

1.

Google Drive files created, accessed or owned by the account;

j.
YouTube subscriber information, private videos and files, private
messages, and comments;
k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l.
account.

Google Talk and Google Hangouts conversation logs associated with the

51

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 59 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
52

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 60 of 189

ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following Apple DSID:

created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.

53

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 61 of 189

ATACHMENTF
Particular Things to be Seized

I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, tiles, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(£), Apple is required to disclose the following infonnation to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
a.
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 62 of 189

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;

f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and
j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

55

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 63 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction.of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
56

 Case Document 29-13 Filed 04/28/20 Page 64 of 189
A0 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT

for the

District of Columbia

In the Matter of the Search of


(Brie?y describe the property to be searched Case: 1 218?80?02582
or identi?i the person by name and address) Assigned TO I BBFYI A.



INFORMATION ASSOCIATED WITH THREE Assign- Date 3 8/3/2018 
ACCOUNTS STORED AT PREMISES CONTROLLED Description: Search SeIzure Warrant

BY MICROSOFT. GOOGLE, AND APPLE 
SEARCH AND SEIZURE WARRANT
To: Any authorized law enforcement of?cer

An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the Western District of Washington
(identify the person or describe the property to be searched and give its location):

 

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identi?l the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before 15. 2018 (not to exceed 14 days)
in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief US. District Judge
(United States Magistrate Judge)

Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)

for days (not to exceed 30) El until, the facts justifying, the later speci?c date of

Date and time issued: 3/57/27 3? (1374 3:32 A xi?jg/? 

Jtidge 's signature

 

 

Washington, DC Hon. Beryl A. Howell, Chief US. District Judge

Printed name and title

 

City and state:

 

 

 

Case Document 29-13 Filed 04/28/20 Page 65 of 189

A0 93 (Rev. 1 1/ 13) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing of?cer '3 signature

 

 

Printed name and title

 

 

Case Document 29-13 Filed 04/28/20 Page 66 of 189

ATTACHMENT A

Property to be Searched

This warrant applies to information associated with the email address:

 

created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered

at One Microsoft Way, Redmond, WA 98052.

45

Case Document 29-13 Filed 04/28/20 Page 67 of 189

ATTACHMENT 
Particular Things to be Seized

1. Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, ?les, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. 2703(f), the Provider is required
to disclose the following information to the government for each account or identi?er listed in
Attachment A:

a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e?mail;

b. All existing printouts from original storage of all of the electronic mail described above
in Section LA. above;

c. All intemet search data including all queries and location data;

d. All transactional information of all activity of the account described above in Section LA,
including log ?les, dates, times, methods of connecting, ports, dial ups, and/or locations;

e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and ?les;

f. Records or other information regarding the identi?cation of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identi?ers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e?mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section 

46

Case Document 29-13 Filed 04/28/20 Page 68 of 189

11. Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized
access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.
1513 (witness tampering); 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contribution ban) from June 1,
2015 to present, including:

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

b. All records, information, documents or tangible materials that relate in any way to

ni ations or meetin involvin Jerome Corsi, _Julian Assange,
andy Credico, or any individual

associated with the Trump Campaign;

 

c. All images, messages, communications, calendar entries, search terms, ?address book?
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;

d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identi?er concerning the messages identi?ed above,
including records about their identities and whereabouts;

6. Evidence of the times the account was used;

f. All images, messages and communications regarding wiping software, or
other methods to avoid detection by law enforcement;

g. Passwords and keys, and other access information that may be necessary to
access the account and other associated accounts;

h. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

Case Document 29-13 Filed 04/28/20 Page 69 of 189

i. All existing printouts from original storage which concern the categories identi?ed in
subsection 

48

Case Document 29-13 Filed 04/28/20 Page 70 of 189

A0 106 (Rev. 04110) Application for a Search Warrant

 

 

. . 2
UNITED STATES DISTRICT COURT AUG 3 .
for the Glen 2018
District of Columbia Court; Io'iJIIii-F'inisliricsi 32%?
2
In the Matter of the Search of 
(Esclriin' tn Case: 1 
or it enti I 1U person Harrie cm; m. E. rat-Is) - 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS i T0 - Beryl A-
STORED AT PREMISES CONTROLLED BY MICROSOFT, Date 8/3/2018
GOOGLE. AND APPLE Description: Search Seizure Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the

property to be searched and give its location):

 

 

See Attachment A

located in the Western District of .. Washington there is now concealed (identify the
person or describe the property to be seized):

See Attachment 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
devidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;
lifproperty designed for use, intended for use, or used in committing a crime;
a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section O?ense Description
18 U.S.C. 1505, 1512, 1513 Obstruction of justice, Witness tampering
18 U.S.C. 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy

See Af?davit for add'l

The application is based on these facts:
See attached Af?davit.

Continued on the attached sheet.
Delayed notice of days (give exact ending date if more than 30 days: is requested
under 18 U.S.C. 3103a, the basis of which is set forth on the attaclgd sheet.

ppii'cant ?s signature

 

 
 
 

Reviewed by 
Aaron Zelinsky(ASC) Andrew Mitchell,_Special Agent, FBI

 

 

 

 

 

Printed name and title

Sworn to before me and signed in my presenceDate: 42 r/ 137/1 
Judge '3 signature
City and state: Washington, DC. Hon. Beryl A. Howell, Chief US. District Judge

 

Printed name and title

Case Document 29-13 Filed 04/28/20 Page 71 of 189

AUG 201?3-

Clerk, US. District a. Bankruptcy

Co I 1 .
IN THE UNITED STATES DISTRICT COURT or mm? 0? Columbia

FOR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED AT

Case: 1:18?sc?02582
Assigned To Howell, Beryl A.

 

PREMISES CONTROLLED BY Assign Dale 8/ 3/201 8 
MICROSOFT, GOOGLE, AND APPLE Description: Search Seizure Warrant
AFFIDAVIT IN SUPPORT OF

AN APPLICATION FOR A SEARCH WARRANT

1, Andrew Mitchell, being ?rst duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1. I make this af?davit in support of an application for a search warrant for

information associated with the following:

a. The email account?(hereafter ?Target Account 1), that is

stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
of?ces located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs

and in Attachments A and B.

b. The email account _(hereafter ?Target Account that is

stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
of?ces located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
information to be disclosed by Google and searched by the government is described in the

following paragraphs and in Attachments and D.

c. The iCloud accoun_ssociated with the Apple email account
_hereafter ?Target Account that is stored at premises owned,

Case Document 29-13 Filed 04/28/20 Page 72 of 189

maintained, controlled, or operated by Apple, Inc., a business with of?ces located at 1 In?nite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
the government is described in the following paragraphs and in Attachment and F.

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation
(FBI), and have been since 2011. As a Special Agent of the FBI, 1 have received training and
experience in investigating criminal and national security matters.

3. The facts in this af?davit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This af?davit is intended
to show merely that there is suf?cient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this af?davit,
there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4
(misprision ofa felony), 18 U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18
U.S.C. .1030 (unauthorized access of a protected computer); 18 U.S.C. 1505 and 1512
(obstruction of justice), 18 U.S.C. 1513 (witness tampering); 18 U.S.C. 1343 (wire fraud), 18
U.S.C. 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign
contribution ban) (the ?Subject Offenses?).

5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for Roger -address,_Target

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for 

- Account 2). On or about March 14, 2018, Chief

Judge Howell issued a search warrant for iCloud account (Target Account 3). This

2

Case Document 29-13 Filed 04/28/20 Page 73 of 189

warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION

6. This Court has jurisdiction to issue the requested warrant because it is ?a court of
competentjurisdiction? as de?ned by 18 U.S.C. 271 1. Id. 2703(3), 
Speci?cally, the Court is ?a district court of the United States (including a magistrate judge of
such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C.
2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraphs 14, 19, and 61.

SUMMARY

7. This application seeks authority to search, from the date of search warrants
previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is -account; Target Account 2, which is
.account; and Target Account 3, which is iCloud account. As set
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
witnesses, and make false statements.

8. For example, as set forth in more detail below, in recent months STONE has
reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
campaign or were scheduled to meet with the Special Counsel?s Of?ce and/or appear before the
Grand Jury investigating such interactions. After STONE learned that one witness, Randy

CREDICO, was prepared to contradict congressional testimony, STONE repeatedly
3

Case Document 29-13 Filed 04/28/20 Page 74 of 189

urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so

through multiple text messages. In June 2018, STONE instructed his private investigator to

provide him with a full background investigation on another witness,-who had

done information technology work for STONE during the campaign

 

9. In September 2017, STONE released a statement he said he provided to Congress
in which he denied having advance knowledge of ?the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton.? He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, ?it will soon the Podesta?s time in the barrel,? he was not
referring to the hacking or publication of John Podesta?s emails, but rather. to ?Podesta?s business
dealings with Russia.? Evidence obtained in the investigation, however, shows the following:

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to ?Get
to Assange? at the Ecuadorian Embassy and ?get pending WikiLeaks Julian
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed
CORSI to have contact AS SANGE. On or about August 2, 2016, CORSI
responded to STONE that the ?[w]ord is friend in embassy plans 2 more dumps. One shortly
after I?m back. 2nd in Oct. Impact planned to be very damaging. . .. Time to let more than
Podesta to be exposed as in bed enemy if they are not ready to drop After receipt of
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: ?Trust me,
it will soon the Podesta?s time in the barrel. #CrookedHillary.?

b. Information disclosures subsequently occurred on or about the times
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the

United States (?shortly after I?m back?), Guccifer 2.0 released hacked information related to the

4

Case Document 29-13 Filed 04/28/20 Page 75 of 189

Democratic Congressional Campaign Committee On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape of then?
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.

c. Furthermore, on the clay of the Access Hollywood video disclosure, there
were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately the Washington Post

published its story regarding the Access Hollywood tape. By approximately WikiLeaks

tweeted out its ?rst release of emails hacked from John Podesta.

 

Case Document 29-13 Filed 04/28/20 Page 76 of 189

 

PROBABLE CAUSE.

A. Background on Relevant individuals
Roger STONE
10. Roger STONE is a self-employed political strategist/consultant and has been
actively involved in US. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
11. Jerome CORSI is a political commentator who, according to publicly available
information, currently serves as the ?Washington Bureau Chief for Inforwars.com.? According
to publicly?available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

Case Document 29-13 Filed 04/28/20 Page 77 of 189

 

B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking
Activity during the 2016 Presidential Election

13. On October 7, 2016, the U.S. Department of Homeland Security and the Of?ce of
the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following:

a. The U.S. Intelligence Community is con?dent that the Russian
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent

with the methods and motivations of Russian-directed efforts. These thefts and disclosures were

Case Document 29-13 Filed 04/28/20 Page 78 of 189

intended to interfere with the US. election process. Such activity is not new to Moscow??the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
in?uence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia?s senior?most of?cials could have authorized these activities.

14. On January 6, 2017, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following:

a. ?Russian President Vladimir Putin ordered an influence campaign in 2016
aimed at the US presidential election. Russia?s goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President?elect Trump.?

b. The USIC also described, at a high level, some of the techniques that the
Russian government employed during its interference. The USIC summarized the efforts as a
?Russian messaging strategy that blends covert intelligence operations?such as cyber activity?
with overt efforts by Russian Government agencies, state?funded media, third-party
intermediaries, and paid social media users or ?trolls.??

0. With respect to ?cyber activity,? the USIC assessed that ?Russia?s
intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties.? Further,
July 2015, Russian intelligence gained access to Democratic National Committee (DNC)

networks and maintained that access until at least June 2016.? The USIC attributed these cyber

8

Case Document 29-13 Filed 04/28/20 Page 79 of 189

activities to the Russian GRU, also known as the Main Intelligence Directorate: 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
of?cials and political ?gures. By May, the GRU had ex?ltrated large volumes of data from the
The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
and is Russia?s largest foreign intelligence agency.

d. With respect to the release of stolen materials, the USIC assessed ?with
high con?dence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made
multiple contradictory statements and false claims about his identity throughout the election.

C. Additional Hacking Activity by Individuals Associated with the GRU

15. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.

16. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the cloud-based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts.

17. On or about. September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These

emails were later posted on DCLeaks.

Case Document 29-13 Filed 04/28/20 Page 80 of 189

18. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

19. On or about July 13, 2018, a grandjury in this District indicted eleven GRU
of?cers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee and the chairman of the Clinton campaign (John Podesta). See United
States v. Viktor Borisovich et (1 :18?cr-215) 

D. Roger Public Interactions with Guccifer 2.0 and WikiLeaks

20. On June 14, 2016, the forensic ?rm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported On the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of ?les and mails, I gave to Wikileaks. They will publish them soon.?
In that post, Guccifer 2.0 also began releasing hacked DNC documents.

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.

 

A twelfth defendant was charged with conspiring to in?ltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.

10

Case Document 29-13 Filed 04/28/20 Page 81 of 189

22. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear
Hillary: DNC Hack Solved, 80 Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he explains who he is and
why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game.?

23. On August 8, 2016, STONE addressed the Southwest Broward Republican
Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming ?October Surprise? aimed at the Hillary
Clinton presidential campaign. Speci?cally, STONE was asked: ?With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he?s
going to do?? STONE responded: ?Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there?s no telling what the October surprise may be.? A few days later, STONE
clari?ed that While he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
11 believe in the real #GucciferZ.? That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0?s
1 1

Case Document 29?13 Filed 04/28/20 Page 82 of 189

Twitter account was reinstated.

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJ StoneJ paying you
back.? Guccifer also sent a private message to @RogerJ StoneJ stating ?i?m pleased to say 
great man. please tell me ifI can help anyhow. it would be a great pleasure to me.?

27. On August 18, 2016, Paul Manafort, longtime friend and associate,
resigned as Chairman of the Trump Campaign.

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted:
?Trust me, it will soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a C-SPAN
interview that same day, STONE reiterated that because of the work of a ??mutual acquaintance?
of both his and the public [could] expect to see much more from the exiled
whistleblower in the form of strategically-dumped Clinton email batches.? He added: ?Well,
?rst of all, I think Julian Assange is a 1 think he?s taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
like the Watergate tapes.?

29. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.?

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.?

31. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony

12

Case Document 29-13 Filed 04/28/20 Page 83 of 189

of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement which was
part of WikiLeaks? 10?year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJ StoneJ 

to tweet: ?Payload coming. #Lockthemup.?

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
The Podesta Emails #HillaryClinton #Podesta #imWithHer? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

34. WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21,
2016 C-SPAN and Twitter references argued publicly that ?[it is] a reasonable assumption to -
or at least a reasonable conclusion - that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any
influence with him or that 1 have advanced knowledge of the speci?cs of what he is going to do.
1 do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13

Case Document 29-13 Filed 04/28/20 Page 84 of 189

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta?s email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true.?

E. Private Twitter Direct Messages with WikiLeaks and ASSAN GE

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJ Stone] r. Information recovered from the search of that account
includes the following:

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the of?cial Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: ?Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me? cordially 

. b. Less than an hour later, @wikileaks responded by direct message: ?We
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don?t go there if you don?t want us to correct you.?

c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct me the more people think you?re lying. Your

operation leaks like a sieve. You need to ?gure out who your friends are.?

14

Case Document 29-13 Filed 04/28/20 Page 85 of 189

d. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJ containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to communicate.?

e. In addition, @RogerJStoneJr also exchanged direct messages with
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
?Still nonsense. As ajournalist it doesn?t matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don?t know of any crime you need to be pardoned for - best regards. That
same day, @JulianAssange responded: ?Between CIA and they?re doing quite a lot. 011 the
side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal.?

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

15

Case Document 29-13 Filed 04/28/20 Page 86 of 189

F. Communications with STONE, - and Others Regarding

Forthcoming Leaks

37. As indicated above, on September 1 1, 2017, Chief Judge Howell issued a search

warrant for Account on

October 17, 2017, Chief Judge Howell issued a search warrant for STONE?s-address,

?(Target Account and on or about March 14, 2018, Chief Judge

Howell issued a search warrant for iCloud account (Target Account 3). In addition,

 

on or about December 19, 2017, Chief Judge Howell issued a search warrant for 
email account. Information recovered pursuant to those search warrants includes the following:
a. On or about May 15, 2016, -mailed CORSI: ?Here is my
?ight schedule. Need to get something con?rmed now . . . CORSI copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI

that, ?May meet Manafort -guarantee nothing.?

b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1

with the title, ?Roger why don?t you look this over before I send it-I believe that

CORSI wrote,

 
  

nd I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?

0. On July 25, 2016, STONE, using Target Account 1, sent an email to

CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange

16

Case Document 29-13 Filed 04/28/20 Page 87 of 189

[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
Foundation, allegedly.?

d. On or about July 31, 2016, STONE, using Target Account I, emailed
CORSI with the subject line, ?Call me The body of the email read: -should see
Assange[.] -should find Bernie [S]anders brother who called Bill a Rapist turn him for
should ?nd? or more proof of Bill getting kicked out.?

e. As noted above, on or about August 2, 2016 (approximately 19 days
before STONE publicly tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE
at Target Account 1: ?Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued: ?Signs are Fox
will have me on mid?Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle.? Investigators believe that reference to a ?friend in embassy

[who] plans 2 more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in

f. On or about August 5, 2016,_ an associate of 

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton

2016.

led Trump by 15 points. STONE responded, ?enjoy it while can[.] I dined with my new pal

Julian Assange last night.? -ubsequently stated to investigators that, around the

17

Case Document 29-13 Filed 04/28/20 Page 88 of 189

same time, STONE told him he had gone to London to meet ASSANGE. -150 stated
that in 2018,- told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told-e was joking and

had not actually met ASSANGE.2

g. On or about August 15, 2016, CORSI emailed STONE at Target Account
1: ?Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it?s not
over yet. More to come than anyone realizes. Won?t really get started until after Labor Day. I?m

in NYC this week. Jerry.?

h. On or about August 31, 2016, CORSI emailed STONE at Target Account
1: ?Did you get the PODESTA writeup.? STONE replied 

i. On or about August 31, 2016, CORSI messaged STONE at Target
Account 3, ?Podesta paid $180k to invest in Uranium One was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation tied to Ukraine Yanukovych Panama papers
reveals Podesta hired by S[b]erbank, Russia?s largest ?nancial institution Podesta ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin.?

j. On or about September 6, 2016, CORSI emailed STONE at Target
Account 1: ?Roger[,] Is NY Post going to use the Pedesta [sic] stuff??

k. On or about September 24, 2016,-mailed CORSI, will

have much more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded,

 

 

Case Document 29-13 Filed 04/28/20 Page 89 of 189

?We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to

him about it again back, ?Awaiting secret file. Hope you

are well. Can?t wait for the debate. Channeling Reagan, I hope!? CORSI responded, ?Keep me
posted about In a subsequent meeting with investigators-indicated this
conversation concerned possible derogator?y information he was trying to obtain from Turkey.

1. On or about October 3, 2016, an associate of STONE emailed STONE at
Target Account 2 and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote back,
?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled.? The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See below. You
didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry about.? The
associate responded, ?Well clearly he knows what Assange has. I?d say that?s important.?

m. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then?candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the US. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the US election-related documents would all come out before Election Day.

n. On or about October 4, 2016, CORSI messaged STONE at Target

Account 3, ?Assange made a fool of himself. Has nothing or he would have released it. Total

BS hype.?
19

Case Document 29-13 Filed 04/28/20 Page 90 of 189

0. That same day, BANNON emailed STONE at Target Account 2, ?What
was that this STONE replied, ?Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done BANNON wrote back, ?He
didn?t cut deal w/ STONE replied, ?Don?t think so BUT his lawyer- is a
big democrat.?

p. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released

38. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David ahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood? and NBC for reaction.?

39. According to phone records at approximately

11:27 AM, CORSI placed a call to STONE which STONE did not answer.

 

3 
on/2016/ 10/0 7/3 1d74714-80e5-1 

20

Case Document 29-13 Filed 04/28/20 Page 91 of 189

40. At approximately 1 STONE received a phone call from the Washington
Post. The call lasted approximately twenty minutes.

41. At approximately 1 STONE called CORSI and the two spoke for
approximately seventeen minutes.

42. At approximately CORSI called STONE and the two spoke for
approximately twenty minutes.

43. At approximately the Washington Post published a story regarding the
Access Hollywood tape.

44. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, expect that much
of next dump focus, setting stage for Foundation debacle.?

45. At approximately an author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded message to CORSI without comment. STONE does not appear

to have forwarded the email to any other individual.

H. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

46. On or about October 8, 2016, STONE, using Target Account 3, messaged
CORSI, ?Lunch postponed have to go see CORSI responded to STONE, ?Ok. I

understand.? Approximately twenty minutes later, CORSI texted, ?Clintons know they will lose

21

Case Document 29-13 Filed 04/28/20 Page 92 of 189

a week of Paula Jones media with attacking Foundation, using Wikileaks Goldman Sachs
speech comments, attacking bad job numbers.?

47. On or about Wednesday, October 12, 2016, at approximately STONE,
using Target Account 2, emailed Corsi asking him to ?send me yOur best podesta links.?
STONE emailed CORSI at approximately ?need your BEST podesta pieces.? CORSI
wrote back at approximately ?Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it?s easy to understand will take weekend. Your choice??

48. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails, as noted above. At approximately 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line ?Podesta talking
points.? Attached to the email was a ?le labeled, STONE podesta talking points Oct
12 2016.docx.? The ?talking points? included the statement that ?Podesta is at the heart of a
Russian?government money laundering operation that bene?ts ?nancially Podesta personally and
the Clintons through the Clinton Foundation.?

49. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed
CORSI back via Target Account 1: ?Got them and used them.?

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target
Account 2: -- Joule ties to RUSSIA MONEY LAUNDERING to CLINTON
STONE responded, ?Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook.? CORSI wrote back to

STONE, ?I?ll give you one more NOBODY YET HAS It looks to me like
22

Case Document 29-13 Filed 04/28/20 Page 93 of 189

- skimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once-
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund account, there?s no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited ?nancials or IRS Form 9905 about received via
Russia Metcombank[.] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 
51. On or about Thursday, October 13, 2016, at approximately 6:3 0PM, CORSI sent
STONE an email at Target Account 2, with the subject, STONE article RUSSIAN
MAFIA STYLE MONEY-LAUNDERIN G, the CLINTON FOUNDATION, and JOHN
The text stated: ?Roger[,] You are free to publish this under your own name.?
That same day, STONE posted a blog post with the title, ?Russian Mafia money laundering, the
Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks.? The post then asked,

?Just how much money did ?a controversial Russian billionaire investor with

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by -with the money transferred via Deutsche
Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation??

52. On or about October 14, 2016, CORSI sent a message to STONE at Target
Account 3, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s

basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

23

Case Document 29-13 Filed 04/28/20 Page 94 of 189

53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3,
?On Assange, can you call me now before STONE responded, ?Missed ?just
landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important
intel to share.?

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1
and 2 with the subject, ?Fwd: ASSANGE. . .URGENT. . CORSI wrote, ?From a very trusted
source,? and forwarded an email with the header information stripped out, showing only the
body text. The email read, I ?gured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man ?les that include Hillary. It?s what they used to call a ?Mexican stand offH? Only
hope is that if Trump speaks out to save him[.] Otherwise he?s dead anyway, once he?s dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He?s called Podesta?s bluff and raised him the election.?

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3,
call. Important.?

56. On or about October 19, 2016, STONE published an article on Breitbart.com in
which he claimed he had ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated, predicted that Podest?a?s business dealings would be exposed. Ididn?t hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,

2016 discussed above.

57. On or about November 8, 2016, the United States presidential election took place.

24

Case Document 29-13 Filed 04/28/20 Page 95 of 189

58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3,
?Congratulations, Roger. He could not have done it without you.?
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3,

?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in London.

Have some interesting news for you.?

 

25

Case Document 29-13 Filed 04/28/20 Page 96 of 189

 

Case Document 29-13 Filed 04/28/20 Page 97 of 189

 

J. Congressional Testimony and Public Statements About His Relationship
with Wikileaks

61. On September 26, 2017, STONE testi?ed before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta?s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. . . .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny. . . .

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.

27

Case Document 29-13 Filed 04/28/20 Page 98 of 189

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. Thisjournalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary? ?go?between? and ?mutual friend.? All of these monikers are equally



true.

62. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.
Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.

Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had con?rmed with the intermediary 
MR. STONE: That 

Q: -- was the length and the breadth of what you were referring to?

MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasrons.

63. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

K. Use of Target Account 3 to Message Randy CREDICO about 
?Back channel?

28

Case Document 29-13 Filed 04/28/20 Page 99 of 189

64. On November 19, 2017, Randy CREDICO (who, as described further below,
STONE publicly identi?ed as his ?intermediary? to ASSANGE), messaged STONE on Target
Account 3, ?My lawyer wants to see me today.? STONE responded, ??Stonewall it. Plead the
?fth. Anything to save the plan? Richard CREDICO responded, ?Ha ha.?

65. On or about November 21, 2017, CREDICO messaged STONE on Target
Account 3, was told that the house committee lawyer told my lawyer that I will be getting a
STONE wrote back, ?That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear.? They continued to
message, and CREDICO wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To
do what Nothing happening in DC the day before Thanksgiving why are busting my
chops??

66. On or about November 24, 2017, STONE, using Target Account 3, texted
CREDICO, ?Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them which he
himself said in public b4 told me . It?s a fucking witchunt CREDICO replied, told
you to watch his tweets. That?s what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuff[.] Ijust followed his 
STONE responded, never said anything about the DNC but it was August.? CREDICO
wrote back, ?It was not August because I didn?t interview him or meet him until August 26th[.]
That was my ?rst communication with his secretary in London, August 26th.? STONE wrote

back, ?Not the way I remember it oh well I guess Schiff will try to get one of us indicted for

Perjuf?-l?

29

Case Document 29-13 Filed 04/28/20 Page 100 of 189

67. STONE and CREDICO continued to exchange messages via Target Account 3,
and on November 24, 2017, CREDICO wrote to STONE, ?Forensic evidence proves that there is
no back Channel. So now you can relax.?

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.

69. On November 29, 2017, STONE publicly stated that CREDICO was his
?intermediary.? In a public Facebook post, STONE further stated that, ?Credico merely 
con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-mails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

70. On or about December 1, 2017, CREDICO messaged STONE on Target
Account 3, stating, don?t know why you had back Channel now I had
to give all of my forensic evidence to the FBI today what a You could have just told
him the truth that you didn?t have a back Channel they now know that I was not in London until
September of this year[.] You had no back?channel and you could have just told the truth . . .
You want me to cover you for perjury STONE responded, ?What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life

and you can get away with asserting for 5th Amendment rights if don?t want talk about AND if

 

4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.

30

Case Document 29-13 Filed 04/28/20 Page 101 of 189

you-turned over anything to the FBI you?re a fool.? CREDICO responded, ?You open yourself
up to six counts of perjury[.] But I?m sure that wasn?t sworn testimony so you?re probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn?t have put me in this bad spot . . . you should go back . . . and amend your
testimony and tell them the truth.? CREDICO repeated: ?you need to amend your testimony
before I testify on the 15th.? STONE replied, ?If you testify you?re a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you?re stupid enough to


71. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good nigh CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

72. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

73. STONE and CREDICO continued to exchange messages via Target Account 3,
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, ?Hope don?t fuck Up my efforts to get Assange a 
CREDICO messaged STONE, have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my

show[.] That was my initial contact.?

31

Case Document 29-13 Filed 04/28/20 Page 102 of 189

74. On or about January 8, 2018, CREDICO messaged STONE on Target Account 3
stating: ?Embassy logs . . . 17 other pieces of information prove that I did not have any
conversations with Assange until September of last year.?

75. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE on Target Account 3: ?You lied to the house Intel
committee . . . But you?ll get off because you?re friends with Trump so don?t worry. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
of 2016 to prove 

76. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my
lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to take that dog away
from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 

77. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told

me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too.

 

5 
135911370.htm1

6 

32

Case Document 29-13 Filed 04/28/20 Page 103 of 189

He was depressed about it. Or was he lying.? The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.

L. Use of the Target Accounts to Communicate with Individuals Related to
the Investigation

78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap
devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use
Target Account 1 and Target Account 2, and that he has used them to communicate with

individuals related to the investigation.

   
 

79. For example, STONE and ommunicated twice on May 28 and May

29, 2018 using Target Account 1. a former associate of was

interviewed by the Special Counsel?s Of?ce on or about May 2, 2018. Toll records show that

-nd STONE communicated multiple times on May 5, 2018, and STONE

communicated with-using Target Account 1 on June 1, 2018 and June 6, 2018. -

- a private investigator who had previously worked with STONE and who was hired

by STONE to research individuals associated with this case (as described further below),

   
 

 

communicated with STONE on Target Account 1 at least four times between May 27, 2018 and

July 12,2018.

80. STONE has also used Target Account 2 to communicate with individuals

associated with this investigation.

a. For example, between May 23, 2018 and the present, STONE and CORSI
exchanged at least ?ve messages using Target Account 2. In the same time period, STONE

exchanged at least 75 emails with CREDICO using Target Account 2.

33

Case Document 29-13 Filed 04/28/20 Page 104 of 189

b. Also in this same time period, STONE emailed _at least

ten times using Target Account 2.-is a former employee of STONE. On May 9,

and again on May 10, 201 8? communicated by phone with

STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails

wit-sing Target Account 2. In addition, between on or about June 14, 2018 and

and STONE exchanged five emails using Target Account 2.

       

June 17,2018,

  

81. STONE has also used a phone number associated with Target Account 3 to

communicate with - a private investigator hired by STONE. -was

interviewed by investigators on June 7, 2018, and subsequently informed investigators that in

June 2018, STONE instructed him to conduct a full background investigation on-

.vho had been employed by STONE during the Campaign as an information technology
specialist-?
_also told investigators that in June 2018, STONE instructed him to ?nd

an address for CREDICO that could be used to serve CREDICO with legal process.

-told investigators that his primary form of communication with STONE is by text

 
 
 

 

message on Target Account 3.

BACKGROUND CONCERNING EMAIL
82. In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail (?email?) to the public. The Providers allow

34

Case Document 29-13 Filed 04/28/20 Page 105 of 189

subscribers to obtain email accounts at the domain names identi?ed in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account?s user or users.

83. In my training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber?s full name, physical address, telephone numbers and
other identi?ers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account?s user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.

84. In my training and experience, email Providers typically retain certain
transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (1162., session) times and durations, the types of service utilized, the status of the account

(including whether the account is inactive or closed), the methods used to connect to the account

35

Case Document 29-13 Filed 04/28/20 Page 106 of 189

(such as logging into the account via the Providers? website), and other log ?les that re?ect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address address?) used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.

85. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers? support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account?s user or users.

86. As explained herein, information stored in connection with an email account may
provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This ?user attribution? evidence is analogous to the search for ?indicia of
occupancy? while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such

as date and time) may indicate who used or controlled the account at a relevant time. Further,

36

Case Document 29-13 Filed 04/28/20 Page 107 of 189

information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user?s account may further indicate the geographic location of the
account user at a particular time g, location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner?s state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner?s motive and intent to commit a crime 
communications relating to the crime), or consciousness of guilt deleting communications
in an effort to conceal them from law enforcement).

87. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event

has occurred.

INFORMATION REGARDING APPLE ID AND 

 

7 The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: Law Enforcement Legal Process Guidelines,? available
at ?Create and start using an Apple 
available at ?iCloud,? available at ?What
does iCloud back available at 25 Security,? available at

37

Case Document 29-13 Filed 04/28/20 Page 108 of 189

88. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the operating system, and desktop and laptop computers based on

the Mac OS operating system.

89. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications As
described in further detail below, the services include email, instant messaging, and file storage:

a. Apple provides email service to its users through email addresses at the
domain names mac.com, me.com, and icloud.com.

b. iMessage and FaceTime allow users of Apple devices to communicate in
real?time. iMessage enables users of Apple devices to exchange instant messages (?iMessages?)
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.

0. iCloud is a ?le hosting, storage, and sharing service provided by Apple.
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store device backups and data associated with third-party apps.

d. iCloud-connected services allow users to create, store, access, share, and
data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and

manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user

Security Guitlupclf, and ?iCloud: How Can I Use iCloud?,? available at


38

Case Document 29-13 Filed 04/28/20 Page 109 of 189

to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to bookmarks and webpages opened in the Safari web browsers
on all of the user?s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and i network information across multiple
Apple devices.

e. Game Center, Apple?s social gaming network, allows users of Apple
devices to play and share games with each other.

f. Find My iPhone allows owners of Apple devices to remotely identify and
track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.

g. Location Services allows apps and websites to use information from
cellular, i, Global Positioning System networks, and Bluetooth, to determine a
user?s approximate location.

h. App Store and iTunes Store are used to purchase and download digital
content. apps can be purchased and downloaded through App Store on devices, or
through iTunes Store on desktop and'laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on devices and on desktop and laptop computers running

either Microsoft Windows or Mac OS.

39

Case Document 29-13 Filed 04/28/20 Page 110 of 189

90. Apple services are accessed through the use of an ?Apple an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.

91. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a ?veri?cation email? sent by Apple to that ?primary? email address.
Additional email addresses (?alternate,? ?rescue,? and ?noti?cation? email addresses) can also be
associated with an Apple ID by the user.

92. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user?s full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the ?My Apple and ?iForgot? pages on
Apple?s website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address address?) used to register and access

the account, and other log ?les that re?ect usage of the account.

40

Case Document 29-13 Filed 04/28/20 Page 111 of 189

93. Additional information is captured by Apple in connection with the use of an
Apple ID to access certain services. For example, Apple maintains Connection logs with IP
addresses that re?ect a user?s sign?on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple?s website. Apple
also maintains records re?ecting a user?s app purchases from App Store and iTunes Store, ?call
invitation logs? for FaceTime calls, ?query logs? for iMessage, and ?mail logs? for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.

94. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an device, Apple captures and retains the user?s IP
address and identi?ers such as the Integrated Circuit Card ID number which is the
serial number of the device?s SIM card. Similarly, the telephone number of a user?s iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identi?ers, including the Media Access Control address 
address?), the unique device identi?er and the serial number. In addition,
information about a user?s computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user?s web browser may be
captured when used to access services through icl.oud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a

device.

41

Case Document 29-13 Filed 04/28/20 Page 112 of 189

95. Apple provides users with ?ve gigabytes of free electronic space on iCloud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other ?les (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store 108 device backups, which can contain a user?s photos and
videos, iMessages, Short Message Service and Multimedia Messaging Service
messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the app for WhatsApp, an
instant messaging service, can be con?gured to regularly back up a user?s instant messages on
iCloud Drive. Some of this data is stored on Apple?s servers in an form but can

nonetheless be by Apple.

96. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
?les and records described above. This evidence may establish the ?who, what, why, when,
where, and how? of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further

suspicion.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

42

Case Document 29-13 Filed 04/28/20 Page 113 of 189

97. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. 2703(a), 2703(b)(1)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
and particularly described in Section I of Attachment B, D, and F. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identi?ed in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and ?lter out privileged material.

CONCLUSION

98. Based on the forgoing, I request that the Court issue the proposed search warrant.

99. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not
required for the service or execution of this warrant.

REQUEST FOR SEALING

100. I further request that the Court order that all papers in support of this application,
including the af?davit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriouslyjeopardize that investigation.

Respectfully submitted,

Andrew Mitchell
Special Agent
Federal Bureau of Investigation

43

Case Document 29-13 Filed 04/28/20 Page 114 of 189

r7:

.- 

Subscribed and sworn to before me on this day of August, 2018The Honorable Beryl A. Howell
Chief United States District Judge

 

44

Case Document 29-13 Filed 04/28/20 Page 115 of 189

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the email address:

created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered

at One Microsoft Way, Redmond, WA 98052.

45

Case Document 29-13 Filed 04/28/20 Page 116 of 189

ATTACHMENT 
Particular Things to be Seized

1. Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, ?les, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. 2703(f), the Provider is required
to disclose the following information to the government for each account or identi?er listed in
Attachment A:

a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e?mail, the date and time at which
each e-mail was sent, and the size and length of each e?mail;

b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;

0. A11 internet search data including all queries and location data;

d. All transactional information of all activity of the account described above in Section LA,
including log ?les, dates, times, methods of connecting, ports, dial ups, and/or locations;

e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and ?les;

f. Records or other information regarding the identi?cation of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identi?ers, records of session times and durations, log?in IP addresses associated
with session times and dates, account status, alternative e?mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section 

46

Case Document 29-13 Filed 04/28/20 Page 117 of 189

II. Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision ofa felony), 18
U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized
access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.
1513 (witness tampering); 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contribution ban) from June 1,
2015 to present, including:

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,

associated with the Trump Campaign;

c. All images, messages, communications, calendar entries, search terms, ?address book?
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;

d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identi?er concerning the messages identified above,
including records about their identities and whereabouts;

e. Evidence of the times the account was used;

f. All images, messages and communications regarding wiping software, or
other methods to avoid detection by law enforcement;

g. Passwords and keys, and other access information that may be necessary to
access the account and other associated accounts;

h. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

Case Document 29-13 Filed 04/28/20 Page 118 of 189

i. All existing printouts from original storage which concern the categories identi?ed in
subsection {La

48

Case Document 29-13 Filed 04/28/20 Page 119 of 189

ATTACHMENT 

 

Property to be Searched

This warrant applies to information associated with the following Google account:

 

created or maintained between October 17, 2017 and the present, that is storedat premises
owned, maintained, controlled, or operated by Google, Inc., a business with of?ces located at

1600 Amphitheatre Parkway, Mountain View, CA 94043.

49

Case Document 29-13 Filed 04/28/20 Page 120 of 189

ATTACHMENT 
Particular Things to be Seized

1. Files and Accounts to be produced by Google, Inc.

To the extent that the information described in Attachment is within the possession,
custody, or control of Google, Inc. including any messages, records, ?les, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. 2703(f), Google is required to disclose the
following information to the g0vernment for each account or identi?er listed in Attachment C:

a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e?mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;

b. All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;

0. All internet search data including all queries and location data;

d. All transactional information of all activity of the account described above
in Section LA, including log ?les, dates, times, methods of connecting, ports, dial ups,
and/or locations;

6. All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and ?les;

f. All records or other information regarding the identi?cation of the account
described above in Section LA, to include application, full name, physical address,
telephone numbers and other identi?ers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e?mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log ?les, means and source of payment
(including any credit or bank account number), and detailed billing records;

g. All records indicating the services available to subscribers of the
electronic mail address described above in Section 

h. Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;

50

Case Document 29-13 Filed 04/28/20 Page 121 of 189

i. Google Drive ?les created, accessed or owned by the acCount;

j. YouTube subscriber information, private videos and ?les, private
messages, and comments;

k. Google+ Photos contents to include all images, videos and other ?les, and
associated upload/download date and timestamp;

1. Google Talk and Google Hangouts conversation logs associated with the
account.

51

Case Document 29-13 Filed 04/28/20 Page 122 of 189

II. Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision ofa felony), 18
U.S.C. ?371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized
access ofa protected computer); 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
1513 (witness tampering); 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contribution ban), from June
1, 2015 to present, including:

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

b. All records, information, documents or tangible materials that relate in any way to
communications or meetin involvin Jerome Corsi, Julian Assange,
?Randy Credico, or any individual
associated with the Trump Campaign;

c. All images, messages, communications, calendar entries, search terms, ?address book?
entries and contacts, including any and all preparatory steps taken in furtherance of the
above?listed offenses;

d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identi?er concerning the messages identified above,
including records about their identities and whereabouts;

e. Evidence of the times the account was used;

f. All images, messages and communications regarding wiping software, or
other methods to avoid detection by law enforcement;

g. Passwords and keys, and other access information that may be necessary to
access the account and other associated accounts;

h. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

i. All existing printouts from original storage which concern the categories identified in
subsection 11a

52

Case Document 29-13 Filed 04/28/20 Page 123 of 189

ATTACHMENT 

Property to be Searched

This warrant applies to information associated with the following Apple DSID:

 

created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,

California 95014.

53

Case Document 29-13 Filed 04/28/20 Page 124 of 189

ATACHMENT 
Particular Things to be Seized

I. Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, ?les, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. 2703(f), Apple is required to disclose the following information to the government,
in form whenever available, for each account or identi?er listed in Attachment E:

a. All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and noti?cation email addresses, and veri?cation information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);

b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identi?ers Advertising Identi?ers Global Unique Identi?ers
Media Access Control addresses, Integrated Circuit Card ID numbers
Electronic Serial Numbers Mobile Electronic Identity Numbers 
Mobile Equipment Identi?ers Mobile Identi?cation Numbers Subscriber
Identity Modules Mobile Subscriber Integrated Services Digital Network Numbers
International Mobile Subscriber Identities and International Mobile
Station Equipment Identities 

c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was Sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;

d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;

54

Case Document 29-13 Filed 04/28/20 Page 125 of 189

e. The contents of all ?les and other records stored on iCloud, including all 
device backups, all Apple and third?party app data, all ?les and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;

f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including aceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web?based access of Apple
services (including all associated identi?ers), and logs associated with device purchase,
activation, and upgrades;

g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;

h. All records pertaining to the types of service used;

i. All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and

j. All ?les, keys, or other information necessary to any data produced in an

form, when available to Apple (including, but not limited to, the keybag.txt and
?les).

55

Case Document 29-13 Filed 04/28/20 Page 126 of 189

II. Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision ofa felony), 18
U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized
access ofa protected computer); 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
1513 (witness tampering); 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contribution ban), from June
1, 2015 to present, including:

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetin involvin Jerome Corsi, _Julian Assange,
Randy Credico, or any individual

 
 

associated with the Trump Campaign;

c. All images, messages, communications, calendar entries, search terms, ?address book?
entries and contacts, including any and all preparatory steps taken in furtherance of the
above?listed offenses;

d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identi?er concerning the messages identi?ed above,
including records about their identities and whereabouts;

e. Evidence of the times the account was used;

f. All images, messages and communications regarding wiping software, or
other methods to avoid detection by law enforcement;

g. Passwords and keys, and other access information that may be necessary to
access the account and other associated accounts;

h. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

i. All existing printouts from original storage which concern the categories identi?ed in
subsection 

56

Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 127 of 189
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THREE
ACCOUNTS STORED AT PREMISES CONTROLLED
BY MICROSOFT, GOOGLE, AND APPLE

)
)
)
)
)
)

Case: 1: 18-sc-02583
Ass!gned To: Howell, Beryl A.
Assign. Date : 8/3/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property lo be searched and give its location):

See Attachment C

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment D

YOU ARE COMMANDED to execute this warrant on or before
August 15, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrale Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 128 of 189

AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 129 of 189

ATTACHMENT C
Property to be Searched
This warrant applies to information associated with the following Google account:

created or maintained between October 17, 2017 and the present, that is stored at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
1600 Amphitheatre Parkway, Mountain View, CA 94043.

49

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 130 of 189

ATTACHMENTD
Particular Things to be Seized

I.

Files and Accounts to be produced by Google, Inc.

To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section I.A.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;
50

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 131 of 189

i.

Google Drive files created, accessed or owned by the account;

j.
YouTube subscriber infonnation, private videos and files, private
messages, and comments;

k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
I.
account.

Google Talk and Google Hangouts conversation logs associated with the

51

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 132 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
52

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 133 of 189
AO 106 (Rev. 04/10) Application for a Search Warrant

f

UNITED STATES DISTRICT COURT

AUG ._ 3 201H

for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe rhe property to be searched
or ide11tifj1 l11e person by name a11d,addrcss)

)
)

INFORMATION ASSOCIATED WITH THREE ACCOUNTS
STORED AT PREMISES CONTROLLED BY MICROSOFT,
GOOGLE, AND APPLE

)
)
)

Clerk, U. S, lllstrlct & Bankrupic}
Courts for t~e District of Columola

Case: 1:18-sc-02583
Assigned To : Howell, Beryl A.
Assign. Date : 8/3/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its localion):

See Attachment C

located in the

- - -Northern
- - - - - District of

California

- -- - - - - - - - - -

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment D

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;

~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Offense Description

Code Section

18 u.s.c. §§ 1505, 1512, 1513
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Obstruction of justice, Witness tampering
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on ~

Reviewed by AUSA/SAUSA:
!Aaron Zelinsky (ASC)

Applicam's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
.Judge 's signature

City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and litle

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 134 of 189

]: i,'
AUG - 3 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
lN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIATED WITH
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY
MICROSOFT, GOOGLE, AND APPLE

Clerk, U.S. ()istrlc:t & Bunkruptc}'
Courts tor the District of Columbia

Case: 1: 18-sc-02583
Assigned To : Howell, Beryl A.
Assign . Date : 8/3/2018 .
Descript ion: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following:
a. The email accoun

(hereafter "Target Account 1), that is

stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
and in Attachments A and B.
b. The email accoun

(hereafter "Target Account 2"), that is

stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments C and D.
c. The iCloud account

associated with the Apple email account

(hereafter "Target Account 3"), that is stored at premises owned,

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 135 of 189

maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
the government is described in the following paragraphs and in Attachment E and F.
2.

I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation

(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18
U.S.C. § J 030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses").
5.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for Roger STONE'

address,

(Target

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
address,

(Target Account 2). On or about March 14, 2018, Chief

Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This

2

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 136 of 189

warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 27I 1(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,

including in paragraphs 14, 19, and 61.
SUMMARY
7.

This application seeks authority to search, from the date of search warrants

previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set

"
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
witnesses, and make false statements.
8.

For example, as set forth in more detail below, in recent months STONE has

reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
campaign or were scheduled to meet with the Special Counsel's Office
. After STONE learned that one witness, Randy
CREDICO, was prepared to contradict STONE's congressional testimony, STONE repeatedly
3

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 137 of 189

urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness

who had

done information technology work for STONE during the campaign and

In September 2017, STONE released a statement he said he provided to Congress

9.

in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather. to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a.

On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get

to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
CORSI to have

contact ASSANGE. On or about August 2, 2016, CORSI

responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
it will soon the Podesta's time in the barrel. #CrookedHillary."
b.

Information disclosures subsequently occurred on or about the times

CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 138 of 189

Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthencandidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
c.

Furthermore, on the day of the Access Hollywood video disclosure, there

were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.

5

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 139 of 189

PROBABLE CAUSE.
A. Background on Relevant Individuals
i. Roger STONE

10.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

11.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

6

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 140 of 189

B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking
Activity during the 2016 Presidential Election

13.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following:
a.

The U.S. Intelligence Community ("USIC") is confident that the Russian

Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were

7

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 141 of 189

intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
14.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
a.

"Russian President Vladimir Putin ordered an influence campaign in 2016

aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and.potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
b.

The USIC also described, at a high level, some of the techniques that the

Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-such as cyber activitywith overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls.'"
c.

With respect to "cyber activity," the USIC assessed that "Russia's

intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further,
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber

8

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 142 of 189

activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
and is Russia's largest foreign intelligence agency.
d.

With respect to the release of stolen materials, the USIC assessed "with

high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
e.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made

multiple contradictory statements and false claims about his identity throughout the election.

C. Additional Hacking Activity by Individuals Associated with the GRU
15.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the."snapshots" to
those accounts.
17.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later posted on DCLeaks.
9

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 143 of 189

18.

On or about November I, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
19.

On or about July 13, 2018, a grand jury in this District indicted eleven GRU

officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United

States v. Viktor Borisovich Netyksho, et al. (1: 18-cr-215) (D.D.C.). 1

D. Roger STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
20.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.

1

A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.

10

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 144 of 189

22.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
23.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by AS SAN GE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
25.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 145 of 189

Twitter account was reinstated.
26.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJ r paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27.

On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign.
28.

As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted:

"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well,
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
like the Watergate tapes."
29.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
30.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday @HillaryClinton is done. #WikiLeaks."
31.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
12

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 146 of 189

of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Info wars that his intennediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
32.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
33.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
35.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 147 of 189

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "S\nce I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
36.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr. Information recovered from the search of that account
includes the following:
a.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the

hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
b.

Less than an hour later, @wikileaks responded by direct message: "We

appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
c.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
14

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 148 of 189

d.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
e.

In addition, @RogerJStoneJr also exchanged direct messages with

ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

f.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

15

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 149 of 189

F. STONE's Communications with STONE
Forthcoming Leaks

37.

, and Others Regarding

As indicated above, on September 11, 2017, Chief Judge Howell issued a search

warrant for STONE's

address,

(Target Account 1); on

October 17, 2017, Chief Judge Howell issued a search warrant for STONE'

address,

(Target Account 2); and on or about March 14, 2018, Chief Judge

Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
email account. Information recovered pursuant to those search warrants includes the following:
a.

On or about May 15, 2016,

emailed CORSI: "Here is my

flight schedule. Need to get something confirmed now .... " CORSI responded, ."! copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
that, "May meet Manafort -guarantee nothing."
b.

On or about May 18, 2016, CORSI emailed STONE at Target Account 1

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
c.

On July 25, 2016, STONE, using Target Account 1, sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange

16

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 150 of 189

[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
d.

On or about July 31, 2016, STONE, using Target Account 1, emailed

CORSI with the subject line, "Call me MON." The body of the email read:

should see

should find Bernie [S]anders brother who called Bill a Rapist- tum him for

Assange[.]
Trump[.]

should fin
e.

e or more proof of Bill getting kicked out."

As noted above, on or about August 2, 2016 (approximately 19 days

before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HR.Can artifact ofrigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
f.

On or about August 5, 2016,

an associate of STONE's,

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the
17

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 151 of 189

same time, STONE told him he had gone to London to meet ASSANGE

also stated

told STONE he would be interviewed by the FBI and would have to

that in 2018

divulge the conversation about meeting AS SAN GE. STONE tol

he was joking and

had not actually met ASSANGE. 2
g.

On or about August 15, 2016, CORSI emailed STONE at Target Account

1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not

over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
h.

On or about August 31, 2016, CORSI emailed STONE at Target Account

1: "Did you get the PODESTA writeup." STONE replied "[y]es."
1.

On or about August 31, 2016, CORSI messaged STONE at Target

Account 3, "Podesta paid $ l 80k to invest in Uranium One - was hired by Rosatom in Giustra

scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."

J.

On or about September 6, 2016, CORSI emailed STONE at Target

Account 1: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

k.

On or about September 24, 2016,

emailed CORSI, "I will

have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,

18

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 152 of 189

"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you

are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
posted about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
I.

On or about October 3, 2016, an associate of STONE emailed STONE at

Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,

"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
m.

On or about October 4, 2016, ASS ANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
n.

On or about October 4, 2016, CORSI messaged STONE at Target

Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total

BS hype."
19

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 153 of 189

o.

That same day, BANNON emailed STONE at Target Account 2, "What

was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye

is a

big democrat."
p.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had b~en hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released

38.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold rece_ived a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood' and NBC for reaction."
39.

According to phone record

, at approximately

11 :27 AM, CORSI placed a ca.JI to STONE which STONE did not answer.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-wason/2016/10/07/3 ld74 7l 4-8ce5- l l e6-875e-2cl bfe943b66_story.html

20

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 154 of 189

40.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
41.

At approximately 1 :42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
42.

At approximately 2: 18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
43.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
44.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
of next dump focus, setting stage for Foundation debacle."
45.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target

Account 2, forwarded

message to CORSI without comment. STONE does not appear

to have forwarded the email to any other individual.

H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
46.

On or about October 8, 2016, STONE, using Target Account 3, messaged

CORSI, "Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 155 of 189

a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
speech comments, attacking bad job numbers."
47.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
the Clintons through the Clinton Foundation."
49.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50.

On or about Thursday, October 13, 2016, CORSI emailed STONE at Target

Account 2: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON

FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 156 of 189

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation(.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have no.w promised it to a dozen MSM reporters[.]"
51.

On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent

STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how much money did

, a controversial Russian billionaire investor with

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by

, with the money transferred via Deutsche

Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52.

On or about October 14, 2016, CORSI sent a message to STONE at Target

Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's

basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 157 of 189

53.

On or about October 17, 2016, CORSI messaged STONE at Target Account 3,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54.

On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1

and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted

source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.J I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55.

On or about October 18, 2016, CORSI messaged STONE at Target Account 3,

"Pis call. Important."
56.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
57.

On or about November 8, 2016, the United States presidential election took place.

24

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 158 of 189

58.

On or about November 9, 2016, CORSI messaged STONE at Target Account 3,

"Congratulations, Roger. He could not have done it without you."
59.

On or about November 10, 2016, CORSI messaged STONE at Target Account 3,

"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
Have some interesting news for you."

25

 Case Document 29-13 Filed 04/28/20 Page 159 of 189

 

Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 160 of 189

J. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks

61.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Pode_sta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 161 of 189

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this rep011, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
infotmation proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
62.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in_
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: ThatQ: -- was the length and the breadth of what you were referring to?
MR. STONE: That is c01Tect, even though it was repeated to me on numerous separate
occasions.
63.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
K. STONE's Use of Target Account 3 to Message Randy CREDI CO about STONE's
"Back channel"

28

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 162 of 189

64.

On November 19, 2017, Randy CREDI CO (who, as described further below,

STONE publicly identified as his "intermediary'' to ASSANGE), messaged STONE on Target

Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
65.

On or about November 21, 2017, CREDICO messaged STONE on Target

Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a
subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?'.'
66.

On or about November 24, 2017, STONE, using Target Account 3, texted

CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDI CO replied, "I told
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one ofus indicted for
perjury[.]"

29

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 163 of 189

67.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
no back Channel. So now you can relax."
68.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
70.

On or about December 1, 2017, CREDICO messaged STONE on Target

Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.

30

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 164 of 189

you ·turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDI CO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify(.]"
71.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say 1 have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th(.]" STONE responded: "You got nothing."
72.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
show[.] That was my initial contact."
31

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 165 of 189

74.

On or about January 8, 2018, CREDICO messaged STONE on Target Account 3

stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
conversations with Assange until September of last year."
75.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee ... But you'll get off because you're friends with Trump so don't worry. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
of 2016 to prove it[.]"
76.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
77.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog135911370.html

6

https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/

32

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 166 of 189

He was depressed about it. Or was he lying." The article noted that CREDTCO stated he did not
have prostate cancer and did not have any such discussion with STONE.

L. STONE's Use of the Target Accounts to Communicate with Individuals Related to
the Investigation
78.

On May I 7, 2018, Chief Judge Howell issued an order for the use of pen-trap

devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use

Target Account 1 and Target Account 2, and that he has used them to communicate with
individuals related to the investigation.
79.

For example, STONE and

communicated twice on May 28 and May

29, 2018 using Target Account 1.

, a former associate of STONE's, was

interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that

'

and STONE communicated multiple times on May 5, 2018, and STONE
communicated wit

using Target Account 1 on June 1, 2018 and June 6, 2018.

a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
July 12,2018.
80.

STONE has also used Target Account 2 to communicate with individuals

associated with this investigation.
a.

For example, between May 23, 2018 and the present, STONE and CORSI

exchanged at least five messages using Target Account 2. In the same time period, STONE
exchanged at least 75 emails with CREDICO using Target Account 2.

33

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 167 of 189

•

b.

Also in this same time period, STONE emailed

is a former employee of STONE. On May 9,

ten times using Target Account 2.
2018, FBI agents approached

at least

and

That day,

and again on May 10, 2018,

communicated by phone with

STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
with

using Target Account 2. In addition, between on or about June 14, 2018 and

June 17, 2018,

81.

and STONE exchanged five emails using Target Account 2.

STONE has also used a phone number associated with Target Account 3 to

communicate with

, a private investigator hired by STONE.

was

interviewed by investigators on June 7, 2018, and subsequently informed investigators that in
June 2018, STONE instructed him to conduct a full background investigation on
who had been employed by STONE during the Campaign as an information technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary fmm of communication with STONE is by text
message on Target Account 3.

BACKGROUND CONCERNING EMAIL
82.

In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail ("email") to the public. The Providers allow

34

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 168 of 189

subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by r~gistering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
83.

In my training and experience, email Providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
84.

In my training and experience, email Providers typically retain certain

transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
35

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 169 of 189

(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
85.

In my training and experience, in some cases, email account users will

communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
86.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For ~xample, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 170 of 189

information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
~

in an effort to conceal them from law enforcement).
87.

In my training and experience, information such as search history can help to

show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

INFORMATION REGARDING APPLE ID AND iCLOUD 7

The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htip:/limages.apple.com/orivacy/docs/ legal-process-guiclelines-us.pd_f; "Create and start using an Apple ID,"
available at https://suppoct.app.Je.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.aople.com/ kb/PH12519; "iOS Security," available at

37

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 171 of 189

88.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
89.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a.

Apple provides email service to its users through email addresses at the

domain names mac.com, me.com, and icloud.com.
b.

iMessage and FaceTime allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
c.

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
d.

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user

https://www.apple.com/business/docs/iOS Security Guid.e. pdf, and "iCloud: How Can I Use iCloud?," available at
https: //support.apple.com/kb/PH26502.

38

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 172 of 189

to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
e.

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
f.

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
g.

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
h.

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.

39

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 173 of 189

90.

Apple services are accessed through the use of an "Apple ID," an account created

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91.

An Apple ID takes the form of the full email address submitted by the user to

create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in@icloud.com, @me.com, or@mac.com) or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
92.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.

40

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 174 of 189

93.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.

41

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 175 of 189

95.

Apple provides users with five gigabytes of free electronic space on iCloud, and

users can purchase additional storage space. That storage space, located oµ servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail) ; images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
96.

In my training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

42

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 176 of 189

97.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.
CONCLUSION
98.

Based on the forgoing, I request that the Court issue the proposed search warrant.

99.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING
100.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respe~

Andrew Mitchell
Special Agent
Federal Bureau of Investigation
43

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 177 of 189

Subscribed and sworn lo before me on this

1f {

of Augus~ 2018.

/

$

/711 !l l(,t1Lt
The Honorable Beryl A. Howell
Chief United States District Judge

44

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 178 of 189

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the email address:

created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered
at One Microsoft Way, Redmond, WA 98052.

45

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 179 of 189

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section LA.;

46

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 180 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 181 of 189

i.

All existing printouts from original storage which concern the categories identified in
subsection II.a

48

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 182 of 189

ATTACHMENT C
Property to be Searched

This warrant applies to information associated with the following Google account:

created or maintained between October 17, 2017 and the present, that is stored.at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
1600 Amphitheatre Parkway, Mountain View, CA 94043.

49

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 183 of 189

ATTACHMENT D
Particular Things to be Seized

I.

Files and Accounts to be produced by Google, Inc.

To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(£), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section LA, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section LA.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;

50

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 184 of 189

1.

Google Drive files created, accessed or owned by the account;

J.
YouTube subscriber information, private videos and files, private
messages, and comments;

k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;

1.

Google Talk and Google Hangouts conversation logs associated with the

account.

51

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 185 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
52

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 186 of 189

ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:

created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.

53

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 187 of 189

ATACHMENTF
Particular Things to be Seized

I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment Eis within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
ofthe United States, including any messages, records, files, logs, or infonnation that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
a.
All records or other information regarding th~ identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;

54

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 188 of 189

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f.
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, Jogs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and
j.
All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

55

 Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 189 of 189

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
I, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.

All existing printouts from original storage which concern the categories identified in
subsection II.a
56

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 1 of 61
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the properly lo be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH THREE
ACCOUNTS STORED AT PREMISES CONTROLLED
BY MICROSOFT, GOOGLE, AND APPLE

)
)
)
)
)
)

Case: 1: 18-sc-02582
Assigned To: Howell, Beryl A.
Assign . Date: 8/3/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Western
District of
Washington
(identify the person or describe the properly to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 15, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m.
0 at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 2 of 61
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No. :

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 3 of 61

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the email address:

created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered
at One Microsoft Way, Redmond, WA 98052.

45

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 4 of 61

ATTACHMENTB
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

46

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 5 of 61

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. §4(misprisionofafelony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 6 of 61

i.

All existing printouts from original storage which concern the categories identified in
subsection II.a

48

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 7 of 61
AO 106 (Rev. 04/10) Application for a Search Warrant

f

UNITED STATES DISTRICT COURT

AUG ._ 3 201H

for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe rhe property to be searched
or ide11tifj1 l11e person by name a11d,addrcss)

)
)

INFORMATION ASSOCIATED WITH THREE ACCOUNTS
STORED AT PREMISES CONTROLLED BY MICROSOFT,
GOOGLE, AND APPLE

)
)
)

Clerk, U. S, lllstrlct & Bankrupic}
Courts for t~e District of Columola

Case: 1:18-sc-02583
Assigned To : Howell, Beryl A.
Assign. Date : 8/3/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its localion):

See Attachment C

located in the

- - -Northern
- - - - - District of

California

- -- - - - - - - - - -

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment D

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;

~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Offense Description

Code Section

18 u.s.c. §§ 1505, 1512, 1513
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Obstruction of justice, Witness tampering
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on ~

Reviewed by AUSA/SAUSA:
!Aaron Zelinsky (ASC)

Applicam's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
.Judge 's signature

City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and litle

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 8 of 61

]: i,'
AUG - 3 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
lN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIATED WITH
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY
MICROSOFT, GOOGLE, AND APPLE

Clerk, U.S. ()istrlc:t & Bunkruptc}'
Courts tor the District of Columbia

Case: 1: 18-sc-02583
Assigned To : Howell, Beryl A.
Assign . Date : 8/3/2018 .
Descript ion: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the following:
a. The email accoun

(hereafter "Target Account 1), that is

stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
and in Attachments A and B.
b. The email account

(hereafter "Target Account 2"), that is

stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments C and D.
c. The iCloud account

associated with the Apple email account

(hereafter "Target Account 3"), that is stored at premises owned,

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 9 of 61

maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
the government is described in the following paragraphs and in Attachment E and F.
2.

I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation

(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses").
5.

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for Roger STONE'

address,

(Target

Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's

address,

(Target Account 2). On or about March 14, 2018, Chief

Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This
2

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 10 of 61

warrant seeks to search those accounts from the date each respective warrant was issued to the
present.

JURISDICTION
6.

This Court has jurisdiction to issue the requested warrant because it is "a comt of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraphs 14, 19, and 61.

SUMMARY
7.

This application seeks authority to search, from the date of search warrants

previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
witnesses, and make false statements.
8.

For example, as set forth in more detail below, in recent months STONE has

reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
campaign or were scheduled to meet with the Special Counsel's Office
. After STONE learned that one witness, Randy
CREDICO, was prepared to contradict STONE's congressional testimony, STONE repeatedly
3

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 11 of 61

urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness

who had

done information technology work for STONE during the campaig

9.

In September 2017, STONE released a statement he said he provided to Congress

in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a.

On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get

to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
AS SAN GE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed
CORSI to have

contact ASSANGE. On or about August 2, 2016, CORSI

responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
it will soon the Podesta's time in the barrel. #CrookedHillary."
b.

Information disclosures subsequently occurred on or about the times

CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the

4

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 12 of 61

Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape of thencandidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
c.

Furthermore, on the day of the Access Hollywood video disclosure, there

were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.

5

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 13 of 61

PROBABLE CAUSE.
A. Background on Relevant Individuals
i. Roger STONE

10.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome CORSI
11.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

6

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 14 of 61

B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking
Activity during the 2016 Presidential Election
13.

On October 7, 2016, the U.S. Department of Homeland Security and the Office of

the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
assessed the following:
a.

The U.S. Intelligence Community ("USIC") is confident that the Russian

Government directed the recent compromises of emails from .US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were

7

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 15 of 61

intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
14.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
a.

"Russian President Vladimir Putin ordered an influence campaign in 2016

aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
b.

The USIC also described, at a high level, some of the techniques that the

Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-·such as cyber activitywith overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
c.

With respect to "cyber activity," the USIC assessed that "Russia's

intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further1
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 16 of 61

activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
and is Russia's largest foreign intelligence agency.
d.

With respect to the release of stolen materials, the USIC assessed "with

high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
e.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made

multiple contradictory statements and false claims about his identity throughout the election.
C. Additional Hacking Activity by Individuals Associated with the GRU

15.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September,"these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
17.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later posted on DCLeaks.
9

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 17 of 61

I 8.

On or about November I, 20 I 6, individuals associated with the GRU

spearphished over I 00 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
19.

On or about July 13, 2018, a grand jury in this District indicted eleven GRU

officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United

States v. Viktor Borisovich Netyksho, et al. (l: I 8-cr-215) (D.D.C.). 1

D. Roger STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
20.

On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
I

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
-In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.

1

A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.

10

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 18 of 61

22.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
23.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
25.

On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer

2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 19 of 61

Twitter account was reinstated.
26.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27.

On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign.
28.

As noted above, on August 21, 2016, using@RogerJStoneJR, STONE tweeted:

"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE] , the public [could] expect to see much more from the exiled
whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well,
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
like the Watergate tapes."
29.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
30.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
31.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had schec;luled for the next day from the balcony
12

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 20 of 61

of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJ r
to tweet: "Payload coming. #Lockthemup."
32.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
33.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
35.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 21 of 61

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
36.

On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the

Twitter account @RogerJStoneJr. Information recovered from the search of that account
includes the following:
a.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the

hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
b.

Less than an hour later, @wikileaks responded by direct message: "We

appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
c.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends ar·e."

14

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 22 of 61

d.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
e.

In addition, @RogerJStoneJr also exchanged direct messages with

ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
f.

On Saturday, June I 0, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

15

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 23 of 61

F. STONE's Communications with STONE
Forthcoming Leaks

37.

and Others Regarding

As indicated above, on September 11, 2017, Chief Judge Howell issued a search

warrant for STONE'

(Target Account 1); on

address

October 17, 2017, Chief Judge Howell issued a search warrant for STONE'

address,

(Target Account 2); and on or about March 14, 2018, Chief Judge

Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December I 9, 2017, Chief Judge Howell issued a search warrant fo
email account. Information recovered pursuant to those search warrants includes the following:
a.

On or about May 15, 2016,

emailed CORSI: "Here is my

flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
that, "May meet Manafort -guarantee nothing."
b.

On or about May 18, 2016, CORSI emailed STONE at Target Account 1

with the title, "Roger -- why don't you look this over before I send i

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
c.

On July 25, 2016, STONE, using Target Account 1, sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange

16

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 24 of 61

[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
d.

On or about July 3I,2016, STONE, using Target Account 1, emailed

CORSI with the subject line, "Call me MON." The body of the email read:

should see

should find Bernie [S]anders brother who called Bill a Rapist- turn him for

Assange[.]
Trump[.]

should find
e.

or more proof of Bill getting kicked out."

As noted above, on or about August 2, 2016 (approximately 19 days

before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
f.

On or about August 5, 2016,

an associate of STONE's,

emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the
17

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 25 of 61

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting ASSANGE. STONE tol

he was joking and

had not actually met ASSANGE. 2
g.

On or about August 15, 2016, CORSI emailed STONE at Target Account

1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not

over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
h.

On or about August 31, 2016, CORSI emailed STONE at Target Account

1: "Did you get the PODESTA writeup." STONE replied "[y]es."

i.

On or about August 31, 2016, CORSI messaged STONE at Target

Account 3, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra

scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."

J.

On or about September 6, 2016, CORSI emailed STONE at Target

Account 1: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

k.

On or about September 24, 2016,

emailed CORSI, "I will

have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,

18

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 26 of 61

"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you

are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
posted about file[.]" ln a subsequent meeting with investigators

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
I.

On or about October 3, 2016, an associate of STONE emailed STONE at

Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,

"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
m.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
n.

On or about October 4, 2016, CORSI messaged STONE at Target

Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total

BS hype."

19

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 27 of 61

o.

That same day, BANNON emailed STONE at Target Account 2, "What

was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer

is a

big democrat."
p.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released
38.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood' and NBC for reaction."
39.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE which STONE did not answer.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-wason/2016/10/07/3 ld74714-8ce5-1 Ie6-875e-2cl bfe943b66_story.html

20

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 28 of 61

40.

At approximately I I :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
41.

At approximately I :42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
42.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
43.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
44.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
of next dump focus, setting stage for Foundation debacle."
45.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target

Account 2, forwarded

message to CORSI without comment. STONE does not appear

to have forwarded the email to any other individual.

H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
46.

On or about October 8, 2016, STONE, using Target Account 3, messaged

CORSI, "Lunch postponed-have to go see T." CORSI responded to STONE, "Ok. I
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 29 of 61

a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
speech comments, attacking bad job numbers."
47.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
the Clintons through the Clinton Foundation."
49.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50.

On or about Thursday, October 13, 2016, CORSI emailed STONE at Target

Account 2: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
22

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 30 of 61

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.J The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
51.

On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent

STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how much money did

a controversial Russian billionaire investor with

ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by

with the money transferred via Deutsche

Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52.

On or about October 14, 2016, CORSI sent a message to STONE at Target

Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 31 of 61

53.

On or about October 17, 2016, CORSI messaged STONE at Target Account 3,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54.

On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1

and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted

source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offT.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55.

On or about October 18, 2016, CORSI messaged STONE at Target Account 3,

"Pls call. Important."
56.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
57.

On or about November 8, 2016, the United States presidential election took place.

24

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 32 of 61

58.

On or about November 9, 2016, CORSI messaged STONE at Target Account 3,

"Congratulations, Roger. He could not have done it without you."
59.

On or about November I 0, 2016, CORSI messaged STONE at Target Account 3,

"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
Have some interesting news for you."

25

 Case Document 29-14 Filed 04/28/20 Page 33 of 61

 

Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 34 of 61

J. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks
61.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic asse1tions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the ban-el. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta' s email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 35 of 61

I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
. Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
62.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.

Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only refe1Ting to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
63.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an miicle on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."

K. STONE's Use of Target Account 3 to Message Randy CREDI CO about STONE's
"Back channel"

28

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 36 of 61

64.

On November 19, 2017, Randy CREDICO (who, as described further below,

STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE on Target
Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the

fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDlCO responded, "Ha ha."
65.

On or about November 21, 2017, CRED ICO messaged STONE on Target

Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a

subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?"
66.

On or about November 24, 2017, STONE, using Target Account 3, texted

CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "Itold
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuffl.] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"

29

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 37 of 61

67.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on November 24, 2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is
no back Channel. So now you can relax."
68.

On or about November 28, 2017, CREDI CO tweeted a copy of a subpoena he

received from HPSCT that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that, "Credico merely []
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
70.

On or about December 1, 2017, CREDICO messaged STONE on Target

Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.

30

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 38 of 61

you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you 're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify[.]"
71.

STONE and CREDICO continued to message each other on or about December I,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
72.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73.

STONE and CREDICO continued to exchange messages via Target Account 3,

and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
show[.] That was my initial contact."
31

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 39 of 61

74.

On or about January 8, 2018, CREDI CO messaged STONE on Target Account 3

stating: "Embassy logs ... + 17 other pieces of information prove that r did not have any
conversations with Assange until September of last year."
75.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee . .. But you' 11 get off because you' re friends with Trump so don't worry. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
of 2016 to prove it[.]"
76.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
. from you," referring to CREDICO's therapy dog. CREDICO stated that it was "ce1iainly scary .
. . When you start bringing up my dog, you're crossing the Jine[.]" 5
77.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dogl 359 l l370.html

6

https ://www.motherjones.com/politics/20 18/05/ro ger-stone-to-associate-prepare-to-d ie/

32

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 40 of 61

He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
L. STONE's Use of the Target Accounts to Communicate with Individuals Related to
the Investigation

78.

On May 17, 2018 , Ghief Judge Howell issued an order for the use of pen-trap

devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use

Target Account 1 and Target Account 2, and that he has used them to communicate with
individuals related to the investigation.
79.

For example, STONE and

communicated twice on May 28 and May

29, 2018 using Target Account 1.

, a former associate of STONE's, was

interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that
and STONE communicated multiple times on May 5, 2018, and STONE
communicated wit

using Target Account 1 on June 1, 2018 and June 6, 2018

a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described fmther below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
July 12, 2018.
80.

STONE has also used Target Account 2 to communicate with individuals

associated with this investigation.
a.

For example, between May 23, 2018 and the present, STONE and CORSI

exchanged at least five messages using Target Account 2. In the same time period, STONE
exchanged at least 75 emails with CREDICO using Target Account 2.

33

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 41 of 61

b.

Also in this same time period, STONE emailed

ten times using Target Account 2.
2018, FBI agents approache

at least

is a former employee of STONE. On May 9,
and

That day,

and again on May 10, 2018

communicated by phone with

STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
wit

using Target Account 2. In addition, between on or about June 14,2018 and

June 17, 2018

81.

and STONE exchanged five emails using Target Account 2.

STONE has also used a phone number associated with Target Account 3 to

communicate with

a private investigator hired by STONE.

was

interviewed by investigators on June 7, 2018, and subsequently informed investigators that in
June 2018, STONE instructed him to conduct a full background investigation on
who had been employed by STONE during the Campaign as an information technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary form of communication with STONE is by text
message on Target Account 3.

BACKGROUND CONCERNING EMAIL
82.

In my training and experience, I have learned the Providers provide a variety of

on-line services, including electronic mail ("email") to the public. The Providers allow

34

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 42 of 61

subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
83.

In my training and experience, email Providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
84.

In my training and experience, email Providers typically retain certain

transactional information about the creation and use of each account on their systems. This
info1mation can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
35

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 43 of 61

(such as logging into the account via the Providers ' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
85.

In my training and experience, in some cases, email account users will

communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
86.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 44 of 61

info1mation maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them from law enforcement).
87.

In my training and experience, information such as search history can help to

show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.

INFORMATION REGARDING APPLE ID AND iCLOUD 7

The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/ privacy/docs/lee.al-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.app le.oom/en-us/HT203993; "iCloud," available at http://www.appl e.com/icloud/; "What
does iCloud back up?," available at https://supporl.apple.com/kb/PH125 l9; "iOS Security," available at

37

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 45 of 61

88.

Apple is a United States company that produces the iPhone, iPad, and iPod

Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
89.

Apple provides a variety of services that can be accessed from Apple devices or,

in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a.

Apple provides email service to its users through email addresses at the

domain names mac.corn, me.com, and icloud.com.
b.

iMessage and FaceTime allow users of Apple devices to communicate in

real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
c.

iCloud is a file hosting, storage, and sharing service provided by Apple.

iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
d.

iCloud-connected services allow users to create, store, access, share, and

synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user

https://"1ww.apple.com/business/docs/iOS Security Guide.pd£, and "iCloud: How Can I Use iCloud?," available at
l1t1ps://supporl.npple.com/kb/PH26502.

38

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 46 of 61

to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize boolanarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
e.

Game Center, Apple's social gaming network, allows users of Apple

devices to play and share games with each other.
f.

Find My iPhone allows owners of Apple devices to remotely identify and

track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
g.

Location Services allows apps and websites to use information from

cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
h.

App Store and iTunes Store are used to purchase and download digital

content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.

39

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 47 of 61

90.

Apple services are accessed through the use of an "Apple ID," an account created

during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91.

An Apple ID takes the form of the full email address submitted by the user to

create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
92.

Apple captures information associated with the creation and use of an Apple ID.

During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.

40

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 48 of 61

93.

Additional information is captured by Apple in connection with the use of an

Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94.

Apple also maintains information about the devices associated with an Apple ID.

When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.

41

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 49 of 61

95.

Apple provides users with five gigabytes of free electronic space on iC[oud, and

users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
96.

In my training and experience, evidence of who was using an Apple ID and from

where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED

42

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 50 of 61

97.

I anticipate executing this warrant under the Electronic Communications Privacy

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items clescribed in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.

CONCLUSION
98.

Based on the forgoing, I request that the Court issue the proposed search warrant.

99.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
100.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Res~
Andrew M i t c h e l l ~
Special Agent
Federal Bureau of Investigation
43

~

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 51 of 61

Subscribed and sworn to before me on this

i!~
lf

August, 2018.

k//~fdttt7~
fe
1

The Honora Ber; l A. Howell
Chief United States District Judge

44

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 52 of 61

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the email address:

created or maintained between September 11, 2017 and pr~sent, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered
at One Microsoft Way, Redmond, WA 98052.

45

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 53 of 61

ATTACHMENT B
Particular Things to be Seized
I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section LA. above;
c; All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section LA,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f.

Records or other information regarding the identification of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,

g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;

46

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 54 of 61

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S .C. § 3 (accessory after the fact) , 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June I,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual

c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

47

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 55 of 61

ATTACHMENT D
Particular Things to be Seized

I.

Files and Accounts to be produced by Google, Inc.

To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b.
All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c.

All internet search data including all queries and location data;

d.
All transactional information of all activity of the account described above
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e.
All records or other information stored by an individual using the account,
including address books, contact and buddy lists, calendar data, pictures, and files;
f.
All records or other information regarding the identification of the account
described above in Section I.A, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g.
All records indicating the services available to subscribers of the
electronic mail address described above in Section I.A.;
h.
Google+ subscriber information, circle information, including name of
circle and members, contents of posts, comments, and photos, to include date and
timestamp;
50

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 56 of 61

i.

Google Drive files created, accessed or owned by the account;

J.
YouTube subscriber information, private videos and files, private
messages, and comments;

k.
Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;

1.
account.

Google Talk and Google Hangouts conversation logs associated with the

51

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 57 of 61

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); ·1s U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
, Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1..

All existing printouts from original storage which concern the categories identified in
subsection II.a
52

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 58 of 61

ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:

created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.

53

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 59 of 61

ATACHMENTF
Particular Things to be Seized

I.

Files and Accounts to be produced by the Provider:

To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(£), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
a.
All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
b.
All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEi");
c.
The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d.
The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 60 of 61

e.
The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCJoud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and book.marks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and book.marks;
f. .
All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g.
All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
h.

All records pertaining to the types of service used;

i.
All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and
j.
. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).

55

 Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 61 of 61

II.

Information to be Seized by Law Enforcement Personnel

Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U .S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of_justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created, used, or
communicated with the account or identifier concerning the messages identified above,
including records about their identities and whereabouts;
e. Evidence of the times the account was used;
f.

All images, messages and communications regarding wiping software, encryption or
other methods to avoid detection by law enforcement;

g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

i.

All existing printouts from original storage which concern the categories identified in
subsection II.a
56

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 1 of 48

AO 93 (Rev l l/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY GOOGLE

)
)
)
)
)
)

Case: 1 :18-sc-02595
Ass!gned To : Howell, Beryl A.
Assign. Date : 8/8/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

r/

YOU ARE COMMANDED to execute this warrant on or before
August 21, 2018
(not to exceed 14 days)
in the daytime 6:00 a.m. to 10:00 p.m.
D at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell , Chief U.S. District Judge
(United States Magistrate Judge)

D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriale box)
D for _ _ days (not to exceed 30) D until, the facts justifying, the later specific date of

Date and time issued
City and state:

~/
Washington, DC

~/

j

cl-} ~Df"1

- - - - - - - - - - -- - -

:Judge 's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 2 of 48

AO 93 (Rev, l l/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 3 of 48

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 4 of 48

ATTACHMENT B
I.

Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(±), Google is required to disclose the following
information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 5 of 48

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

1.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);

J.

All Google Developers Console information associated with the account;

k.

All Minutemaid information associated with the account;

1.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All YouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive information associated with the account;

s.

All Google+ information associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 6 of 48

Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEi")); and
u.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 7 of 48

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or acces~ to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 8 of 48

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s}-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 9 of 48
AO 106 (Rev. 04/10) Application for a Search Warrant

D

UNITED STATES D ISTRICT C OURT

AUG.. 8 2018

for the
District of Columbia
In the Matter of the Search of

5·

(Briefly describe the prop erty to be searched
or identify the person by nam e and address)

IN FORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY GOOGLE

l

CJ.rk, U.S. District and
01nkrupt · · ~

Case: 1: 18-sc-02595
Assigned To: Howell, Beryl A
Assign. Date : 8/8/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a fed eral law enforcement officer or an attorney for the government, request a searc h warrant and state under
penalty of pe1jw·y that I have reason to bel ieve that on the following person or property (idrmrify /he p erson or describe the
property to be searched and give its location) :

See Attachment A
located in the

- - - Northern
- - ---

District of

person or describe the property to be seized) :

California
---- --- -- - -

, there is now concealed (identify the

See Attachment B

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):

~ evidence of a crime;

ref contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 u.s.c. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts :
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attache heet.

Reviewed by AUSA/SAUSA:
jl<yle R. Freeny (ASC)

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

Date

~/LhJ!J

City and state: Washington, D.C.

Judge's signature

Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 10 of 48

FILE
AUG -8 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

Clerk, U.S. District and
Bankruptcy Courts

Ca~e: 1: 18-sc-02595
Ass!gned To : Howell, Beryl A
Ass,g~. ~ate: 8/8/2018
.
Descnpt,on: Search & S .
e1zure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the Google account

("Target

Account"), stored at premises owned, maintained, controlled or operated by Google, LLC
("Google"), a company headquartered in Mountain View, California. The information to be
disclosed by Google and searched by the government is described in the following paragraphs and
in Attachments A and B.
2.

I am a Special Agent with the Federal Bureau of Investigation (FBI), and have

been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

,Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
-: 1-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 11 of 48

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121 (a)(I )(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U .S.C.

§ 271 I (3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,

-2-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 12 of 48

STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome CORSI
7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 13 of 48

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these tyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 14 of 48

12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to mbve the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016

-5-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 15 of 48

presidential election, including conspiracy to commit authorized access to protected computers.

See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:l 8-cr-00125).

C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
19.

On June 14, 2016, Crowd Strike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[tJhe main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."

In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"

-6-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 16 of 48

aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and

-7-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 17 of 48

[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday@HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.

-8-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 18 of 48

33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
th.ought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter

-9-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 19 of 48

account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 20 of 48

issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June I 0, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address

. On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONE's

l addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

s email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

emailed CORSI: "Here is my flight

On or about May 15, 2016,

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at
CORSI that, "May meet Manafort -guarantee nothing."
-11-

who replied to

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 21 of 48

43.

On or about May 18, 2016, CORSI emailed STONE

with the title, "Roger -- why don't you look this over before I send

" I believe that
. CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, usin

, sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, usin

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.]
Trump[.]
46.

, emailed
h should see

should find Bernie [S]anders brother who called Bill a Rapist - turn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --

-12-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 22 of 48

neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

, an associate of STONE's, emailed

On or about August 5, 2016

STONE

. The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SAN GE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

On or about August 15, 2016, CORSI emailed STONE at
: "Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
49.

On or about August 31, 2016, CORSI emailed STONE at
: "Did you get the PODESTA writeup." STONE replied "[y]es."

-13-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 23 of 48

50.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Y anukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
51.

On or about September 6, 2016, CORSI emailed STONE at
: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

52.

On or about September 24, 2016

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today.

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't ~ait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
53.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."

-14-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 24 of 48

54.

On or about October 4, 2016, AS SAN GE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
55.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
56.

That same day, BANNON emailed STONE a

, "What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye

is a big

democrat."
57.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

-15-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 25 of 48

58.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn 't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
59.

According to phone record

, at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
61.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
62.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
63.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
64.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE using

, "I expect

that much of next dump focus, setting stage for Foundation debacle."

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/31 d74714-8ce5-l l e6-875e-2cl bfe943b66_story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 26 of 48

65.

At approximately 6:27P

L, an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
, forwarded

s message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

66.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed -

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
67.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

using

emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

, with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
-17-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 27 of 48

"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
69.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via t
70.

l Account, "Got them and used them."

On or about Thursday, October 13, 2016, CORSI emailed STONE at
: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
lik

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Onc
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email a

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I

-18-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 28 of 48

have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money di

, a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent b

, with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
74.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. lf HRC wins, Assange can

-19-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 29 of 48

kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
75.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
76.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
77.

On or about November 8, 2016, the United States presidential election took place.

78.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
79.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-20-

 Case Document 29-15 Filed 04/28/20 Page 30 of 48

 

Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 31 of 48

t

STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks
87.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing"was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,

-22-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 32 of 48

such asse11ions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
88.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confamed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
89.

In the month that followed his testimony before HP SCI, on or about October 24,

2017, STONE published an ai1icle on his website, stonecoldtruth.com, titled "Is it the Podesta's

-23-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 33 of 48

Time in the Barrel Yet?" In that article, STONE stated: "[J]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
90.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
91.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
92.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me . It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't

-24-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 34 of 48

interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
guess Schiff will try to get one of us indicted for perjury[.]"
93.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
94.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
95.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely []
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June i2, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credi co never said he knew or had any information as to source or
content of the material."
96.

On or about December 1, 2017, CREDI CO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for petjury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-25-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 35 of 48

wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of petjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back .. ·. and amend your testimony and tell them the truth." CREDI CO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
97.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
98.

On or about December 13, 2017, according to public reporting, CREDI CO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
99.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDI CO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an

-26-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 36 of 48

email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
100.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year."
101.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
102.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you sta11 bringing up my dog, you're crossing the line[.]" 5
103.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the a11icle, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stonethreatened-dog-135911370.html
6

https ://www .motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-27-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 37 of 48

He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.

K. The Target Account
104.

According to subscriber records obtained from Google, Target Account
was created on October 27, 2015, in the name o

" The recovery email for the Target Account is STONE'

l account,

. Subscriber records obtained in approximately August 2018 indicate
that the last login to the Target Account occurred on May 17, 2018.
105.

According to subscriber records obtained from Facebook, Target Account
was used to register a Facebook account in the name o
which was created on October 27, 2015, with the verified telephone numbe

According to a public records database, the telephone numbe

is linked

t
106.

was voluntarily interviewed by investigators from the Special

Counsel's Office on or about Friday, May 18, 201

told investigators that he

became STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as
STONE's right-hand man. According to

STONE utilized the services of several

individuals to post social media content to Facebook and Twitter, and that he
STONE both instructed these individuals about what to post.

) and

stated that he

purchased a couple hundred fake Face book accounts as part of this work (including both new
and existing accounts), and that bloggers working for STONE would try to build what looked
like real Facebook accounts. 7

7

further stated that STONE wanted to push out

Face book requires that all users of Facebook accounts use their actual name while registering
-28-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 38 of 48

WikiLeaks content through his Facebook and Twitter accounts, and that content related to the
stolen Podesta emails was pushed out through STONE's Facebook and Twitter accounts.
107.

On or about August 2, 2018, Chief Judge Howell issued a search warrant for the

Facebook account registered to Target Accou

. (1: 18-sw-

2570).
108.

Search warrant returns for STONE's Hotmail account contain a number of emails

that appear to have been sent to Target Accoun

from various

entities, including Facebook and Twitter. Although it is not clear from the face of the emails
how they ended up in STONE

l account, 8 they may have been auto-forwarded or

otherwise imported from the Target Account into th

l account. These emails include at

least one receipt sent on or about June 30, 2016, from Facebook to the Target Account for a
Facebook advertisement, which was then forwarded from STONE

account to

Google account. 9 They also include several emails sent from
to the Target Account in early 2017.
BACKGROUND CONCERNING GOOGLE

109.

In my training and experience, I have learned that Google provides a variety of on-

line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers

and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
8
9

Investigators have been unable to access the full headers for these emails.
told investigators that he would sometimes send emails from STONE's account.
-29-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 39 of 48

obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account's
user or users.
110.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
111.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in

(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the

-30-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 40 of 48

account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
112.

In my training and experience, in some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user ::is ::i
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
113.

This application seeks a warrant to search all responsive records and information

under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google's possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.
114.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or

-31-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 41 of 48

alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt

(e.g., deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES
115.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and

-32-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 42 of 48

other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
116.

Based on the forgoing, I request that the Court issue the proposed search warrant.

117.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
118.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

~ape ~

Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation
Subscribed and sworn to before me on thief' day of August, 2018.

6//W

The Honorable Beryl A. Howell
Chief United States District Judge

-33-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 43 of 48

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 44 of 48

ATTACHMENTB
I.

Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 45 of 48

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

i.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usernames and email accounts associated with them);

J.

All Google Developers Console information associated with the account;

k.

All Minutemaid information associated with the account;

I.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All Y ouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive information associated with the account;

s.

All Google+ information associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 46 of 48

Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEi")); and
u.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 47 of 48

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange

, Julian
, Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 48 of 48

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 1 of 50
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY TWITTER

)
)
)
)
)
)

Case: 1: 18-sc-02596
Assigned To : Howell, Beryl A.
Assign. Date : 8/8/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 21, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United Stales Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

----~

Date and time issued:

City and state:

Washington, DC

/~ -- /?'/7~~/

Judge 's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 2 of 50
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No .:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized :

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 3 of 50

ATTACHMENT A

Property to be Searched
This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 4 of 50

ATTACHMENT B
I.

Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
information to the government for each account listed in Attachment A:
A.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

B.

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

C.

All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;

D.

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

E.

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the usemame associated with the account (i.e., "mentions" or "replies");

F.

All photographs and images in the user gallery for the account;

G.

All location data associated with the account, including all information collected by the
"Tweet With Location" service;

H.

All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

I.

All data and information that has been deleted by the user;

J.

A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);

K.

A list of all users that the account has "unfollowed" or blocked;

L.

All "lists" created by the account;
-2-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 5 of 50

M.

All information on the "Who to Follow" list for the account;

N.

All privacy and account settings;

0.

All records of Twitter searches performed by the account, including all past searches saved
by the account;

P.

All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;

Q.

All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

R.

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

S.

All data and information associated with the profile page, including photographs;

T.

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;

U.

The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;

V.

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

W.

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
information regarding the types of devices used to access the account;

X.

All activity logs for the account;

Y.

All location information for the account, including all location data collected by any
plugins or widgets;

Z.

The types of service utilized by the user;
-3-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 6 of 50

AA.

All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;

BB.

All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;

CC.

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

DD.

All data and information that has been deleted by the user;

EE.

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

FF.

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

GG.

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identifier;

HH.

Information regarding accounts linked to accounts to which the Target Accounts are linked;

II.

All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
-4-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 7 of 50

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 8 of 50

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 9 of 50
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia

FILED
AUG .. 8 2018
Clerk, U.S.

District and

Bankrupt.C¥i;lOIU~.:-::-~~

In the Matter of the Search of

)

~

(Briefly describe the property lo be searched
or identify the person by name and add1·es~~

)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY TWITTER

)
)

Case: 1:18-sc-02596
Assigned To : Howell , Beryl A.
Assign. Date: 8/8/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal Jaw enforcement officer or an attorney for the government, request a search wanant and state under
penalty of pe1jury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the

- - -Northern
- - -- -

District of

person or describe the property to be seized):

See Attachment B

---- -California
-- -- - --

, there is now concealed (identify the

'

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):

ri evidence of a crime;
ri contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 U.S .C. §§ 1001, 1030, 371

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

See Affidavit for add'I
The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0

z-~

Delayed notice of _ _ days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on

Reviewed by A USA/SA USA:
jKyle R. Freeny (ASC)

) is requested

Applicant's signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

---- 4,t;,u~
City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 10 of 50

FILE D
IN THE UNITED STATES DISTRICT COURT
F R TI-IB !STRICT OF OLUMBIA
IN THE MATIER F 1 J' SEARCH OF
INFORMATION A S CIATED WITH
ONE ACCOUN1 STORED AT PREMISES
CONTROLLED BY TWITTER

AUG -8 201B
Clertc, U.S. District and
Bankrupt~y Cour-t

Case: 1:18- sc- 02596
Ass!gned To : Howell, Beryl A.
Assrgn. Date : 8/8/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Twitter account

("Target Account"), stored

at premises owned, maintained, controlled or operated by Twitter, Inc. ("Twitter"), a company
headquartered in San Francisco, California. The information to be disclosed by Twitter and
searched by the government is described in the following paragraphs and in Attachments A and B.
2.

I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have

been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
-1-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 11 of 50

U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.
JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals

i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

-2-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 12 of 50

7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

B.

Russian Government-Backed Hacking Activity During the 2016, Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

-3-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 13 of 50

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

-4-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 14 of 50

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November I, 2016, individuals associated with the GRU

spearphished over I 00 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.

See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).

C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to

-5-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 15 of 50

Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days

-6-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 16 of 50

later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."

-7-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 17 of 50

28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October I, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday @HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' 10-year anniversary celebration - STONE told lnfowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I

-8-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 18 of 50

think there's at least a reasonable belief that (Assange] may have passed this information on to
(STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-9-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 19 of 50

to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

-I 0-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 20 of 50

40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSI's Communications with STONE
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE'

address

. On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONE'

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant fo

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at

, who replied to

CORSI that, "May meet Manafort -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE a

with the title, "Roger -- why don't you look this over before I send i

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
-11-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 21 of 50

44.

On July 25, 2016, STONE, usin

, sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

, emailed

CORSI with the subject line, "Call me MON." The body of the email read
Assange[.]
Trump[.]
46.

should see

should find Bernie [S]anders brother who ·called Bill a Rapist - tum him for
or more proof of Bill getting kicked out."

should find

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSJ's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.
STONE at

On or about August 5, 2016,

an associate ofSTONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal

-12-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 22 of 50

Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE
that in 2018

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SAN GE. STONE tol

he was joking and

had not actually met ASSANGE. 2
48.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
49.

On or about August 31, 2016, CORSI emailed STONE at
: "Did you get the PODESTA writeup." STONE replied "[y]es."

50.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
51.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

-13-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 23 of 50

52.

On or about September 24, 2016

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
53.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
54.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.

-14-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 24 of 50

55.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
56.

That same day, BANNON emailed STONE a

, "What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye

is a big

democrat."
57.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
58.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /31d74714-8ce5-11 e6-875e-2c 1bfe943b66_story.html
-15-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 25 of 50

59.

According to phone record

a, at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
61.

At approximately l :42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
62.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
63.

At approximately 4:00PM, the Washington Post published a story regarding the

~ccess Hollywood tape.
64.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE usin

, "I expect

that much of next dump focus, setting stage for Foundation debacle."
65.

At approximately 6:27PM

, an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.

-16-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 26 of 50

G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

66.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
67.

On or about Wednesday, October 12, 2016, at approximately 8: 17AM, STONE,

usin

emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

, with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
69.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."

-17-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 27 of 50

70.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
skimmed maybe billions off Skolkovo-Skolkovo kept their money with

like

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to.post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

-18-

with the money

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 28 of 50

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[ .]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
74.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
75.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."

-19-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 29 of 50

76.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
77.

On or about November 8, 2016, the United States presidential election took place.

78.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
79.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-20-

 Case Document 29-16 Filed 04/28/20 Page 30 of 50

 

Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 31 of 50

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks

87.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21 , 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
-22-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 32 of 50

does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
info1mation proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
88.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confomed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
89.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
-23-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 33 of 50

J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
90.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
save the plan' ........Richard Nixon[.]" CREDI CO responded, "Ha ha."
91.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
92.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the UNC stutll.J 1just followed his tweetsl.J" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one of us indicted for perjury[.]"

-24-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 34 of 50

93.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
94.

On or about November 28, 2017, CREDI CO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
95.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
96.

On or about December 1, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if u don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of perjury[.] But I'm sure

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-25-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 35 of 50

that wasn't sworn testimony so you're probably clear[.]' Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied; "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
97.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
98.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
99.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would.do my show[.] That was my
initial contact."

-26-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 36 of 50

I 00.

On or about January 8,2018, CREDJCO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year."
101.

CREDI CO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
102.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
103.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.

5

https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stonethreatened-dog-l359113 70.html
6

https://www .motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-27-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 37 of 50

s Statements Regarding STONE's Use of Social Media

K.

104.

On or about Friday, May 18, 2018

S was voluntarily interviewed

by investigators from the Special Counsel's Office

told investigators that he became

STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
105.

According t

, STONE utilized the services of several individuals to

post social media content to Facebook and Twitter, and that he
instructed these individuals about what to post.

) and STONE both

stated that he purchased a couple

hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.
106.

further stated that STONE wanted to push out WikiLeaks content

through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
was pushed out through STONE's Facebook and Twitter accounts.
L. The Target Account

107.

The Target Account is a Twitter account with usemam

Search warrant returns for STONE's Hotmail account contain emails from Twitter about Target
which appear to have originally been sent to
. Although it is not clear from the face of the emails how they
ended up in STONE's Hotmail account, 7 they may have been auto-forwarded or otherwise
imported from

7

to the Hotmail account. Subscriber records

Investigators have been unable to access the full headers for these emails.
-28-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 38 of 50

obtained from Google show th

, as the recovery account. 8

Hotmail address
108.

m was registered using STONE's

Tweets associated with the Target Account, which are publicly available, include

the retweeting of content related to WikiLeaks, STONE's testimony before the House
Intelligence Committee, and the hacking of the DNC. The Target Account was also used to
retweet content with the hashtag #FreeAssange! The Target Account is listed as having been
created in March 2016 and bears the picture of a person purporting to b
109.

In my training and experience, I know that, in addition to posting content and

purchasing advertisements, Twitter accounts can be used to communicate privately and directly
with other users through Twitter's direct messaging function. As noted above, STONE used at
least one other Twitter account, @RogerJStoneJr, to communicate with WikiLeaks and
ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING TWITTER

110.

Twitter owns and operates a free-access social-networking website of the same

name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a· photo of themselves, and location
information. Twitter also permits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
more detail below.
11 I.

Upon creating a Twitter account, a Twitter user must create a unique Twitter

usemame and an account password, and the user may also select a different name of 20

8

was also used to register a Facebook account. This Court
authorized a search of that Facebook account on or about August 2, 20 I 8 (I: 18-sw-2570).
-29-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 39 of 50

characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.
112.

Twitter asks users to provide basic identity and contact information, either during

the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
113.

A Twitter user can post a personal photograph or image (also known as an

"avatar") to his or her profile, and can also change the profile background or theme for his or her.
account page. In addition, Twitter users can post ·"bios" of 160 characters or fewer to their profile
pages.
114.

Twitter also keeps IP logs for each user. These Jogs contain information about the

user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
115.

As discussed above, Twitter users can use their Twitter accounts to post "Tweets"

of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"

-30-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 40 of 50

the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
of all "mentions" and "replies" for that username ).
116.

Twitter users can include photographs or images in their Tweets. Each Twitter

account also is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
117.

Twitter users can also opt to include location data in their Tweets, which will

reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.
118.

When Twitter users want to post a Tweet that includes a link to a website, they

can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
119.

A Twitter user can "follow" other Twitter users, which means subscribing to

those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously

followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.

-31-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 41 of 50

120.

In addition to posting Tweets, a Twitter user can also send Direct Messages

(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular user, but older DMs are stored on Twitter's database.
121.

Twitter users can configure the settings for their Twitter accounts in numerous

ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
will not be sent to the user'~ phone.
122.

Twitter includes a search function that enables its users to search all public

Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
123.

Twitter users can connect their Twitter accounts to third-party websites and

applications, which may grant these websites and applications access to the users' public Twitter
profiles.
124.

If a Twitter user does not want to interact with another user on Twitter, the first

user can "block" the second user from following his or her account.
125.

In some cases, Twitter users may communicate directly with Twitter about issues

relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user

-32-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 42 of 50

for breaching Twitter's terms of service, during which time the Twitter user will be prevented
from using Twitter's services.
126.

As explained herein, information stored in connection with a Twitter account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, profile contact information, communications,
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
automatically added to "tweeted" communications. This geographic and timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates

-33-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 43 of 50

to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal
evidence from law enforcement).
127.

Therefore, the computers of Twitter are likely to contain all the material described

above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other account
information.

FILTER REVIEW PROCEDURES
128.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
129.

Based on the forgoing, I request that the Court issue the proposed search warrant.

130.

Pursuant to 18 U .S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
131.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not

-34-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 44 of 50

known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Andrew Mitchell
Special Agent
Federal Bureau of Investigation
Subscribed and sworn to before me on ~hist~ day of August, 2018.

~!fA;qp
The Honorable Beryl A. Howell
Chief United States District Judge

-35-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 45 of 50

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 46 of 50

ATTACHMENT B
I.

Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession;

custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following
information to the government for each account listed in Attachment A:
A.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

B.

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

C.

All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;

D.

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

E.

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");

F.

All photographs and images in the user gallery for the account;

G.

All location data associated with the account, including all information collected by the
"Tweet With Location" service;

H.

All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

I.

All data and information that has been deleted by the user;

J.

A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);

K.

A list of all users that the account has "unfollowed" or blocked;

L.

All "lists" created by the account;
-2-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 47 of 50

M.

All information on the "Who to Follow" list for the account;

N.

All privacy and account settings;

0.

All records of Twitter searches performed by the account, including all past searches saved
by the account;

P.

All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;

Q.

All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

R.

All past and current usemames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

S.

All data and information associated with the profile page, including photographs;

T.

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;

U.

The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;

V.

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

W.

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
information regarding the types of devices used to access the account;

X.

All activity logs for the account;

Y.

All location information for the account, including all location data collected by any
plugins or widgets;

Z.

The types of service utilized by the user;
-3-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 48 of 50

AA.

All information about the account's use of Twitter' s link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;

BB.

All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;

CC.

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

DD.

All data and information that has been deleted by the user;

EE.

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

FF.

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

GG.

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
identifier, or any other account or device identifier;

HH.

Information regarding accounts linked to accounts to which the Target Accounts are linked;

II.

All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
-4-

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 49 of 50

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5 -

 Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 50 of 50

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s );

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)--who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 1 of 33
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)
)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES CONTROLLED BY 1&1 MAIL
& MEDIA, INC.

)
)
)

Case: 1: 18-sc-02670
Assigned To: Howell, Beryl A.
Assign. Date : 8/20/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Eastern
District of
Pennsylvania
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
September 3, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Rudolph Contreras-, U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

if_dJ!J(J.&18 3: l?t t'\L
Washington, DC

/

Judge 's signature

Hon. Rudolph Contreras, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 2 of 33

AO 93 (Rev. l l/13) Search and Seizure Warrant (Page 2)

Return

Case No. :

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 3 of 33

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following l&I Mail account, whic;h
is stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, Inc., a
company headquartered i~ Chesterbrook, Pennsylvania:

-1-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 4 of 33

ATTACHMENT B

I.

Information to be disclosed by l&l Mail

To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the ac.count, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 5 of 33

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

1.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
j.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

-3-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 6 of 33

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
and 52 U.S.C. § 30121 (foreign contribution ban), including:
a.

Evidence of unauthorized access to protected computers;

b.

Evidence of the distribution or transfer of data obtained through unauthorized
access to protected computers;

c.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

d.

Evidence indicating the account owner's state of mind as it relates to the crimes
under investigation;

e.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

f.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

g.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

-4-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 7 of 33

h.

Communications, recorqs, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

i.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

J.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign

-5-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 8 of 33
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describa the property to be searched
or identify the person by name and oddres!i)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES CONTROLLED BY 1&1 MAIL &
MEDIA, INC.

l
)

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1:18-sc-02670
Ass!gned To : Howell, Beryl A.
Assign. Date: 8/20/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement offi cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A

located in the

Eastern

-------

District of

Pennsylvania

----"--''--"-...c...r...;_..:....:.._;~- - -

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
evidence of a crime;

M
Mcontraband, fruits of crime, or other items illegally possessed;

~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section

u.s.c. § 30121
18 u.s.c. §§ 1030, 371
52

Offense Description
Foreign Contribution Ban
Unauthorized Access of Protected Computer, Conspiracy

See Affidavit for add'I

The application is based on these facts :
See attached Affidavit.

~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ __ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC)

Patrick J. Myers, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

er

City and state: Washington, D.C.

Hon. Rudolph Contreras, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 9 of 33

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY l&l MAIL & MEDIA,
INC.

AUG 2o20'8
Clerk. U.S. District & Bankruptcy
Courts for thil Oiatriat af r ·
a

Case: 1 :18-sc-02670
Assigned To: Howell, Beryl A.
Assign. Date: 8/20/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

("Target Account"), stored at

information associated with the account

premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("1&1 Mail"), a
company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed by 1& 1
Mail and searched by the government is described in the following paragraphs and in Attachments
A and B.
2.

I am a Special Agent with the Federal Bureau of Investigation ("FBI") assigned to

FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

-1-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 10 of 33

4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 951 (acting as an unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of
a protected computer), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban).
There also is probable cause to search the information described in Attachment A for evidence,
contraband, fruits, and/or instrumentalities of the Subject Offenses, further described in
Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

PROBABLE CAUSE
A.

Russian Government-Backed Hacking Activity during the 2016 Presidential
Election
6.

On June 14, 2016, the cybersecurity firm CrowdStrike, Inc. and its affiliates

("CrowdStrike") published a blog post entitled, "Bears in the Midst: Intrusion into the

-2-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 11 of 33

Democratic National Committee." 1 In the blog post, CrowdStrike described how the firm "was
called by the Democratic National Committee (DNC), the formal governing body for the US
Democratic Party, to respond to a suspected breach." According to CrowdStrike, the cyber actor
known as "Fancy Bear" breached the DNC network in 2016. CrowdStrike further assessed:
"Extensive targeting of defense ministries and other military victims [by FANCY BEAR] has
been observed, the profile of which closely mirrors the strategic interests of the Russian
government, and may indicate affiliation with f'nasttoe Pa:rne,ri:hrnaTeJihHoe Yrrpasnem1e (Main
Intelligence Department) or GRU, Russia's premier military intelligence service."
7.

Starting in or around mid-2016, published reports also detailed attempts to

compromise both the work and personal email accounts of numerous individuals involved in the
2016 U.S. presidential campaign through "spearphishing" efforts. In this context, spear phishing
refers to the fraudulent practice of sending an email that purports to be from a known or trusted
sender in order to induce the targeted victim to respond in a desired manner, typically by clicking
a malicious link or URL. The perpetrators used Bitly, a link-shortening and management service,
to disguise the malicious URLs. Victims of these spearphishing efforts included John Podesta, the
chairman of the Clinton Campaign, who received a spearphishing email on or about March 19,
2016. The email contained a Bitly link created by the Bitly account john356gh, which the FBI has
linked to a known GRU officer.
8.

On or about September 20, 2016, Crowd Strike also identified a new intrusion into

the DNC's virtual private cloud, hosted by Amazon Web Services (AWS). CrowdStrike advised

1

"Bears in the Midst: Intrusion into the Democratic National Committee," June 14, 2016,
available at https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-nationalcommittee.
-3-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 12 of 33

the FBI that the perpetrators obtained unauthorized access to the DNC's VPC system through the
theft of an administrator credential, which gave the perpetrators the ability to modify the network's
security rules. After gaining this access, the perpetrators modified the rules that limited the
universe of devices that could connect to the victim computers.

Based on its forensic analysis,

CrowdStrike determined that the perpetrators copied snapshots of the DNC's cloud-based
computers onto at least three new AWS accounts created by the perpetrators.
9.

Following the inception of the spear phishing and intrusion campaigns, a series of

overlapping actors began to be release documents stolen from the DNC, DCCC, and the personal
email accounts of campaign-affiliated individuals. Release of these stolen documents principally
occurred through three forums: (1) a series of accounts operated under the online persona
"Guccifer 2.0"; (2) a website and series of accounts operated under the online persona "DCLeaks";
and (3) the websites and public archives operated by the group "Wikileaks." The releases of stolen
documents included confidential memoranda written by Democratic employees; strategy
documents discussing various components of the 2016 federal elections; and confidential
correspondences of the DNC and DCCC, as well as individuals involved in the presidential
campaign of Hillary Clinton.
10.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." 2 In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith .in the US
2

"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_20l 7_01.pdf.
-4-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 13 of 33

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
11.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
12.

With respect to hacking activity, the USIC assessed: "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
13.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
14.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
(Case No. 1:18-cr-00125).

-5-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 14 of 33

B.

Guccifer 2.0's Use of WikiLeaks to Further the Interference in the 2016 U.S.
Presidential Election

15.

On June 15, 2016, the day after CrowdStrike publicly attributed the DNC hack to

Russian government actors, the persona Guccifer 2.0 published its first post on a WordPress
blog, publicly claiming responsibility for the hack. The post, titled "GUCCIFER 2.0 DNC'S
SERVERS HACKED BY A LONE HACKER," contained a number of documents that Guccifer
2.0 represented as "docs I downloaded from the Democrats network." Guccifer 2.0 also stated in
the same post that, with respect to the documents stolen from the DNC, "[t]he main part of the
papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
16.

According to open source information, WikiLeaks is a self-described anti-secrecy

organization, which is responsible for releasing stolen documents from a number of government
and non-governmental entities. Julian Assange, an Australian citizen, founded WikiLeaks in or
around 2006, and he has stated in public interviews that he is deeply involved in running the
organization.
17.

On or about June 20, 2016, Guccifer 2.0 registered the Twitter account

@GUCCIFER_ 2. Search warrant returns for that Twitter account show that Guccifer 2.0
communicated via direct message with WikiLeaks' Twitter account, @wikileaks, about the stolen
DNC documents, including about ways to maximize the impact of the documents on the 2016
U.S. presidential election. For example, on or about June 22, 2016, WikiLeaks sent a private
message to Guccifer 2.0, via Twitter, telling Guccifer 2.0 to "[s]end any new material [stolen
from the DNC] here for us to review and it will have a much higher impact than what you are
doing." On or about July 6, 2016, WikiLeaks stated, "if you have anything hillary related we
want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National
Convention] is approaching and she will solidify Bernie supporters behind her after." Guccifer

-6-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 15 of 33

2.0 responded, "ok ... I see." WikiLeaks explained, "we think trump has only a 25% chance of
winning against Hillary ... so conflict between Bernie and Hillary is interesting."
18.

According to information obtained through a court-authorized search of the

Target Account conducted in or around August 2016, I know that on or about July 14, 2016,

Guccifer 2.0 sent WikiLeaks an email with an attachment titled "wk dnc linkl .txt.gpg." Search
warrant returns for the Guccifer 2.0 Twitter account show that Guccifer 2.0 then sent a direct
message to WikiLeaks that appears to explain that the encrypted file contained instructions on
how to access an online archive of stolen DNC documents. On or about July 18, 2016,
WikiLeaks confirmed it had "the 1Ob or so archive" and would make a release of the stolen
documents "this week."
19.

On or about July 22, 2016, WikiLeaks released over 20,000 emails and other

documents stolen from the DNC network. This release occurred approximately three days before
the start of the Democratic National Convention. WikiLeaks did not disclose Guccifer 2.0's role
in providing them.
20.

On or about October 7, 2016, WikiLeaks released the first set of emails that had

been stolen from John Podesta, chairman of the Clinton Campaign. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately thirty-three tranches
of documents that had been stolen from Podesta. Based on an assessment of the WikiLeaks
releases, investigators believe that the total amount of stolen election-related data released by
WikiLeaks was substantially greater than the 1GB of stolen data apparently contained in the
online archive provided by Guccifer 2.0, as described above.

-7-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 16 of 33

21.

In an August 2017 interview, AS SANGE indicated that only a small number of

people, including himself, worked on the release of the DNC emails. 3 Based on public source
information, I know that AS SANGE made false and misleading statements about the origins of
the stolen documents, including statements that insinuated that WikiLeaks had received them
from a recently-deceased DNC employee.
22.

Investigators have learned that WikiLeaks and/or ASSANGE communicated,

including via intermediaries, about the stolen documents with Roger J. Stone ("STONE"), who
advised the presidential campaign of Donald J. Trump in 2015 and who remained in contact with
individuals employed by the campaign through the 2016 election. For example, search warrant
returns for STONE's Hotmail account

, show that on or about July 25,

2016, STONE directed one of his associates, Jerome CORSI, to "[g]et to Assange [a]t the
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... ." On or about July
31, 2016, Stone reached out again to CORSI, suggesting that he should "see Assange." A few
days later, on or about August 2, 2016, CORSI emailed STONE, "Word is friend in embassy
plans 2 more dumps. One shortly after I'm back 2nd in Oct[ober]. Impact planned to be very
damaging .... " I believe that CORSl's reference to a "friend in [the] embassy" refers to
ASSANGE.

C.

The Target Account
23.

According to subscriber information obtained from WordPress in July 2016, the

Guccifer 2.0 WordPress account
the email addres

3

) was created on June 15, 2016 using
and Target Account

was listed as

See https://www.newyorker.com/magazine/2017/08/21/julian-assange-a-man-without-a-country
-8-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 17 of 33

another email address on the account. Subscriber records for the Target Account indicate that it
was created on July 23, 2016 in the name of "Guccifer Second."
24.

The FBI searched the Target Account in approximately August 2016 pursuant to

a search warrant authorized by the Northern District of California. In approximately September
2017, the government obtained additional non-content information about the Target Account
pursuant to 18 U.S.C. § 2703(d), which included header information for the period of time
between approximately August 2016 and September 2017. The header information shows that
the Target Account continued to receive emails through at least approximately February 25,
2017, including emails from WordPress and the file sharing services DropBox and MediaFire,
which were not captured in the original court-authorized search conducted in August 2016.
25.

Subscriber records obtained from l&l Mail in August 2018 show that the Target

Account is still active (that is, it has not been deleted). The last login is listed as October 18,

2016. Records from the Target Account will, among other things, assist investigators in
understanding Guccifer 2.0's use of file sharing services, which may in turn assist investigators
in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks
and others.
BACKGROUND CONCERNING l&l MAIL

26.

In my training and experience, I have learned that l&l Mail provides a variety of

on-line services, including electronic mail ("email") access, to the public. 1& 1 Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target
Account. Subscribers obtain an account by registering with l&l Mail. During the registration

process, 1& 1 Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1& 1 Mail are likely to contain stored electronic communications (including retrieved

-9-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 18 of 33

and unretrieved email for l&l Mail subscribers and information concerning subscribers and their
use of 1& 1 Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
27.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
28.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in

(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,

-10-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 19 of 33

IP address information can help to identify which computers or other devices were used to access
the email account.
29.

In my training and experience, m some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
30.

This application seeks a warrant to search all responsive records and information

under the control of l&l Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
regardless of whether such communication, record, or other information is stored, held, or
maintained outside the United States.
31.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled

-11-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 20 of 33

the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt
(e.g., deleting communications in an effort to conceal them from law enforcement).

32.

Because there is probable cause to believe that the Target Account is an

operational account created to further criminal conduct, this application seeks authorization to
seize the information in Attachment B from the time of the creation of the account to the present.
FILTER REVIEW PROCEDURES

33.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent

-12-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 21 of 33

with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team.
CONCLUSION
34.

Based on the forgoing, I request that the Court issue the proposed search warrant.

35.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING
36.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

-Ei?~

Special Agent
Federal Bureau oflnvestigation

Subscribed and sworn to before me on this

_df}_~ yof August, 2018.
__,

rable Rudolph Contreras
United States District Judge

-13-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 22 of 33

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following l&l Mail account, which
is stored at premises owned, maintained, controlled, or operated by l&I Mail & Media, Inc., a
company headquartered in Chesterbrook, Pennsylvania:

-1-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 23 of 33

ATTACHMENTB
I.

Information to be disclosed by l&l Mail
To the extent that the information described in Attachment A is within the possession,

custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 24 of 33

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

1.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEi")); and

J.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

-3-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 25 of 33

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
and 52 U.S.C. § 30121 (foreign contribution ban), including:
a.

Evidence of unauthorized access to protected computers;

b.

Evidence of the distribution or transfer of data obtained through unauthorized
access to protected computers;

c.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

d.

Evidence indicating the account owner's state of mind as it relates to the crimes
under investigation;

e.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

f.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

g.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

-4-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 26 of 33

h.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

J.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign

-5-

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 27 of 33

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY l&l MAIL & MEDIA,
INC.

Case: 1:18-sc-02670
Assigned To: Howell, Beryl A.
Assign. Date : 8/20/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NO -DIS 'LOSURE UND "' R 18 U.S .C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct l&l Mail & Media, Inc. ("l&l Mail"), an electronic
communication and/or remote computing services provider headquartered in Chesterbrook,
Pennsylvania, not to notify any other person (except attorneys for l&l Mail for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
further order of the Court.

1.

The Court has the inherent power to seal court filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing

Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 28 of 33

2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b).

l&l Mail provides an "electronic communications service," as defined in 18

U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how l&l Mail may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
1

Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 29 of 33

deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b ), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command l&l Mail not to notify any other person (except attorneys for 1&1 Mail for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.

FA
6.

N-DlSCLOSURE

The Federal Bureau oflnvestigation ("FBI") is investigating WikiLeaks and others

for violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer);
18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
3

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 30 of 33

and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses"), in connection with efforts to compromise the networks
of the Democratic National Convention ("DNC"), the Democratic Congressional Campaign
Committee ("DCCC"), and the email accounts of U.S. persons involved in the 2016 presidential
election, followed by the public release of stolen materials through various outlets.
7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that l&l Mail and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for 1& 1 Mail for the purpose of receiving
legal advice) for a period of one year or until further order of the Court.

Such an order is

appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant
and related papers may also alert the targets to the scope of information known to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

4

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 31 of 33

9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S .C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in confidentiality to justify the government's sealing request.

See Robinson, 935 F.2d at 287-89.
10.

Based on prior dealings with l&l Mail, the United States is aware that, absent a

court order under Section 2705(b) commanding l&l Mail not to notify anyone about a legal
request, 1& 1 Mail may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
1& 1 Mail not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for 1& 1 Mail for the purpose of receiving legal advice) for a period of one year
or until further order of the Court.
Respectfully submitted,
ROBERTS. MUELLER, III
Special Counsel

Dated:

8 [2o/( 8

By:
Kyle
The
·a l Counsel's O · e
(202) 616-3812

5

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 32 of 33

AUG 2o2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY l&l MAIL & MEDIA,
INC.

Clerk, U.S. District & Bankruptcy
Courts tor the District of Columbia

Case: 1: 18-sc-02670
Assigned To : Howell, Beryl A.
Assign. Date: 8/20/2018
Description: Search & Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require l&l Mail & Media, Inc. ("1&1 Mail"), an electronic communication and/or remote
computing services provider headquartered in Chesterbrook, Pennsylvania, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 33 of 33

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C . § 2705(b), l&l Mail and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for I & I Mail for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.

//L-BLE RUDOLPH CONTRERAS
TES DISTRICT JUDGE

oG)oJdfl_c (

2

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 1 of 35

AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH
ONE CELLULAR TELEPHONE NUMBER THAT IS
STORED AT PREMISES CONTROLLED BY AT&T

)
)
)
)
)
)

Case: 1: 18-sc-02671
Ass!gned To : Howell, Beryl A
Assign. Date: 8/20/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Southern
District of
Florida
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
August 31, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:

City and state:

Washington, DC

Hon. Rudolph Contreras, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 2 of 35

AO 93 (Rev. I l/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 3 of 35

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the cellular telephone assigned call
number

("the Account"), that is stores at premises controlled by AT&T ("the

Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida.

-1-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 4 of 35

ATTACHMENT B
I.

Information to be disclosed by Provider
To the extent that the information described in Attachment A is within the possession,

custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.

§ 2703(f), the Provider is required to disclose to the government the following information
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through

November 15, 2016:
a. The following information about the customers or subscribers of the Account:
1.

Names (including subscriber names, user names, and screen names);

ii. Addresses (including mailing addresses, residential addresses, business
addresses, and e-mail addresses);
m. Local and long distance telephone connection records;
1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
v. Length of service (including start date) and types of service utilized;
vi. Telephone or instrument numbers (including MAC addresses, Electronic
Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifier ("MEID"); Mobile Identification Number
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MS ISDN"); International
Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi");
vii. Other subscriber numbers or identities (including the registration Internet
Protocol ("IP") address); and
viii. Means and source of payment for such service (including any credit card
or bank account number) and billing records.

-2-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 5 of 35

b. All records and other information (not including the contents of communications)
relating to wire and electronic communications sent or received by the Account,
including:
1.

the date and time of the communication, the method of the
communication, and the source and destination of the communication
(such as the source and destination telephone numbers (call detail
records), email addresses, and IP addresses); and

11.

information regarding the cell tower and antenna face (also known as
"sectors") through which the communications were sent and received.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A which

consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting),
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
14, 2016 to November 15, 2016.

-3-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 6 of 35
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describ • the p roperty to be searched
or ide111ify the p erson by name nnd address)

INFORMATION ASSOCIATED WITH
ONE CELLULAR TELEPHONE NUMBER STORED AT
PREMISES CONTROLLED BY AT&T

l
)
)
)

FI .
AUG 2 O 2018
GI erk, U,S. District & Bankruptcy
Courts for the District of Columbia

Case: 1:18-sc-02671
Assigned To: Howell, Beryl A.
Assign. Date: 8/20/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location) :

See Attachment A

located in the

- --Southern
- - - -- District of - - --

person or describe the property to be seized):

Florida
, there is now concealed (identify the
- - - - - -- -

See Attachment B

The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
0 property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Offense Description

Code Section
52 U.S.C. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

~ Continued on the attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days: - - - - - ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
IKyle R. Freeny (ASC)

c_A~,.c.1. ~
,..--·-~~pp 1ca11 s signature

Andrew Mitchell, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

_ 8_µg!_)i}( (
/

City and state: Washington, D.C.

Judge's signature

Hon. Rudolph Contreras, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 7 of 35

~Il
AUG 2 o 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE CELLULAR TELEPHONE NUMBER
THAT IS STORED AT PREMISES
CONTROLLED BY AT&T

Clork, U.S. District & Baok1optcy
Courts for the blstrlct of Columbia

Case: 1: 18-sc-02671
Assigned To : Howell, Beryl A.
Assign. Date : 8/20/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant under 18

U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a
certain cellular telephone assigned call number

("Target Telephone"), which is

stored at premises owned, maintained, controlled or operated by AT&T, a wireless telephone
service provider headquartered in North Palm Beach, Florida. The information to be disclosed by
AT&T and searched by the government is described in the following paragraphs and in
Attachments A and B.
2.

I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have been

since 2011. As a Special Agent of the FBI, I have received training and experience in investigating
criminal and national security matters.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and does
not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit; there

- 1-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 8 of 35

is probable cause to believe that violations of the following statutes have been committed or are
being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C.
§ 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false
statements), 18 U.S.C. § l 030 (unauthorized access of a protected computer), 18 U.S.C. § 1343
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 3012l(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the information
described in Attachment A for evidence of the Subject Offenses, further described in Attachment

B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id.

§§ 2703(a), (b)(l)(A), &

(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
6.

When the Government obtains records under § 2703 pursuant to a search warrant,

the Government is not required to notify the subscriber or any other person of the warrant, for such
a period as the Court deems appropriate, where there is reason to believe that such notification will
seriously jeopardize an investigation. 18 U.S.C. § 2705(b).

PROBABLE CAUSE
7.

The Special Counsel's Office, with FBI's assistance, is investigating the Russian

government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump ("Trump Campaign"). This includes investigating Roger Stone (STONE)

-2-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 9 of 35

and others known and unknown, in connection with the hacking of email accounts associated with
the Democratic National Committee (DNC), Democratic Congressional Campaign Committee
(DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the
subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization
WikiLeaks, among others.
8.

This application seeks cell-site location information for the Target Telephone,

used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this
corresponds to the time period during which there is evidence that STONE was engaged in, and
attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder
Julian ASSANGE about the content of stolen documents prior to their public release. During this
same time period, STONE was also in communications with members of the Trump Campaign.

A. Background on Relevant Individuals
1.

9.

Roger STONE

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official relationship
with the Campaign thereafter, STONE maintained his support for Trump and continued to make
media appearances in support of the Campaign.

As described further below, STONE also

maintained contact with individuals employed by the Campaign, including then-campaign
chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

10.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According to

-3 -

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 10 of 35

publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for
the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of books
regarding Democratic presidential candidates. As described further below, CORSI was in contact
with STONE during the summer and fall of 20 I 6 regarding forthcoming disclosures of hacked
information by WikiLeaks, and appears to have obtained information regarding upcoming
disclosures which he relayed to STONE.

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential Election

12.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC

-4-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 11 of 35

assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump.
13.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
14.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and
maintained that access until at least June 2016." The USIC attributed these cyber activities to the
Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in the
compromise of the personal e-mail accounts of Democratic Party officials and political figures. By
May, the GRU had exfiltrated large volumes of data from the DNC."
15.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
16.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
17.

The Special Counsel's Office has determined that individuals associated with the

-5-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 12 of 35

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
18.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals used
three new accounts with the same cloud computing service to move the "snapshots" to those
accounts.
19.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
20.

On or about November 1, 2016, individuals associated with the GRU spearphished

over 100 accounts used by organizations and personnel involved in administering elections in
numerous Florida counties.
21.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).
C. Evidence of Google Searches Relating to the Conduct Under Investigation

22.

During the course of its investigation, the FBI has identified a series of searches

that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona.
In pa1iicular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress
blog), records from Google show that searches were conducted for the terms "guccifer" and

-6-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 13 of 35

"guccifer j une," from an IP address within the range 107. 77 .216.0/24. 1 This IP range is assigned
to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida.
23.

IP logs obtained from Twitter show that STONE used multiple IP addresses within

the range 107.77.216.0/24 to log into his Twitter account@RogerJStoneJr.
24.

Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about

June 13, 2018, the FBI obtained all searches conducted by the CookieIDs that conducted the
Guccifer-related searches described above. 2 Based on these results, the FBI has not yet been able
to attribute the searches to any particular user.

D. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
25.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on
its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part of
the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon." In
that post, Guccifer 2.0 also began releasing hacked DNC documents.
26.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
27.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

1

Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range of up to 256 IP addresses.
2

Google assigns unique CookieIDs to searches conducted while a user is not logged into a Google
account. All searches conducted from the same device and browser during a 24-hour window are
associated with the same CookieID.
-7-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 14 of 35

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
28.

· On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain to
the Clinton Foundation but there's no telling what the October surprise may be." A few days later,
STONE clarified that while he was not personally in touch with AS SANGE, he had a close friend
who served as an intermediary.
29.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
30.

On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer
2.0's Twitter account was reinstated.

-8-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 15 of 35

31.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
32.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
33.

On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe
that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton
aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
34.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
35.

On Saturday, October 1, 2016, usmg @RogerJStoneJr, STONE tweeted,

"Wednesday@HillaryClinton is done. #WikiLeaks."
36.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony

-9-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 16 of 35

of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr to
tweet: "Payload coming. #Lockthemup."
37.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
38.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"REI,,EASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link to
approximately 2,050 emails that had been hacked from John Podesta's personal email account.
39.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do. I
do believe he has all of the e-mails that Ruma Abedin and Cheryl Mills, the Clinton aides, thought
were deleted. I hear that through my emissary."
40.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing from

-10-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 17 of 35

an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE

41.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 3 The latter account is the official Twitter account of WikiLeaks and has been
described as such by numerous news reports. The message read: "Sine~ I was all over national
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents
and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
42.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
43.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your operation
leaks like a sieve. You need to figure out who your friends are."
44.

On or about November 9, 2016, one day after the presidential election, @wikileaks

3

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account@RogerJStoneJr.
-11-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 18 of 35

sent a direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
45.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the

founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: "Still
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from
the government and the courts ruled it was legal to do so and refused to issue an order restraining
the paper from publishing additional articles. If the US government moves on you I will bring
down the entire house of cards. With the trumped-up sexual assault charges dropped I don't know
of any crime you need to be pardoned for - best regards. R." That same day, @JulianAssange
responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
46.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest level
of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."

F. CORSl's Communications with STONE,
Forthcoming Leaks
4 7.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

2017, Chief Judge Howell issued a search warrant for one of STONE's

On October 17,
addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
-12-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 19 of 35

warrant for

email account. On or about March 14, 2018, Chief Judge Howell issued

a search warrant for STONE's iCloud account. Information recovered pursuant to those search
warrants indicated the following:
48.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
have forwarded the message to STONE at

who replied to CORSI that,

"May meet Manafort -guarantee nothing."
49.

On or about May 18, 2016, CORSI emailed STONE a

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
50.

On July 25, 2016, STONE, using

sent an email to CORSI

with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
51.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.]
Trump[.]
52.

emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist - tum him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

-13-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 20 of 35

tweeted

about

"Podesta's

time

m

the

barrel"),

CORSI

emailed

STONE

at

, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox will
have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now.
Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential campaign
to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed
as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are
now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor
she well. I expect that much of next dump focus, setting stage for Foundation debacle."
Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
53.

an associate of STONE's, emailed

On or about August 4, 2016,

STONE at

The email contained a link to a poll indicating that Clinton

led Trnmp by 15 points. STONE responded on or about the same day, "enjoy it while u can[.] I
dined with my new pal Julian Assange last night."

subsequently stated to investigators

that, around the same time, STONE told him he had gone to London to meet ASSANGE.
also stated that in 2018,

told STONE he would be interviewed by the FBI

and would have to divulge the conversation about meeting ASSANGE. STONE told
he was joking and had not actually met AS SAN GE. 4

-14-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 21 of 35

54.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-Iocation
information indicating that it was taken in Los Angeles.
55.

On or about August 15, 2016, CORSI emailed STONE at

"Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not over
yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm in NYC
this week. Jerry."
56.

On or about August 31, 2016, CORSI emailed STONE at

"Did you get the PODESTA writeup." STONE replied "[y]es."
57.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by S [bJerbank,
Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton false narrative
attempting to tie Trump to Putin."
58.

On

or

about

6,

September

2016,

CORSI

emailed

STONE

at

: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
59.

On or about September 24, 2016,

-15-

emailed CORSI, "I will have much

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 22 of 35

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have secure
back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again
today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well. Can't wait

for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted about file[.]"
In a subsequent meeting with investigators,

indicated this conversation concerned

possible derogatory information he was trying to obtain from Turkey.
60.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
61.

On or about October 4, 2016, AS SANGE gave a press conference at the Ecuadorian

Embassy. There had been speculation in the press leading up to that event that ASSANGE would
release information damaging to then-candidate Clinton, but WikiLeaks did not make any new
releases. Instead, ASSANGE promised more documents, including information "affecting three
powerful organizations in three different states, as well as, of course, information previously
referred to about the U.S. election process." ASSANGE also stated that WikiLeaks would publish
documents on various subjects every week for the next ten weeks, and vowed that the U.S.
election-related documents would all come out before Election Day.
62.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."

-16-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 23 of 35

63.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't cut
deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer
64.

is a big democrat."

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was
about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON
had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released

65.

According to a publicly available news article, 5 at approximately 11AM on Friday,

October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source
regarding a previously unaired video of candidate Trump.

According to the same article,

"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a 2005
segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling Trump's
campaign, 'Access Hollywood,' and NBC for reaction."
66.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
67.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.

5

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iev.:d-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875e-2c 1bfe943 b66_story.html
-17-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 24 of 35

68.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
69.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
70.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked

71.

from John Podesta that focused primarily on materials related to the Clinton Foundation. On or
"I expect that

about August 2, 2016, CORSI emailed STONE using
much of next dump focus, setting stage for Foundation debacle."
72.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released

Podesta

emails.

forwarded

Approximately

ten

minutes

later,

STONE,

using

message to CORSI without comment. STONE does

not appear to have forwarded the email to any other individual.

H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
73.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-have

to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty minutes
later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T attacking
Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers."
74.
using

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."
-18-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 25 of 35

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta
is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
75.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3 :25PM EDT, CORSI
emailed STONE at both

, with the subject line

"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
personally and the Clintons through the Clinton Foundation."
76.

CORSI followed up several minutes later with another email titled, "Podesta talking

points," with the text "sent a second time just to be sure you got it." STONE emailed CORSI back
via the Hotmail Account, "Got them and used them."
77.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post
under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back
to STONE, "I'll give you one more -

NOBODY YET HAS THIS[:] It looks to me like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once

had

the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's Clinton
Fund account, there's no telling how much money he laundered, or where it ended up. Nothing in

-19-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 26 of 35

Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia &
Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me SOMETHING to
post on Podesta since I have now promised it to a dozen MSM reporters[.]"
78.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked, "Just
how much money did

a controversial Russian billionaire investor with ties to

the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by

with the money transferred via Deutsche Bank and

Trust Company Americas in New York City, with the money ending up in a private bank account
in the Bank of America that is operated by the Clinton Foundation?"
79.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's basically
a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
80.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."

-20-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 27 of 35

81.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote,

"From a very trusted source," and forwarded an email with the header information stripped out,
showing only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry,
Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that
he has a set of dead man files that include Hillary. It's what they used to call a 'Mexican stand
off[.]' Only hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
82.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
83.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails." STONE
stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear it from
Wikileaks, although Julian Assange and I share a common friend. I reported the story on my
website." STONE linked to the story he had asked CORSI to write for him on October 13, 2016
discussed above.
84.

On or about November 8, 2016, the United States presidential election took place.

85.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
86.

On or about November 10, 2016, CORSI messaged STONE at his iCloud account,

"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
Have some interesting news for you."

-21-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 28 of 35

I. The Target Telephone
87.

Search warrant returns for STONE's Hotmail account,

show that on numerous occasions, including in 2016, STONE provided the Target Telephone

Number to individuals as his cellular telephone number and/or the way to reach him. On or about
August 17, 2017, AT&T,

indicated that the "user" of the

Target Telephone Number is "Roger J. Stone." Publicly available databases indicate the Target
Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a
company investigators have linked to STONE.
88.

There is evidence that STONE used the Target Phone in connection with the

conduct under investigation. For example, according to records
:
a) STONE called CORSI on or about July 25, 2016 from the Target Phone, and spoke
with him for approximately twenty-six minutes. Less than roughly two hours after that call,
STONE emailed CORSI, "Get to Assange [a]t the Ecuadorian Embassy in London and get the
pending wikileaks emails .... "
b) On or about July 30, 2016--one day before STONE instructed CORSI to have
contact ASSANGE-Manafort, who was then-Chairman of the Trump Campaign,
called STONE on the Target Phone Number. The two spoke for approximately sixty-seven
minutes.
c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure,
STONE received a call from the Washington Post at the Target Phone Number, and shortly
thereafter, STONE had two conversations with CORSI from the Target Phone Number.
89.

As set forth in Attachment B, this application seeks cell-site location information

-22-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 29 of 35

for the Target Telephone between Ju ne 14. 201 6-the day before a Google search was conducted
for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0's first public
appearance-and November 15, 2016- one week after the 2016 presidential election and less than
one week after CORSI messaged STONE about having "interesting news" for him. Given
STONE's repeated communications with and/or about the WikiLeaks releases during this time,
including discussions about the content of the documents prior to their release, there is probable
cause to believe that STONE's whereabouts during this time period will yield evidence of the
Subject Offenses under investigation. Location information for the Target Phone will assist
investigators in determining, among other things: whether STONE was in Florida at the time of
the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or
around any of the events or communications discussed above; and where STONE was on the night
he claimed he "dined" with ASSANGE. 6 Location information will also assist investigators in
identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential
co-conspirators during this time period.
BACKGROUND CONCERNING AT&T

90.

In my training and experience, I have learned that AT&T is a company that provides

cellular telephone access to the general public. I also know that providers of cellular telephone
service have technical capabilities that allow them to collect and generate information about the
locations of the cellular telephones to which they provide service, including cell-site data, also

6

As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to
have met AS SANGE, but the FBI is investigating whether STONE may have met an intermediary
instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site
location information varies depending on the distance between towers (among other things).
Given the density of Los Angeles, I believe that cell-site location data for STONE's trip there
would assist investigators in determining, among other things, whether STONE was present at the
locations he has publicly claimed to have been.
-23-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 30 of 35

known as "tower/face information" or "cell tower/sector records." Cell-site data identifies the
"cell towers" (i.e., antenna towers covering specific geographic areas) that received a radio signal
from the cellular telephone and, in some cases, the "sector" (i.e., faces of the towers) to which the
telephone connected. These towers are often a half-mile or more apart, even in urban areas, and
can be 10 or more miles apart in rural areas. Furthennore, the tower closest to a wireless device
does not necessarily serve every call made to or from that device. Accordingly, cell-site data
provides an approximate location of the cellular telephone but is typically less precise than other
types of location information, such as E-911 Phase II data or Global Positioning Device ("GPS")
data.
91.

Based on my training and experience, I know that AT&T can collect cell-site data

about the Target Telephone. Cell-site location data is typically generated only when the phone
is used to engage in communications. I also know that wireless providers such as AT&T typically
collect and retain cell-site data pertaining to cellular phones to which they provide service in their
normal course of business in order to use this information for various business-related purposes.
92.

Based on my training and experience, I know that wireless providers such as

AT&T typically collect and retain information about their subscribers in their normal course of
business. This information can include basic personal information about the subscriber, such as
name and address, and the method(s) of payment (such as credit card account number) provided
by the subscriber to pay for wireless telephone service. I also know that wireless providers such
as AT&T typically collect and retain information about their subscribers' use of the wireless
service, such as records about calls or other communications sent or received by a particular
phone and other transactional records, in their normal course of business. In my training and
experience, this information may constitute evidence of the crimes under investigation because

-24-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 31 of 35

the information can be used to identify the Target Telephone user or users and may assist in the
identification of co-conspirators and/or victims

FILTER REVIEW PROCEDURES
93.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team.

CONCLUSION
94.

Based on the forgoing, I request that the Court issue the proposed search warrant.

95.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-25-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 32 of 35

REQUEST FOR SEALING
96.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

c:::::~

Andrew Mitchell
Special Agent
Federal Bureau of Investigation
Subscribed and sworn to before me on this .Jfl day of August, 2018.

The Honor ble Rudolph Contreras
United States District Judge

-26-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 33 of 35

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the cellular telephone assigned call
number

("the Account"), that is stores at premises controlled by AT&T ("the

Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida.

-1-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 34 of 35

ATTACHMENT B

I.

Information to be disclosed by Provider

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.
§ 2703(f), the Provider is required to disclose to the government the following information

pertaining to the Account listed in Attachment A for the time period June 14, 2016 through
November 15, 2016:

a. The following information about the customers or subscribers of the Account:
i. Names (including subscriber names, user names, and screen names);
11.

Ill.

Addresses (including mailing addresses, residential addresses, business
addresses, and e-mail addresses);
Local and long distance telephone connection records;

1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
v. Length of service (including start date) and types of service utilized;
vi. Telephone or instrument numbers (including MAC addresses, Electronic
Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifier ("MEID"); Mobile Identification Number
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"); International
Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi");
vii. Other subscriber numbers or identities (including the registration Internet
Protocol ("IP") address); and
vu1. Means and source of payment for such service (including any credit card
or bank account number) and billing records.

-2-

 Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 35 of 35

b. All records and other information (not including the contents of communications)
relating to wire and electronic communications sent or received by the Account,
including:
1.

the date and time of the communication, the method of the
communication, and the source and destination of the communication
(such as the source and destination telephone numbers (call detail
records), email addresses, and IP addresses); and

11.

information regarding the cell tower and antenna face (also known as
"sectors") through which the communications were sent and received.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A which

consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting),
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
14, 2016 to November 15, 2016.

-3-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 1 of 56
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY FACEBOOK

)
)
)
)
)
)

Case: 1: 18-sc-02727
Assigned To : Chief Judge Beryl A. Howell
Assign. Date : 8/28/2018
Description: Search and Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
September 11, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
D at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)

D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box).
D for
days (not to exceed 30) D until, the facts justifying, the later specific date of

Date and time issued:
City and state:

f'-"''-',""'""'"--

_ _,'3'--'/'----'-v=-f~ft._Cj,c__---''3"---',
r
~

_W_a_s_hi_n_..g_to_n_:_,_D_C_ _ _ _ _ _ __

Hon. J

. Boasberg, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 2 of 56
AO 93 (Rev. l l/13) Search and Seizure Warrant (Page 2)

Return
Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 3 of 56

ATTACHMENT A

Property to be Searched

This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
Facebook, Inc. ("Facebook"), a company headquartered in Menlo Park, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 4 of 56

ATTACHMENT B

I.

Information to be disclosed by Facebook

To the extent that the information described in Attachment A is within the possession,
custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
following information to the government for each account listed in Attachment A:
(a)

All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

(b)

All activity logs for the account and all other documents showing the user's posts
and other Facebook activities;

(c)

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;

(d)

All profile information; News Feed information; status updates; videos,
photographs, rn:ticles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use ofFacebook applications;

-2-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 5 of 56

(e)

All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;

(f)

All records relating to machine cookies;

(g)

All "check ins" and other location information, including records of the user's
latitude and longitude;

(h)

All IP logs, including all records of the IP addresses that logged into the account;

(i)

All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";

(j)

All information about the Facebook pages that the account is or was a "fan" of;

(k)

All past and present lists of friends created by the account;

(1)

All records ofFacebook searches performed by the account;

(m)

All information about the user's access and use ofFacebook Marketplace;

(n)

The types of service utilized by the user;

(o)

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

(p)

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

(q)

All past and present Admins for the group;

(r)

The "Creator" of the group;

-3-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 6 of 56

(s)

All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

(t)

All records pertaining to connnunications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
services and records of actions taken;

(u)

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and queried.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to connnit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
connnunications regarding hacking, release of hacked material, connnunications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or connnunications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 7 of 56

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

-5-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 8 of 56

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

' 1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 9 of 56

AUG 2 B 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH ONE
ACCOUNT STORED AT PREMISES
. CONTROLLED BY FACEBOOK

Clerk, U.S. Disirict & Bankruptoy

Courts. tor the District of Ga!mnhia

Case: 1:18-sc-02727
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Facebook, Inc. ("Facebook"), an electronic communication and/or remote
computing services provider headquartered in Menlo Park, California, not to disclose the existence
or contents of the Warrant pursuant to 18 U.S.C .. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 10 of 56

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.

ES E. BOASBERG
ISTRICT JUDGE

1/k~~

Date

2

 Case
1:19-mc-00029-CRC
AO 106 (Rev. 04/10)
Application
for a Search Warrant

Document 29-19 Filed 04/28/20 Page 11 of 56

UNITED STATES DISTRICT COURT
for the
District of Columbia

In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)
)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BYFACEBOOK

AUG 2 8 2018
Clerk, U.S. Districi &, B~nkruptoy
Courts for the District ot Columbia

Case: 1:18-sc-02727
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

)l

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the

Northern

District of

California

----~

----

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B
The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more}:

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
D a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section
52 U.S.C. § 30121
18 u.s.c. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

r/ Continued on the attached sheet.
D Delayed notice of
days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC)

4~urA{,t!,,u.__
Applicant's signature

Curtis Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

1/1--f/;t

City and state: Washington, D.C.

) is requested

Hon. J
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 12 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY F ACEBOOK

Case: 1: 18-sc-02727
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof ( collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct Facebook, Inc. ("Facebook"), an electronic
communication and/or remote computing services provider headquartered in Menlo Park,
California, not to notify any other person (except attorneys for Facebook for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing

Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 13 of 56

(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Facebook not to notify any other person (except attorneys for Facebook for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

The Federal Bureau oflnvestigation ("FBI") is investigating violations of 18 U.S.C.

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
3

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 14 of 56

to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in confidentiality to justify the government's sealing request.

See Robinson, 935 F.2d at 287-89.
10.

Based on prior dealings with Facebook, the United States is aware that, absent a

court order under Section 2705(b) commanding Facebook not to notify anyone about a legal
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Facebook not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year
or until further order of the Court.
Respectfully submitted,
ROBERT S. MUELLER, III
Special C o u n u

Dated: -~6c.,/~2==1?!~/~t---ef_,_2~

By:

5

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 15 of 56

FILED
AUG 2 8 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1:18-sc-02727
Assigned To : Chief Judge Beryl A. Howell
Assign. Date : 8/28/2018
Description: Search and Seizure Warrant

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY FACEBOOK

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Curtis Heide, beingfirst duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Facebook account registered to
("Target Account"), stored at premises owned, maintained, controlled or operated by Facebook,

Inc. ("Facebook"), a company headquartered in Menlo Park, California. The information to be
disclosed by Facebook and searched by the government is described in the following paragraphs
and in Attachments A and B.
2.

I have been a Special Agent with the Federal Bureau of investigation for 12 years.

In the course of my duties, I have been responsible for investigating federal crimes and national
security matters involving both counterintelligence and issues related to cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
-1-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 16 of 56

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.
JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

PROBABLE CAUSE
A. Background on Relevant Individuals

i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,

-2-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 17 of 56

STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 18 of 56

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls.'"
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 19 of 56

12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016

-5-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 20 of 56

presidential election, including conspiracy to connnit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).

C. STONE's ~.ublic Interactions with Guccifer 2.0 and WikiLeaks
19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entftled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"

-6-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 21 of 56

aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and

-7-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 22 of 56

[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part ofWikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.

-8-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 23 of 56

33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter

-9-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 24 of 56

account @wikileaks. l The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016,@RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the govermnent and the courts ruled it was legal to do so and refused to

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 25 of 56

issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017,@RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Howell issued a search warrant for one ofSTONE's

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

mail account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at
CORSI that, "May meet Manafort -guarantee nothing."
-11-

who replied to

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 26 of 56

43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read: "
Assange[.]
Trump[.]
46.

emailed
should see

should find Bernie [SJ anders brother who called Bill a Rapist~ turn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --

-12-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 27 of 56

neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

On or about August 5, 2016,

STONE at

an associate of STONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE.

also stated

told STONE he would be interviewed by the FBI and would have to

that in 2018,

divulge the conversation about meeting AS SAN GE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later -heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location

-13-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 28 of 56

information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
"Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S [b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan; I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

-14-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 29 of 56

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer

is a big

democrat."
58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE

-15-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 30 of 56

was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
59.

According to a publicly available news article, 3 at approximately I !AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

at approximately

According to phone records

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately I :42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywoodtape.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/31d74714-8ce5- l l e6-875e-2c 1bfe943b66_story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 31 of 56

65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE using

"I expect

that much of hext dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
68.
using

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"

-17-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 32 of 56

69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
71.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"

-18-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 33 of 56

72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

with the money

transferred via Deutsche Bankand Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

-19-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 34 of 56

AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-20-

 Case Document 29-19 Filed 04/28/20 Page 35 of 56

 

Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 36 of 56

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks

-22-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 37 of 56

88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
-23-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 38 of 56

Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.

90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "ls it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[l]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of Jolm
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"

91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"

-24-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 39 of 56

93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credi co never said he knew or had any information as to source or
content of the material."

-25-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 40 of 56

97.

On or about December 1, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache(.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure,
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
98.

STONE and CREDICO continued to message each other on or about December I,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 41 of 56

99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September oflast year."
102.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5

5

https://www.yahoo.com/news/comedian-randy-credico-says-trurnp-adviser-roger-stonethreatened-dog-135911370.html
-27-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 42 of 56

104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
K

Statements Regarding STONE's Use of Social Media

105.

On or about Friday, May 18, 2018

was voluntarily interviewed

by investigators from the Special Counsel's Office.

told investigators that he became

STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man. 7
106.

According t

STONE utilized the services of several individuals to

post social media content to Facebook and Twitter, and that he
instructed these individuals about what to post.

and STONE both

tated that he purchased a couple

hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.
107.

further stated that STONE wanted to push out WikiLeaks content

through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
was pushed out through STONE's Facebook and Twitter accounts.

6 https ://www.motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/

7

told investigators that he would sometimes send emails from STONE's account.
-28-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 43 of 56

108.

In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,

the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
show that STONE or one of his associates created an ad

account

campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
Intel says he is."

L. The Target Account
109.

According to subscriber records, the email account

was created on August 17, 2015, in the name of"Falo Memo Tio." 8 STONE's Hotmail account
is listed as the recovery email for the account. In my training and
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
example, in the event a password is lost or compromised. Accordingly, there is probable cause
to believe that STONE controls (directly, or through an employee or associate) the email account

110.

The goverrnnent obtained non-content information associated with the
pursuant to an order issued by Chief Judge Howell under 18 U.S.C.

8

Subscriber records list the "Language Code" for the email account as "pt_BR." I believe this
indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 44 of 56

§ 2703(d). Although subscriber records indicate that the last login to the email account took

place on August 18, 2015, header information shows that the account continued to receive emails
until at least July 27, 2018, including from companies that offer advertisement placements.
111.

Header information shows that the email account received multiple emails from

Facebook between approximately November 3, 2016 and November 7, 2016, shortly before the
U.S. presidential election. On or about October 5, 2016, the email account also received an
email from adsense-noreply@google.com, an account that I believe is associated with Google
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
advertising on its network of content sites.
112.

Based on a query performed through Facebook's law enforcement portal, the FBI

has confirmed that the email account

is registered to an active

Facebook account. As explained further below, in my training and experience, I know that, in
addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
communicate with WikiLeaks and ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING FACEBOOK
113.

Facebook owns and operates a free-access social networking website of the same

name that can be accessed at http://www.facebook.com. Facebook allows its users to establish
accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.

-30-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 45 of 56

114.

Facebook asks users to provide basic contact and personal identifying information

to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
also assigns a user identification number to each account.
115.

Facebook users may join one or more groups or networks to connect and interact

with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
user's "Friends," such as profile changes, upcoming events, and birthdays.
116.

Facebook users can select different levels of privacy for the communications and

information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
117.

Facebook users can create profiles that include photographs, lists of personal

interests, and other information.

Facebook users can also post "status" updates about their

-31-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 46 of 56

whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
who can view the user's profile.
118.

Facebook allows users to upload photos and videos, which may include any

metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
119.

Facebook users can exchange private messages on Facebook with other users.

These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
'
profiles; such comments
are typically associated with a specific posting or item on the profile. In

addition, Facebook has a Chat feature that allows users to send and receive instant messages
through Facebook. These chat communications are stored in the chat history for the account.

-32-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 47 of 56

Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call.
120.

If a Facebook user does not want to interact with another user on Facebook, the

first user can "block" the second user from seeing his or her account.
121.

Facebook has a "like" feature that allows users to give positive feedback or connect

to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
particular Facebook pages.
122.

Facebook has a search function that enables its users to search Facebook for

keywords, usemames, or pages, among other things.
123.

Each Facebook account has an activity log, which is a list of the user's posts and

other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
124.

Facebook Notes is a blogging feature available to Facebook users, and it enables

users to write and post notes or personal web logs ("biogs"), or to import their biogs from other
services, such as Xanga, LiveJournal, and Blogger.
125.

The Facebook Gifts feature allows users to send virtual "gifts" to their friends that

appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are
free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.

-33-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 48 of 56

126.

Facebook also has a Marketplace feature, which allows users to post free classified

ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
127.

In addition to the appJications described above, Facebook also provides its users

with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
use of that application may appear on the user's profile page.
128.

Some Facebook pages are affiliated with groups of users, rather than one individual

user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
the current status of the group profile page.
129.

Facebook uses the term "Neoprint" to describe an expanded view of a given user

profile. The "Neoprint" for a given user can include the following information from the user's
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
and use of Facebook applications.
130.

Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.

These logs may contain information about the actions taken by the user ID or IP address on

-34-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 49 of 56

Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
from what IP address the user did so.
131.

Social networking providers like Facebook typically retain additional information

about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number).

In some cases, Facebook users may

communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications.
132.

As explained herein, information .stored in connection with a Facebook account

may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook

-35-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 50 of 56

account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understandthe chronological and geographic context of the
account access and use relating to the crime under investigation.

Such information allows

investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
133.

Therefore, the computers of Facebook are likely to contain all the material

described above, including stored electronic communications and information concerning
subscribers and their use ofFacebook, such as account access information, transaction information,
and other account information.

FILTER REVIEW PROCEDURES
134.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and

-36-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 51 of 56

other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
135.

Based on the forgoing, I request that the Court issue the proposed search warrant.

136.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
13 7.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

/;'-1,~ A~/~,b~
Curtis Heide
Special Agent
Federal Bureau ofinvestigation
Subscribed and sworn to before me on this

J!f day of August, 2018.

-37-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 52 of 56

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
Facebook, Inc. ("Facebook"), a company headquartered in Menlo Park, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 53 of 56

ATTACHMENT B

I.

Information to be disclosed by Facebook
To the extent that the information described in Attachment A is within the possession,

custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
following information to the government for each account listed in Attachment A:
(a)

All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

(b)

All activity logs for the account and all other documents showing the user's posts
and other Facebook activities;

( c)

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;

(d)

All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use ofFacebook applications;

-2-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 54 of 56

(e)

All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;

(f)

All records relating to machine cookies;

(g)

All "check ins" and other location information, including records of the user's
latitude and longitude;

(h)

All IP logs, including all records of the IP addresses that logged into the account;

(i)

All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";

G)

All information about the Facebook pages that the account is or was a "fan" of;

(k)

All past and present lists of friends created by the account;

(1)

All records of Facebook searches performed by the account;

(m)

All information about the user's access and use ofFacebook Marketplace;

(n)

The types of service utilized by the user;

(o)

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

(p)

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

(q)

All past and present Admins for the group;

(r)

The "Creator" of the group;

-3-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 55 of 56

(s)

All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

(t)

All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
services and records of actions taken;

(u)

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and queried.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 56 of 56

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

.h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

i.

The identity of the person( s) who created or used the account, including records
that help reveal the whereabouts of such person( s);

-5-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 1 of 49
AO 93 (Rev. 1 l/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY GOOGLE

)
)
)
)
)

Case: 1:18-sc-02728
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

)

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

'iii

YOU ARE COMMANDED to execute this warrant on or before
September 11, 2018
(not to exceed 14 days)
in the daytime 6:00 a.m. to I 0:00 p.m.
0 at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for
days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

-~=m-/-Jo,icf,)J.t,_/(._f>'-_-~,,,_._:)":1._,/'-'-""'-------_W_as_h_in_.g,_t_on_.,c_D_C_ _ _ _ _ _ __

U.S. District Judge

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 2 of 49
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return
Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 3 of 49

ATTACHMENT A

Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 4 of 49

ATTACHMENT B

I.

Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 5 of 49

e.

All records pertaining to connnunications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

1.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);

J.

All Google Developers Console information associated with the account;

k.

All Minutemaid information associated with the account;

I.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All YouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive information associated with the account;

s.

All Google+ information associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 6 of 49

Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
u.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 7 of 49

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and ot4er files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 8 of 49

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 AO 106 (Rev. 04/10} Application 'for a Search Warrant

Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 9 of 49

UNITED STATES DISTRICT COURT
AUG 2 8 2018

for the
District of Columbia

Clerk, U.S. Districi & Bankruptuy
Courts for the District of Columllia

In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY GOOGLE

)~

)~

Case: 1:18-sc-02728
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location);

See Attachment A
located in the

Northern

District of _ _ _ __-C,:.:a:.:.lic.:fo::-r..n.,,ia,...__ _ _ , there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
evidence of a crime;

M

Mcontraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 u.s.c. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.
~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

~ s, /I,
Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC)

) is requested

,,?ktA,,..___

Applicant's signature

Curtis Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.
Printed name and title

 FILED

Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 10 of 49

AUG 2 8 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY GOOGLE

Cieri(, U.S. District & Bankruptcy
Courts for the District of Columbia

Case: 1: 18-sc-02728
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Google account

("Target Account"),

stored at premises owned, maintained, controlled or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California. The information to be disclosed by Google
and searched by the government is described in the following paragraphs and in Attachments A
andB.
2.

I have been a Special Agent with the Federal Bureau of investigation for 12 years.

In the course of my duties, I have been responsible for investigating federal crimes and national
security matters involving both counterintelligence and issues related to cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
-1-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 11 of 49

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,

-2-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 12 of 49

STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

.-3-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 13 of 49

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 14 of 49

12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, inor around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016

-5-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 15 of 49

presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-00125).

C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."

In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"

-6-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 16 of 49

aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thauks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using @RogerJStoneJR; STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and

-7-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 17 of 49

[AS SANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October!, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday@ HillaryC!inton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. Onthe day o£the AS SANGE announcement - which was
part ofWikiLeaks' IO-year anniversary celebration- STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.

-8-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 18 of 49

33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture),and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true,''
D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter

-9-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 19 of 49

account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder ofWikiLeaks. For example, on June 4, 2017,@RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 20 of 49

issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONE's

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

emailed CORSI: "Here is my flight

On or about May 15, 2016,

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at
CORSI that, "May meet Manafort -guarantee nothing."
-11-

who replied to

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 21 of 49

.43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.]
Trump[.]
46.

emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist -turn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --

-12-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 22 of 49

neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

an associate of STONE's, emailed

On or about August 5, 2016,

STONE at

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet AS SANGE.

also stated

told STONE he would be interviewed by the FBI and would have to

that in 2018,

divulge the conversation about meeting AS SAN GE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?'' STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in

-13-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 23 of 49

STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
: "Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 24 of 49

54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SAN GE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October. 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer
democrat."

-15-

is a big

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 25 of 49

58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

59.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately I :42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/31d74714-8ce5-11 e6-875e-2c 1bfe943b66_ story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 26 of 49

64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
"I expect

On or about August 2, 2016, CORSI emailed STONE using
that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSl for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunchpostponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
68.
using

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on

-17-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 27 of 49

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
71.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the c)lannel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

-18-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 28 of 49

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17,2016, CORSI messaged STONE at his iCloud account,

.. "On Assange, can you call me now- before 2pm[.)" STONE responded, "Missed u- just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

-19-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 29 of 49

75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."

-20-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 30 of 49

80.

On or about November 10, 2016, CORSI messaged STONE at his iC!oud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-21-

 Case Document 29-20 Filed 04/28/20 Page 31 of 49

 

Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 32 of 49

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks
88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.

-23-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 33 of 49

89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occas10ns.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
J, STONE's Messaging to Randy CREDICO about STONE's "Back channel"

91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote

-24-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 34 of 49

back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what ? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post1 STONE further stated that "Credico merely[]

-25-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 35 of 49

confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any inf01mation as to source or
content of the material."
97.

On or about December 1, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Charmel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
98.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 36 of 49

STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September oflast year."
102.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't w01Ty. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away

-27-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 37 of 49

from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.)" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.

K.

Statements Regarding STONE's Use of Social Media
105.

On or about Friday, May 18, 2018,

was voluntarily interviewed

by investigators from the Special Counsel's Office.

told investigators that he became

STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
106.

According to

STONE utilized the services of several individuals to

post social media content to Facebook and Twitter, and that he
instructed these individuals about what to post.

and STONE both

stated that he purchased a couple

hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stonethreatened-dog-135911370.html
6

https://www.motherjones.com/po litics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 38 of 49

107.

further stated that STONE wanted to push out WikiLeaks content

through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
was pushed out through STONE's Facebook and Twitter accounts.
108.

In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,

the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
show that STONE or one of his associates created an ad

accounts

campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
Intel says he is."

L. The Target Account
109.

According to subscriber records, Target Account

created on August 17, 2015, in the name of"Falo Memo Tio." 7 STONE's

was
account

is listed as the recovery email for the Target Account. In my training and
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
example, in the event a password is lost or compromised.

7

Subscriber records list the "Language Code" for the Target Account as "pt_BR." I believe
this indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 39 of 49

110.

The government obtained non-content information associated with the Target

Account pursuant to an order issued by Chief Judge Howell under 18 U.S.C. § 2703( d).

Although subscriber records indicate that the last login to the Target Account took place on
August 18, 2015, header information shows that the account continued to receive emails until at
least July 27, 2018, including from companies that offer advertisement placements.
111.

Header information shows that the Target Account received multiple emails

from Facebook between approximately November 3, 2016 and November 7, 2016, shortly before
the U.S. presidential election. On or about October 5, 2016, the Target Account also received
an email from adsense-noreply@google.com, an account that I believe is associated with Google
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
advertising on its network of content sites.
BACKGROUND CONCERNING GOOGLE

112.

In my training and experience, I have learned that Google provides a variety of on-

line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence

-30-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 40 of 49

of the crimes under investigation because the information can be used to identify the account's
user or users.
113.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
114.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in

(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
11 S.

In my training and experience, in some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as

-31-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 41 of 49

technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the· crimes under investigation because the information can be used to identify the
account's user or users.
116.

This application seeks a warrant to search all responsive records and information

under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google's possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.
117.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by

-32-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 42 of 49

the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the Jogged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt
(e.g., deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES

118.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent·
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION

119.

Based on the forgoing, I request that the Court issue the proposed search warrant.

120.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-33-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 43 of 49

REQUEST FOR SEALING

121.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

~,~A /LA~

·
ide
Special Agent
Federal Bureau oflnvestigation
Subscribed and sworn to before me on this~ day of August, 2018.

-34-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 44 of 49

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 45 of 49

ATTACHMENT B
I.

Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(!), Google is required to disclose the following
information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, . telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 46 of 49

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

1.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);

J.

All Google Developers Console information associated with the account;

k.

All Minutemaid information associated with the account;

I.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All YouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive information associated with the account;

s.

All Google+ information associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 47 of 49

Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("!MEI")); and
u.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 48 of 49

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 49 of 49

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

1.

The identity of any non-U.S. person(s}-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s}-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 1 of 48
AO 93 (Rev. l l/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY 1&1 MAIL & MEDIA, INC.

)
)
)
)
)
)

Case: 1:18-sc-02729
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Eastern
District of
Pennsylvania
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
September 11, 2018
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

f1 in the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for
days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:

City and state:

Washington, DC

E. Boasberg, U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 2 of 48
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 3 of 48

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following I & I Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by I & I Mail & Media,
Inc. ("I &I Mail"), a company headquartered in Chesterbrook, Pennsylvania:

-1-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 4 of 48

ATTACHMENT B
I.

Information to be disclosed by l&l Mail

To the extent that the information described in Attachment A is within the possession,
custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), 1&1 Mail is required to disclose
the following information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 5 of 48

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

i.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
j.

For any accounts linked to the accounts listed in Attaclunent A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attaclunent A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided dming registration, methods of connecting, log files, and means and
somce of payment (including any credit or bank account number).

-3-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 6 of 48

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

-4-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 7 of 48

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating

-5-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 8 of 48

to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.
n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 AO 106 (Rev. 04/10) Application for a Search Warrant

Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 9 of 48

UNITED STATES DISTRICT COURT

AUG 2 B 2018

for the
District of Columbia

In the Matter of the Search of

~
)

(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY 1&1 MAIL & MEDIA, INC.

~
)

FILED
Clerk, U.S. District & Bankruptcy
Courts tor th~ Oistrict of G0!uml1ta

Case: 1:18-sc-02729
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018
Description: Search and Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the - - -Eastern
- - - - - District of

_,P,_e__,n...n..s,_,y_..lv"a.._n...ia~--- , there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):

r.f evidence of a crime;
r.f contraband, fruits of crime, or other items illegally possessed;
fl property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

r;/

Continued on the attached sheet.

0 Delayed notice of

days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

) is requested

~'llzA . . ? ~ ~
Reviewed by AUSA/SAUSA:
IKyle R. Freeny (AS()

Applicant's signature

Curtis Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:
City and state: Washington, D.C.

U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 10 of 48

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY l&l MAIL & MEDIA,
INC.

AUG 2 8 2018
Clerk, U.S. District & Bankruptcy
Courts for tfle District of Columbia

case: 1:18-sc-02729
Assigned To : Chief Judge Beryl A. Howell
Assign. Date: 8/28/2018 .
Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the 1& 1 Mail account

("Target Account"),

stored at premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("l&l
Mail"), a company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed
by l&l Mail and searched by the government is described in the following paragraphs and in
Attachments A and B.
2.

I have been a Special Agent with the Federal Bureau of investigation for 12 years.

In the course of my duties, I have been responsible for investigating federal crimes and national
security matters involving both counterintelligence and issues related to cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contain evidence, fruits, or

-1-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 11 of 48

instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.
JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals

i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,

-2-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 12 of 48

STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 13 of 48

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Goverrunent developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian goverrunent employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Goverrunent agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 14 of 48

12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own\technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016

-5-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 15 of 48

presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).

C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian govermnent actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"

-6-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 16 of 48

aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange .
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SANGE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and

-7-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 17 of 48

[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday@HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.

-8-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 18 of 48

33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta' s email ( speculation and conjecture) and the timing
or scope of their subsequent disclosures. So l am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter

-9-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 19 of 48

account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with AS SANGE,

the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SAN GE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 20 of 48

issue an order restraining the paper from publishing additional articles. If the US govermnent
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Govermnent. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."
E. CORSl's Communications with STONE,
Forthcoming Leaks

41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONE's

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

emailed CORSI: "Here is my flight

On or about May 15, 2016,

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at
CORSI that, "May meet Manafort -guarantee nothing."
-11-

who replied to

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 21 of 48

43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:

emailed
should see

Assange[.]

should find Bernie [S]anders brother who called Bill a Rapist-tum him for

Trump[.]

hould find

46.

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --

-12-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 22 of 48

neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

On or about August 5, 2016,

STONE at

an associate of STONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet AS SANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SANGE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3 :3 8PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in

-13-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 23 of 48

STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
"Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or.about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 24 of 48

54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer
democrat."

-15-

is a big

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 25 of 48

58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

59.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/31d74 714-8ce5-l l e6-875e-2c 1bfe943b66_story .html
3

-16-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 26 of 48

II
I

64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE using

"I expect

that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
68.
using

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on

-17-

l

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 27 of 48

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
71.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

-18-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 28 of 48

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[.J" STONE responded, "Missed u-just ·
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

-19-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 29 of 48

75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."

-20-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 30 of 48

80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-21-

 Case Document 29-21 Filed 04/28/20 Page 31 of 48

 

Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 32 of 48

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks
88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.

-23-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 33 of 48

89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtrnth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"

91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote

-24-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 34 of 48

back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Charmel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely []

-25-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 35 of 48

confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
97.

On or about December 1, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]'' STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
98.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told

4

Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
'
-26-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 36 of 48

STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September oflast year."
102.

CREDICO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away

-27-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 37 of 48

from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
K. Stone's Use of the Target Account

105.

According to subscriber records, Target Account

was

created on November 4, 2015 in the name of Roger Stone, and the last login to the account was
May29,2018. 7
106.

Based on communications identified through a court-authorized search of

STONE's .Gmail account
Account

, I have learned that STONE used Target
to send and receive communications about WikiLeaks and

Assange:
107.

For example, on or about March 21, 2018, STONE used the Target Account to

send an email with the subject, "Randy [Credico] and Me: The Truth about WikiLeaks." The

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stonethreatened-dog0135911370.html
6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
7

The customer date of birth listed in the subscriber records is not STONE's birthdate. In my
training and experience, providers such as l&l. Mail do not verify customer dates of birth.
-28-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 38 of 48

email appears to be a media blast sent to a distribution list that included STONE's Gmail account
In the email, STONE claimed, in substance and in part, that in 2016 he
had asked Credico to confirm that Assange had credible information on Clinton, and that Credico
"never said from whom he gained [the] confirmation, or the source, or the content of whatever
was coming."
108.

At least one reporter also emailed STONE at the Target Account about

WikiLeaks and Assange. In particular, on or about May 11, 2018, a reporter with the
Washington Post emailed STONE at both

nd Target Account

rogerstone@mail.com about "a story on the Mueller investigation." The reporter described "a

scene

when

says he was asked about an email he received

from [STONE] that made reference to an upcoming meeting with Julian Assange." After noting
, STONE's position that no meeting with Assange ever occurred, the reporter also asked STONE,
in substance and in part, if he had anything further to add to the story.
I 09.

On or about the same day, STONE responded from his Google account
stating that the email concerning a meeting with Assange was "a joke

made while trying to get

off the phone." STONE also wrote, "Now would be a good time

for the Washington Post to report that the accusation there was an email that proved that I knew
about the contents of the WikiLeaks disclosures in advance has never been seen by the
Washington Post and was then ascribed to a 'phone call."'

BACKGROUND CONCERNING l&l MAIL
110.

In my training and experience, I have learned that !&I Mail provides a variety of

on-line services, including electronic mail ("email") access, to the public. l&l Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target

-29-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 39 of 48

Account. Subscribers obtain an account by registering with l&l Mail. During the registration

process, l&l Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1&1 Mail are likely to contain stored electronic communications (including retrieved
and unretrieved email for 1&1 Mail subscribers and information concerning subscribers and their
use of l&l Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute.
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
111.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
112.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in

(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the

-30-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 40 of 48

account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
113.

In my training and experience, m some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
114.

This application seeks a warrant to search all responsive records and information

under the control of 1& I Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
regardless of whether such communication, record, or other information is stored, held, or
maintained outside the United States.
115.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" ofthe criminal conduct

-31-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 41 of 48

under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent. (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt

(e.g., deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES

116.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent

-32-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 42 of 48

with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION

117.

Based on the forgoing, I request that the Court issue the proposed search warrant.

118.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING

119.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

/~

/-1 . .d-1;

~ d e '1'
Special Agent
Federal Bureau ofinvestigation
Subscribed and sworn to before me on this~ day of August, 2018.

-33-

'

~

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 43 of 48

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following l&l Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by l&l Mail & Media,
Inc. ("l&l Mail"), a company headquartered in Chesterbrook, Pennsylvania:

-1-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 44 of 48

ATTACHMENT B
I.

Information to be disclosed by l&l Mail
To the extent that the information described in Attachment A is within the possession,

custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), l&l Mail is required to disclose
the following information to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 45 of 48

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps information associated with the account;

i.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
J.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

-3-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 46 of 48

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June I, 2015 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

. b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange

Julian
Randy Credico, or any

individual associated with the Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure;
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

-4-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 47 of 48

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating

-5-

 Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 48 of 48

to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.
n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case Document 29-22 Filed 04/28/20 Page 1 of 56

A0 93 (Rev. 11113) Search and Seizure Warrant

 

UNITED STATES DISTRICT COURT

for the
District of Columbia

In the Matter of the Search of 
(Brie?y describe the property to be searched Case: 1 
or identr'j?t the person by name and address) TO I Howell, Beryl A

INFORMATION ASSOCIATED WITH Date 1 9/24/2018
ONE VIRTUAL PRIVATE SERVER Descriptmn: Search Seizure Warrant 


SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the Western District of Michigan

 

 

(identi?; the person or describe the property to be searched and give its location):

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identt?' the person or describe the property to be seizea?li'

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 8, 2018 (not to exceed 14 days)
in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The Of?cer executing this warrant, or an Of?cer present during the execution of the warrant, must prepare an inventory
as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
United States Magistrate Judge)

 

CI Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (checkthe appropriate box)

CI for days (not to exceed 30) until, the facts justifying, the later speci?c date of

Date and time issued: 

Jndge signature

 

City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge

 

 

Printed name and title

 

Case Document 29-22 Filed 04/28/20 Page 2 of 56

A0 93 (Rev. 11l13) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.2 Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date 

 

 

Executing o?icer signature

 

Printed name and title

 

 

Case Document 29-22 Filed 04/28/20 Page 3 of 56

ATTACHMENT A
Property to be Searched
This warrant applies to the virtual private server using the IP address set forth below, which
is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing,

Michigan:

 

Case Document 29-22 Filed 04/28/20 Page 4 of 56

ATTACHMENT 
I. Information to be disclosed by Liquid Web LLC
To the extent that the information described in Attachment A is within the possession,
custody, or control of Liquid Web LLC (hereinafter, ?the Provider?), regardless of where such
information is stored, held or maintained, the Provider is required to disclose the following
information to the government for the server listed in Attachment A (?Target Server?):

a. A forensic copy of the contents of the Target Server described in Attachment 
information pertaining to the tool and process used to create said forensic copy; a
log of the process; veri?cation of the process; a record of who created the copy,
when it was created, and where it was created, including the person?s name, title,
contact numbers, and address;

b. A forensic copy of the undisturbed contents of random access memory of the
running Target Server described in Attachment information pertaining to the tool
and process used to create said forensic copy; a log of the process; veri?cation of
the process; a record of who created the copy, when it was created, and where it
was created, including the person?s name, title, contact numbers, and address;

0. All records of other subscriber information regarding the account, to include u?l
name, physical address, telephone numbers and other identi?ers, records of session
times and durations, the date on which the account was created, the length of
service, the types of services utilized, the address used to register the account,
login-in IP addresses associated with session times and dates, account status,

alternative email addresses provided during registration, methods of connection,

Case Document 29-22 Filed 04/28/20 Page 5 of 56

log ?les, and means and source of payment (including any credit or bank account

numbers);

. All records pertaining to communications between the Provider and any person

regarding the account, including contacts with support services and records of

actions taken.

II. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period ?om June 1, 2015 to the present, including:

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi,? Julian

Case Document 29-22 Filed 04/28/20 Page 6 of 56

individual associated with the Trump Campaign, or any witness in the
investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, Calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, dOCuments, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or
foreign principals;

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);
j. Credit card and other ?nancial information, including but not limited to, bills and

payment records evidencing ownership of the subject account;

Case Document 29-22 Filed 04/28/20 Page 7 of 56

k. All images, messages and communications regarding wiping software, 

or other methods to avoid detection by law enforcement;

l. The identity of any non?U.S. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

In. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed
in subsection 

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-22 Filed 04/28/20 Page 8_ of 56

v-:?irr airs 

i tints:
IN THE UNITED STATES DISTRICT COURT A ., 
elem, Ufa. District Edukiuptey
FOR THE DISTRICT OF COLUMBIA {ionrts for the Bistrict at Goiumbia

IN THE MATTER OF THE SEARCH OF (338,9? 1318?80-02881
INFORMATION ASSOCIATED WITH ONE T0 Howell, Ben/1A.
VIRTUAL PRIVATE SERVER Date I 9/24/2018

Description: Search <3 Seizure Warrant

 



The United States has ?led a motion to seal the above?captioned warrant and related
documents, including the application and af?davit in support thereof (collectively the ?Warrant?),
and to require Liquid Web, LLC (?Liquid Web?), an electronic communication and/or remote
computing services provider headquartered in Lansing, Michigan, not to disclose the existence or
contents of the Warrant pursuant to 18 U.S.C. 2705(b).

The Court ?nds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and af?davit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;

and

Case Document 29-22 Filed 04/28/20 Page 9 of 56

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. 2705(1)), Liquid Web and its 
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until

further order of the Court.

r? 

THE HONORABLE BERYL A. HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

 

Z: Afig?g/y

Date

 DoCument29-22 Filed 04/28/20 Page 10 of 56

UNITED STATES DISTRICT COURT 71?. - - -

 

bid? 16? it are

"Ir. 

for the
- 3 - Chara, 0.3. District it 
District Of Columbia {toasts to; the District of Gommhia

(8.132351%: Case" Wee-02881

or ideiiti?) the persoii of: name and address) TO Beryl A-
ASSOCIATED WITH Ass:gn. Date 2 9/24/2018
ONE VIRTUAL PRIVATE SERVER Description: Search Seizure Warrant


APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identi?J the person or describe the

property to be searched and give its location):

See Attachment A
located in the Western District of

person or describe the property to be seized):

See Attachment 

Michigan there is now concealed (identi?l the

The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more):

[Erevidence of a crime;
dcontraband, fruits of crime, or other items illegally possessed;

lif property designed for use, intended for use, or used in committing a crime;
El a person to be arrested or a person who is unlawfully restrained.

The search is related to a Violation of:

Code Section O?ense Description
52 U.S.C. 30121 Foreign Contribution Ban
18 U.S.C. 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Af?davit for add'l 

The application is based on these facts:
See attached Affidavit.

Continued on the attached sheet.

El Delayed notice of days (give exact ending date if more than 30 days:
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.

My"

Reviewed by Applicant ?5 signature
'2 Patrick J. Myers, Special Agent, FBI

Printed name and title

is requested

 

yle R. Freeny (ASC)

Sworn to before me and signed in my presence.
(f 7f 5/
Date: 
Judge signature

Hon. Beryl A. Howell, Chief US. District Judge

Printed name and title

 

City and state: Washington, DC-

Case Document 29-22 Filed 04/28/20 Page 11 91,5?) 5 
111 11 :1
11111-1 

Cierk, 1.1.11. 111111116151 Bankruptcy

IN THE UNITED STATES DISTRICT COURT

DISTRICT OF COLUMBIA 3911115 for the District of Golumhta
IN THE MATTER OF THE SEARCH OF Case: 1 :18?sc?02881
INFORMATION ASSOCIATED WITH Assigned To Howe?, Beryl A.
ONE VIRTUAL PRIVATE SERVER Assen- Date 9/24/2131 8

 

Description: Search Seizure Warrant

AMENDED AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick J. Myers, being ?rst duly sworn, hereby depose and state as follows:
I INTRODUCTION AND AGENT BACKGROUND

1. I make this af?davit in support of an application for a search warrant under 18
U.S.C. 2703(a), 2703 and 2703(c)(1)(A). The search warrant seeks authorization to
search a private server (?Target Server?) controlled and operated by Liquid Web, LLC, a
company with headquarters in Lansing, Michigan. The Virtual private Server to be
searched, with Internet Protocol address-is believed to be used by Roger
STONE and is described further below and in Attachment A. Upon receipt of the information
described in Attachment A, government-authorized persons will review that information to locate
the items described in Attachment B.

2. I am a Special Agent with the Federal Bureau of Investigation assigned to
FBI Pittsburgh working directly with the Special Counsel?s Of?ce. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this af?davit come from my personal observations, my training and

experience, and information obtained from Other FBI personnel and witnesses. This af?davit is

- Case Document 29-22 Filed 04/28/20 Page 12 of 56

intended to Show merely that there is suf?cient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this af?davit,
there is probable cause to believe that the Target Server contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B. -

JURISDICTION

5. This Court has jurisdiction to issue the requested warrant because it is ?a court of
competent jurisdiction? as defined by 18 U.S.C. 2711. Id. 2703(a), 
Speci?cally, the Court is ?a district court of the United States (including a magistrate
judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C.
2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US. politics for decades. STONE worked on the presidential campaign of

Case Document 29-22 Filed 04/28/20 Page 13 of 56

Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the-Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7. Jerome CORSI is a political commentator who, according to publicly available
information, currently serves as the ?Washington Bureau Chief for Inforwarscom.? According
to publicly-available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of
books regarding Democratic presidential candidates. 'As described further below, CORSI was in

contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

Case Document 29-22 Filed 04/28/20 Page 14 of 56

 

B. Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

9. On January 6, 2017, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following:

Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the

US presidential election. Russia?s goals were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her

electability and potential presidency. We further assess Putin and the Russian

Government developed: a clear preference for President-elect Trump.

10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber
activity?with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or ?trolls.??

11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties.? Further, July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks

and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted

-4-

Case Document 29-22 Filed 04/28/20 Page 15 of 56

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political .
?gures. By May, the GRU had ex?ltrated large volumes of data from the 

12: With respect to the release of stolen materials,the USIC assessed ?with high
con?dence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016. I

15. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third-party cloud?computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the cloud-based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts. -

16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House adviser who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida counties.

Case Document 29-22 Filed 04/28/20 Page 16 of 56

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States V. Vz'klor Borisovz'ch Nety/csho, el (Case No. 

C. Public Interactions with Guccifer 2.0 and 'WikiLeaks

19. On June 14, 2016, the forensic ?rm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
.on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of ?les and mails, I gave to Wikileaks. They iwill publish them soon.?
In that post, Guccifer 2.0 also began releasing hacked DNC documents.

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.

21. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he explains who he is and
why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and- wise
decision. He went to WikiLeaks with the DNC ?les and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest. Broward Republican

Case Document 29-22 Filed 04/28/20 Page 17 of 56

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise? I
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0?s Twitter account was reinstated.

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJStoneJr paying you
back.? Guccifer also sent a private message to @RogerJStoneJr stating ?i?m pleased to say 
great man. please tell me if I can help anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated I
that MANAFORT had worked with a Washington D.C.?based lobbying ?rms to in?uence U.S.
policy toward Ukraine. I

27. On August 21, 2016, using @Ro gerJ Stone] R, STONE tweeted: ?Trust me, it will

Case Document 29-22 Filed 04/28/20 Page 18 of 56

soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a C-SPAN interview that same
day, STONE reiterated that because of the work of a ??mutual acquaintance? of both his and
the public [could]l expect to see much more from the-exiled whistleblower in the
form of strategically?dumped Clinton email batches.? He added: ?Well, ?rst of all, II think Julian
Assange is a hero. .. I think he?s taking on the deep state, both Republican and Democrat. i
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.?

2.8. - On September 16, 2016, STONE said in a radio interview with Boston Herald .
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.? I

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.? I

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 1
of the Ecuadoran Embassy in Londonannouncement which was
part of WikiLeakS? 10-year anniversary celebration STONE told Infowars thathis intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr
to tweet: ?Payload coming. #Lockthemup.?

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

Case Document 29-22 Filed 04/28/20 Page 19 of 56

The Podesta Emails #HillaryClinton #Podesta #imWithI?Ier? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

33. -WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21,
2016 C-SPAN and Twitter references argued publicly that ?[it is] a reasonable assumption to 
or at least a reasonable conclusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any 
in?uence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

- 34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta?s email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true.?

D. Private Twitter Direct Messages with WikiLeaks and ASSANGE

35.? On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Case Document 29-22 Filed 04/28/20 Page 20 of 56

Podesta emails, the Twitter account @Ro gerJ StoneJ sent a private direct message to the Twitter
account @wikileaks.I The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
. to rexamine the strategy of attacking me? cordially 

36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t go there if you don?t want us to correct you.? .

37. I On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct\? me the more people think you?re lying. Your
Operation leaks like a sieve. You need to ?gure out who your friends are.?

38. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJ StoneJ containing a single 'word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to communicate.? I

39. In addition, @RogerJ StoneJ also exchanged direct messages with ASSANGE,
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SANGE in numerous public reports, stating:
?Still nonsense. As a journalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were 

 

1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.

-10-

Case Document 29-22 Filed 04/28/20 Page 21 of 56

indisputably stolen from the goVernment and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don?t knowiof any crime you need to be pardoned for - best regards. That
same day, @JulianAssange responded: ?Between CIA and OM they?re doing quite a lot. On the
Do] side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal.?

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

E. Communications with STONE- and Others Regarding
Forthcoming Leaks

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for - address-n October

17, 2017, Chief Judge Howell issued a search warrant for one of STONES-addresses,

   
 

or about December 19, 2017, Chief Judge Howell issued a search
warrant for email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for iC10ud account. Information recovered pursuant to those

search warrants indicated the following:

42. On or about May 15, 201-6,-emailed CORSI: ?Here is my ?ight
schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

Case Document 29-22 Filed 04/28/20 Page 22 of 56

appears to have forwarded the message to STONE at_ho replied to

CORSI that, ?May meet Manafort guarantee nothing.?

43. On or about May 18, 2016, CORSI emailed STONE at? I

with the title, ?Roger why don't you look this over before I send itt I believe that

 
 
  

CORSI wrote,
nd 1 did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?
44. On July 25, 2016, STONE, usin- sent an email to
CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
Foundation, allegedly.?
45. On or about July 31, 2016, STONE, usi-emailed
CORSI with the subject line, ?Call me The body of the email read: - should see
Assange[.] - should ?nd Bernie [S]anders brother who called Bill a Rapist turn him for
Trump[.] - should or more proof of Bill getting kicked out.?
46. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at
?Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox
. will have me on mid?Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in pre~season games. Time to let more than Podesta to

-12-

Case Document 29-22 Filed 04/28/20 Page 23 of 56

be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad,.has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2

morc dumps? refers to AS SANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016,-n associate of emailed
STONE at The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal
Julian Assange last night.? -ubsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet stated
that in 2018-told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting. AS SAN GE. STONE told-he was joking and
had not actually met ASSANGE.2

48. Through a search of iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email t-to have ?dined? with ASSANGE. For example, an associate of
STONE sent a text to STONE at approximately on August 2, asking ?How did ur meeting

go- in STONE responded. ?It?s this The following day, the associate asked,

?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

Case Document 29-22 Filed 04/28/20 Page 24 of 56

call later heading for airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had gee-location
information indicating that it was taken in Los Angeles.

On or about August 15, 2016, CORSI emailed STONE at

??Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it not over yet. More to come than anyone realizes. Won? treally get started

 

until after Labor Day. I?m in NYC this week. Jerry.?
0. On or about August 31,2016, CORSI emailed STONE at
??Did you get the PODESTA writeup.? STONE replied 

On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatom 1n Giustra scandal. Podesta now under FBI
investigation tied to Ukraine Yanukovych Panama papers reveals Podesta hired by
S[b]erbank, Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

On or about September 6, 2016, CORSI emailed STONE at

Is NY Post going to use the Pedesta [sic] stuff??

On or about September 24, 2016-emailed CORSI, will have much

   

more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded, ?We have

secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about

it again today ?-wrote_ back, ?Awaiting secret ?le. Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!? CORSI responded, ?Keep me posted
about In a subsequent meeting with investigators-indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

Case Document 29-22 Filed 04/28/20 Page 25 of 56

54. On or about October 3, 2016, an associate of STONE emailed STONE at

and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote

back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will

 

be out in Jan. Many scores will be settled.? The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to Worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s
important.? I

55. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. e1ection~related documents would all come out before Election Day.

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.?

57. That same day, BANN ON emailed STONE a ?What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill him and-the London police are standing done BANNON wrote back, ?He didn?t
cut deal w/ STONE replied, ?Don?t think so BUT his lawyer - is a big

democrat.?

-15-

Case Document 29-22 Filed 04/28/20 Page 26 of 56

58. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October ?11, 2016 email to STONE
was about WikiLeaks. Upon further questiOning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released. I

59. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post. reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.?

60. According to phone records? at approximately
. 11:27 AM, CORSI placed a call to STONE, which STONE did not answer.

61. At approximately STONE received a phone call from the Washington
Post. The call lasted approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for
approximately seventeen minutes. 

63. At approximately CORSI called STONE and the two ?spoke for

approximately twenty minutes1d74714-80e5?1 1e6~8 

-16-

Case Document 29-22 Filed 04/28/20 Page 27 of 56

64. At approximately the Washington ?Post published a story regarding the
Access HollywOod tape.

65. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from'John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, CORSI emailed STONE usin? expect

that much of next dump focus, setting stage for Foundation debacle.?
66. At approximately an author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly Communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the
newly?released Podesta emails. Approximately ten minutes later, STONE, using
forwarded-message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual.

G. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI responded to STONE, ?Ok.'1 understand.? Approximately twenty
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job

numbers.? 

68. On or about Wednesday, October 12, 2016, at approximately STONE,

using?emailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?0k. Monday. The remaining stuff on

-17-

Case Document 29-22 Filed 04/28/20 Page 28 of 56

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice?? .

69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at boll?it?ll the subject
line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that
?Podesta is at the heart of a Russian- government money laundering operation that bene?ts
?nancially Podesta personally and the Clintons through the Clinton Foundation.?

70. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed
CORSI back via the -Account, ?Got them and used them.?

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

Joule 84 ties to RUSSIA MONEY LAUNDERIN to
CLINTON STONE responded, ?Nice but I was hoping for a pieCe I could
post under my by-line since I am the one under attack by Podesta and now Mock.? CORSI
wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me
like - skimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund account, there?s no telling how much. money he laundered, or where it ended up.

Nothing in Clinton Foundation audited ?nancials or IRS Form 9908 about received Via

-18-

Case Document 29-22 Filed 04/28/20 Page 29 of 56

Russia MetcombankL] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since 1 have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI
sent STONE an email a-with the subject, STONE article
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although I
have had some back-channel communications with. Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how much money did? a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by -with the money
transferred Via Deutsche Bank and Trust Company Americas in New York City, with thelmoney
ending up in a private bank account in the Bank of America that is operated by the Clinton
Founda?on?? I

73. On or about October 14, 2016, CORSI sent a message to his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s I
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

?On Assange, can you call me now before STONE responded, ?Missed just
landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

Case Document 29-22 Filed 04/28/20 Page 30 of 56

75. On or about October 17, 2016, CORSI emailed STONE at

ASSANGE. . .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email

 

with the header information stripped out, showing only the body text. The email read, I
?gurcd this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It?s what they used to call a ?Mexican stand offH? Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC Wins, Assange can
kiss his life away. Interesting gambit Assange has to play out-He?s called Pedesta?s bluff and
raised him the election.?

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.? .

77. On or about October 19, 2016, STONE published an article on Breitbart.com in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported theistory on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

78. On or about November 8, 2016, the United States presidential election took place.

I 79. I On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.?

-20-

Case Document 29-22 Filed 04/28/20 Page 31 of 56

80. On or about November 10, 2.016, CORSI messaged STONE at his iCloud

account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

Case Document 29-22 Filed 04/28/20 Page 32 of 56

 

Case Document 2922 Filed 04/28/20 Page 33 of 56

 

I. Congressional Testimony and Public Statements About His Relationship
with Wikileaks . 

88. on September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Pedesta?s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. . . .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must'be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny. . . .

et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assurerme of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go-between? and ?mutual friend.? All of these monikers are equally
true.

-23..

Case Document 29-22 Filed 04/28/20 Page 34 of 56

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.
Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or

encouragement been in any type of contact with Julian Assange?

MR. STONE: No.

Q: So throughout the many months in which you represented you were either in

communication with Assange'or communication through an intermediary with Assange,

you were only referring to a single fact that you had con?rmed with the intermediary 

MR. STONE: That 

Q: was the length and the breadth of what you were referring to?

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

J. Messaging to Randy CREDICO about ?Back channel?

91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identi?ed as his ?intermediary? to AS SAN GE), messaged STONE, ?My
lawyer wants to see me today.? STONE responded, ??Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24?

Case Document 29-22 Filed 04/28/20 Page 35 of 56

back, ?That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what? Nothing
happening in DC the day before Thanksgiving why are busting my chops??

93. 011 or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them which he himself said in public b4 11 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it on.-I told-you to watch his Tweets in October not before that I knew nothing
about the DNC stuf?j I just followed his STONE respOnded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretaiy in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I i
guess Schiff will try to get one of us indicted for 

94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, ?Forensic evidence proves that there is no back Channel. So
now you can relax.?

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.

96. - On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? In a public Facebook post, STONE further stated that ?Credico merely 

-25-

Case Document 29-22 Filed 04/28/20 Page 36 of 56

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-mails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could have just told him the truth that you didn?t have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If
you testify you?re a fool. Because of tromp [Sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you?re stupid enough to I

98. STONE and CREDICO continued to IneSSage each other on or about December 1,

2017. In response to message about being ?stupid enough to testify,? CREDICO told

 

4 Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI.

-26c

Case Document 29-22 Filed 04/28/20 Page 37 of 56

STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or-about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, ?Hope don?t fuck Up my. efforts to get Assan'ge a CREDICO
messaged STONE, have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.?

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy
logs . . . 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about anuary
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get
off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and have all those emails from September of 201 6 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown

reperters copies of email messages he had received from STONE in the prior few days that

stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my

lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to take that dog away

-27-

Case Document 29-22 Filed 04/28/20 Page 38 of 56

from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 

104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . . . It was sent in response to that. Weltalked about it too.
He was depressed about it. Or was he lying.? The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.

K. The Target Server and Efforts to Remove Documents and Information
from his-Residence

105. On or about Friday, May 18, 2016_an assistant to STONE, was
voluntarily interviewed by investigators from the Special Counsel?s Of?ce-old
investigators that he became assistant in Florida in 2015, and that during the summer
of201?6, he acted as right-hand man. -old investigators, in substance and
in part, that STONE was scared about getting hacked and scared about the government
?snooping? on him, and that STONE was in the process of hardening his home systems and
trying to move things off his desktop computer to a secure semen-further advised
that STONE had a new t?tech guy? assisting him. I

106. -old the FBI that as part of this process, STONE was his

data but not deleting it. Analysis of iCloud, which was searched pursuant to a warrant

 

5 
threatened?do g-13 S91 13 70.html 

6 

-23-

Case Document 29-22 Filed 04/28/20 Page 39 of 56

issued by Chief Judge Howell on or about August 3, 2018, nonetheless indicates that call logs
and chats occurring prior to March 1, 2018 have been deleted. Call logs and/or chats from
certain additional periods of time (for- example, June 29, 2018 to July 13, 2018) also appear to
have been deleted. To date, the FBI has not been able to determine when those deletions
occurred.

107. On or about May 22,2018_ who provided tech services for
iMacs, was voluntarily interviewed by the FBI by telephone (having previously been
interviewed in person). - stated that wife had hired someone else to set up an
offsite remote server for data at their Fort Lauderdale residence. - identi?ed the individual

. who set up the 'server as -f Freestyle Systems, whom-net in person at
house in early April. -indicated that STONE was concerned with his business
and work if his computers were seized and he did not have access to them, and he wanted to be
able to continue to work, write, and get the word out in that event. -stated that he believed
that the remote server is hosted by Liquid Web and that STONE pays approximately $5 00 per
month for it. I

108. Based on open source information, I know that Liquid Web, LLC is a US
provider offering dedicated servers, VPS hosting, and cloud servers with Linux or Windows.

?the government obtained subscriber records from Liquid

Web for an account opened by-Those records Show that on or about March 27, 2018,

 

- purchased a server described as ?Item: DS.123 0V5 - Dedicated Server - Single Intel Xeon
CPU - US Central Zone? for $324 per month (?Target Server?). On or about the same day, a
new inventory entry was made in the Liquid Web system, reading ?New entry in inventory

[223 605:2869647]: description: owner_rel_id:

-29-

Case Document 29-22 Filed 04/28/20 Page 40 of 56 -

In my training and experience, this indicates that the server purchased by

-was named?According to public WHOIS records, the domain

109 9. According to records obtained from Liquid Web the name of the Target Server

was changed to_on or about March 28, 2018. The Target Server was

assigned the IP addres- Based on a search conducted on shodan.io, a specialized

 

search engine that scans information about all devices connected to the Internet, the Target

Server?s con?guration has not been changed since March 28, 2018.

110. According to communications produced by 
- on or about March 27, 2018~the same day that-?rst leased the Target
wife tekte-Would you be willing to speak to - who has

setting [sic] up a hosted server for Rogers computer? . . . .All of Rogers data is still on his
desktop but because of his issues with government agencies and after a total backup of his
system and a forensic audit of all the emails and documents on his computer it was concluded
that all future information would be safer on an outside server. . . 

111. On or about April 9, 2018-sent STONE an email at

ith the subject, ?Remote server update.? In that email,-stated,

  

?After ?nding out he couldn?t wipe the data from yorir drives ?_(new IT guy)
wanted us to buy new hard drives and replace the drives on your iMac (and have [Stone?s
attorney] put them away in safety deposit box)? -lso told STONE that, if the data
Was migrated onto a server that runs Windows (which the Target Server does), ?[b]oth

iMacs . . . would need to be put somewhere out of the house/apt to accomplish ?getting data out

of the house.??

Case Document 29-22' Filed 04/28/20 Page 41 of 56

112. April 9, 2018 email suggests that, at the rim-id not
understand tha- had already stood up a server for STONE. In substance-

recommended against the use of a remote Windows server, and asked STONE to ?[l]et me know.

if you want to stay put, or go to windows server wit-

113. According to communications provided by-lo the FBI, on or about April

25, 2018,.exte- just got a call fiom- and it appears Roger IS going
forward with the server idea.? When-asked exactly?-vas

doing-replied, the ?les to the server . . . 

114. Based on the foregoing, and my training and experience, there is probable to
cause to believe that the Liquid Web remote server with IP addres_ e. the Target
Server, is a dedicated server used by, and set up on behalf of, STONE, and that the Target
Server contains evidence, fruits, and/or instrumentalities of the Subject Offenses.

BACKGROUND CONCERNING LIQUID WEB

115. Based on open source information, I know that Liquid Web, LLC, which hosts the
Target Server, is a company based in Lansing, Michigan, which offers dedicated servers, VPS
hosting, and cloud servers with Linux or Windows. The Target Server is among a number of
VPSs running on physical servers controlled by Liquid Web. According to public WHOIS data,
the Target Server is located in Lansing, Michigan. I

116. Based on my knowledge, training, and experience, I know that computer ?les or
remnants of such ?les can be recovered months or even years after they have been downloaded
onto a storage medium, deleted, or viewed via the Internet. Electronic ?les downloaded to a
storage medium can be stored for years at little or no cost. Even when ?les have been deleted,

they can be recovered months or years later using forensic tools. This is so because when a person

-31-

Case Document 29-22 Filed 04/28/20 Page 42 of 56'

?deletes? a ?le on a computer, the data contained in the ?le does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.

117. Therefore deleted ?les, or remnants of deleted ?les, may reside in free space or
slack space that is, in space on the storage medium that is not currently being used by an active
?le ??for long periods of time before they are overwritten. In addition, a computer?s operating
system may also keep a record of deleted data in a ?swap? or ?recovery? ?le.

118. Wholly apart from user-generated ?les, computer storage media contain electronic
evidence of how a computer has been used, what it has been used for, and who has used it. To
give a few examples, this forensic evidence can take the form of operating system con?gurations,
artifacts from operating system or application operation, ?le system data structures, and virtual
memory ?swap? or paging ?les. Computer users typically do not erase or delete this evidence,
because special software is typically required for that task. However, it is technically possible to
delete this information.

1 19. Similarly, ?les that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or ?cache.? The browser often maintains a ?xed
amount of hard drive space devoted to these ?les, and the ?les are only overwritten as they are
replaced with more recently viewed Internet pages or if a user takes steps to delete them.

120. As further described in Attachment B, this application seeks permission to locate
not only the computer ?les that might serve as fruits and instrumentalities or the crimes described
in the warrant, but also for evidence, also described in Attachment B, that established how 
computers were used, the purpose of their use, who used them, and when.

121. Data on the storage medium not currently associated with any ?le can provide

evidence of a ?le that was once on the storage medium but has since been deleted or edited, or of

-32-

Case Document 29-22 I Filed 04/28/20 Page 43 of 56

a deleted portion of a ?le (such as a paragraph that has been deleted from a word processing 
Virtual memory paging systems can leave traces of information on the storage medium that show
what tasks and processes were recently active. Web browsers, email programs, and chat programs
store con?guration information on the storage medium that can reveal information such as online
nicknames and passwords. Operating systems can record additional information, such as the times
the computer was in use. Computer ?le systems can record information about the dates ?les were
created and sequence in which they were created.

122. Forensic evidence on a computer can also indicate who has used or controlled the
computer. This ?user attribution? evidence is analogous to the search for ?indicia of occupancy?
while executinga search warrant at a residence. For example, registry information, con?guration
?les, user pro?les, email, email address books, ?chat,? instant messaging logs, photographs, and
correspondence (and the data associated with the foregoing, such as ?le creation and last accessed
dates) may be evidence of who used or controlled the computer at a relevant time.

123. A person with appropriate familiarity with how a. computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how computers
were used, the purpose of their use, who used them, and when.

124. The process of identifying the exact ?les, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion
is a dynamic process. While it is possible to specify in advance with particularity a description of
the records sought, evidence of this type is not always data that can be merely reviewed by a review
team and passed along to investigators. Whether data stored on a computer is evidence may
depend on other information stored onthe computer and the application of knowledge about how

a computer behaves.

_33_

Case Document 29-22 Filed 04/28/20 Page 44 of 56

125. The FBI anticipates executing this warrant under the above-cited ECPA provisions
by using the search warrant to compel Liquid Web to provide a copy of the Target Server,
including a copy of the memory used by the Target Server. Generally speaking, this copy

duplicates every bit and byte on the Target Server, including all files, slack space, Master File

Table, and metadata in exactly the ordcr they appear on the original; in order words, the taking of 

a complete electronic picture of the computer?s data, including all hidden sectors deleted ?les, and
memory. In my training and experience, the data associated with the Target Server, including
artifacts such as slack space and deleted ?les, are segregated as part of the Target Server and can
be imaged separately from other VPSS that may be stored on the same physical server. After
obtaining a copy of the Target Server, FBI agents or their experts will review that information to
locate the items described in Section II of Attachment B.

126. This application seeks a warrant to search all responsive records and information
under the control of Liquid Web, a provider subject to the jurisdiction of the Court, regardless of
where Liquid Web has chosen to store such information. The government intends to require,
pursuant to the warrant, the disclosure of the contents of wire or electronic communications and
any records of other information pertaining to the customers or subscribers if such communication,
records, or other information is within Liquid Web?s possession, custody, or control, regardless Iof
where that information is stored.

127. As noted above,- told the FBI that, in connection with efforts
to move material off his desktop to a secure server, STONE was data. Accordingly, it
is possible that part or all of the data on the Target Server is In my training and
experience, I know that if the FBI obtains a forensic copy of the undisturbed contents of random

access memory of the running Target Server, which is sought in this application, it may be

-34-

Case Document 29-22 Filed 04/28/20 Page 45 of 56

possible to carve data to locate password. If this application is granted and the
server is, in fact, the FBI intends to use that process to locate the password through
- forensic means, and to use the password to access the server in execution of the warrant.
FILTER REVIEW PROCEDURES

128. Review of the items described in Attachment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney?client and
other operative privileges. The procedures include use, if necessary, of a designated ??lter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
129. Based on the forgoing, I request that the Court issue the proposed search warrant.
130. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-3 5-

Case Document 29-22 Filed 04/28/20 Page 46 of 56

REQUEST FOR SEALING
131. I further request that the Court order that all papers in support of this application,

including the af?davit and search warrant, be sealed until ?irther order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

Patrick J. Myers

Special Agent

Federal Bureau of Investigation

xi 7?4
Subscribed and sworn to before me on this 2 /day of September, 2018.

. The Honorable Beryl A. Howell .
Chief United States District Judge

?36-

Case Document 29-22 Filed 04/28/20 Page 47 of 56

ATTACHMENT A
Property to be Searched
This warrant applies to the Virtual private server using the IP address set forth below, which

is controlled and/or operated by Liquid Web, LLC, a company headquartered i? Lansing,

. Michigan:

 

Case Document 29-22 Filed 04/28/20 Page 48 of 56

ATTACHMENT 
1. Information to be disclosed by Liquid Web LLC
To the extent that the information described in Attachment A is within the possession,
custody, or control of Liquid Web LLC (hereinafter, ?the Provider?), regardless of where such
information is stored, held or maintained, the Provider is required to disclose the following
information to the government for the server listed in Attachment A (?Target Server?):

a. A forensic copy of the contents of the Target Server described in Attachment 
information pertaining to the tool and process used to create said forensic copy; a
log of the process; veri?cation of the process; a record of who created the copy,
when it was created, and where it was created, including the person?s name, title,
contact numbers, and address;

A forensic copy of the undisturbed contents of random access memory of the
running Target Server described in Attachment information pertaining to the tool
and process used to create said forensic copy; a log of the process; verification of
the process; a record of who created the copy, when it was created, and where it
was created, including the person?s name, title, contact numbers, and address;

c. All records of other subscriber information regarding the account, to include u?l
name, physical address, telephone numbers and other identi?ers, records of session
times and durations, the date on which the account was created, the length of
service, the types of services utilized, the IP address used to register the account,
login-in IP addresses associated with session times and dates, account status,

alternative email addresses provided during registration, methods of connection,

Case Document 29-22 Filed 04/28/20 Page 49 of 56

log ?les, and means and source of payment (including any credit or bank account

numbers);

. All records pertaining to communications between the Provider and any person

regarding the account, including contacts with support services and records of

actions taken.

11. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A-

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from June 1, 2015 to the present, including:

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited-to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to 

communications or meetings involving Jerome Corsi, - Julian

Case Document 29-22 Filed 04/28/20 Page 50 of 56

individual associated with the Trump Campaign, or any witness in the
investigation;

0. Communications, records, documents, and other ?les related to any expenditure, -
independent expenditure, or disbursement for an electioneering communication;

d. Records of any ?uids or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

c. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by-any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or
foreign principals;

g. Evidence indicating how and when the account was accessed or used, to determine,
the geographic and chronological context of account access, use, and events relating

- to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);
j. Credit card and other ?nancial information, including but not limited to, bills and

payment records evidencing ownership of the subject account;



Case Document 29-22 Filed,04/28/20 Page 51 of 56

k.

All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

The identity of any person(s)iincluding records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

All existing printouts from original storage which concern the categories identi?ed

in subsection 

- Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with

professional responsibility requirements concerning the maintenance of attorney-client and other

operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-22 Filed 04/28/20 Page 52 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT 0" m? EDI A

Case: 

IN THE MATTER OF THE SEARCH OF Assigned To Howell Beryl A
INFORMATION ASSOCIATED Assign. Date -
VIRTUAL PRIVATE SERVER 1 Description: Search 8 Seizure Warrant

 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 2705(b)

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above?captioned warrant and the application and af?davit
in support thereof (collectively herein the ?Warrant?). under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. 2705 In regard to the non?
disclosure, the prOposed Order would direct Liquid Web, LLC (?Liquid Web?), an electronic
communication and/or remote computing services provider headquartered in Lansing, Michigan,
not to notify any other person (except attorneys for Liquid Web for the purpose of receiving legal
advice) of the existence or content of the Warrant for a period of one year or until further order of
the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent povver to seal court I ?lings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (DC. Cir. 1980) (citing
Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of I
the Warrant. See Washington Post v. Robinson, 935 .2d 282, 287?89 (DC. Cir. 1991).

2. I In addition, this Court has jurisdiction to issue the requested order because it is ?a

court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

Case Document 29-22 Filed 04/28/20 Page 53 of 56

?district court of the United States . . . that has jurisdiction over the offense being investigated.?
18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, DC. See 18 U.S.C. 3237.

3. Further, the Court has authority to require non-disclosure of the Warrant under 1.8
U.S.C. 2705(b). Liquid Web provides an ?electronic communications service,? as defined in 18
U.S.C. 2'510( 15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The
Stored Communications Act 18 U.S.C. 2701?2712, governs how Liquid Web may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber information? using a subpoena, Section 2703(d) allows the Government to obtain other
?non-content? information using a court order, and Section 2703 allows the
. Government to obtain contents of comr?unications using a search warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
Subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
noti?cation. In relevant part, Section 2705(b) provides as follows:I

Preclusion of notice to subject of governmental access. A governmental

entity acting under section 2703 . . . may apply to a court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court

deems appropriate, not to notify any other person of the existence of the warrant,

subpoena, or court order. The court shall enter such an order if it determines that

there is reason to believe that noti?cation of the existence of the warrant, subpoena,
or court order will result in?

 

1 Section 2705 contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2703(b)(1)(B), but the Government does not seek to use-the proposed Order for any legal process
under that provision.

Case Document 29-22 Filed 04/28/20 Page 54 of 56

(1) endangering the life or physical safety of an individual;
?ight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time thatthe court determines is appropriate. Once the

government makes the required showing under 2705(b), the court is required to
issue the non-disclosure order.

In re AppZication for Order of Nondisclosure Pursuantto 18 US. C. 59 2705 for Grand Jury
Subpoena 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Liquid Web not to notify any other person (except attorneys for Liquid Web for the
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until
?irther order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating Violations of 1 8 U. S.C.
2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a
felony), 18 U.S.C. 371 (conspiracy), 18 U.S.C. 951 (acting as an unregistered foreign agent),
18 U.S.C. 1030 (unauthorized access of a protected computer); 18 U.S.C. 1343 (wire hand),
18 U.S.C. 1340 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject

Offenses?), in connection with efforts to compromise the networks of the Democratic National

3

 Case Document 29-22 Filed 04/28/20 Page 55 of 56

Convention the Democratic Congressional Campaign Committee and the
email accounts of US. persons involved in the 2016 presidential election, followed by the public
release of stolen materials through various outlets.

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Liquid Web and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for Liquid Web for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order

is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
FBI. Once alerted to this information, potential targets vvould be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and avoid future prosecution. In particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or digital evidence relating to their
criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no

longer needed, the Government will netify the Court and seek appropriate relief.

Case Document 29-22 Filed 04/28/20 Page 56 of 56

9. There is, therefore, reason to believe that noti?cation of the existence of the I
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287?89.

10. Based on prior dealings with Liquid Web, the United States is aware that, absent a
court order under Section 2705(b) commanding Liquid Web not to notify anyone about a legal
request, Liquid Web may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
exiStence of the warrant prior to producing the material sought.

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and af?davit in support thereof, and all attachments
thereto and other related materials be placed under seal, and ?rrtherrnore, that the Ceurt command
Liquid Web not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of
one year or until further order of the Court. -

Respectfully submitted,

ROBERT S. MUELLER, 
Special Couns

Dated: 4/l ?87 By:

 

Ky . Freeny \g
Th cial Counsel?s f?ce
(202) 616-3812

Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 1 of 59
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

Case: 1: 18-sc-02905
Assigned To: Howell, Beryl A.
Assign. Date : 9/26/2018
Description: Search & Seizure Warrant

(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY TWITTER

)

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
October 9, 2018
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell., Ch ief U.S. District Judge
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3 !03a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:
City and state:

-tkl2P1J?g:/- f..:. (}o/;);
Wash ington, DC

- - - - - - -- - - - ---

Judge 's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 2 of 59
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 3 of 59

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 4 of 59

ATTACHMENT B
I.

Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
information to the government for each account listed in Attachment A:
A.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

B.

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

C.

All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;

D.

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

E.

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");

F.

All photographs and images in the user gallery for the account;

G.

All location data associated with the account, including all information collected by the
"Tweet With Location" service;

H.

All information about the account's use of Twitter' s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

I.

All data and information that has been deleted by the user;

J.

A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);

K.

A list of all users that the account has "unfollowed" or blocked;

L.

All "lists" created by the account;
-2-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 5 of 59

M.

All information on the "Who to Follow" list for the account;

N.

All privacy and account settings;

0.

All records of Twitter searches performed by the account, including all past searches saved
by the account;

P.

All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;

Q.

All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

R.

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

S.

All data and information associated with the profile page, including photographs;

T.

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;

U.

The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;

V.

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

W.

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
information regarding the types of devices used to access the account;

X.

All activity logs for the account;

Y.

All location information for the account, including all location data collected by any
plugins or widgets;

Z.

The types of service utilized by the user;
-3-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 6 of 59

AA.

All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;

BB.

All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;

CC.

All information about connections between the account and third-party websites and
applications, including any Twitter, Face book or other social networking accounts to which
posts from the account are sent;

DD.

All data and information that has been deleted by the user;

EE.

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

FF.

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

GG.

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
identifier, or any other account or device identifier;

HH.

Information regarding accounts linked to accounts to which the Target Accounts are linked;

II.

All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from March 1, 2016 to the present, including:
-4-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 7 of 59

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
, Randy Credico, any

individual associated with the Trump Campaign, or any witness in the
investigation;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f..

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 8 of 59

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s );

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 9 of 59

III.

Review Protocols

Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-7-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 10 of 59
AO 106 (Rev. 04/10) Application for a Search Warrant

UNITED STATES DISTRICT COURT

F

for the
District of Columbia

SEP 2. 6 2018
fWk U.S. District & Bankrupt(;Y

In the Matter of the Search of
(JJricjly describe ihe p roperty to be searched
or ide mijj, 1/w person by name and address)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY TWITTER

)
)
)
)
)
)

r.~~~ts for tila 0\!Hict Di f,{llumbla

Case: 1: 18-sc-02905 1
Ass!gned To: Howell, Beryl A.
Assign. Date : 9/26/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a foderal Jaw enfo rcement officer or an attorney for the government, request a search wa1rnnt and state under
penalty of pe1jury that I have reason to beli.eve that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the

- --

Northern
-

--

District of

California

_ __ ____c:....;......;.;__.- - - - " - - --

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;

~ p~operty designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

b/

Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ __ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
IKyle R. Freeny (ASC)

Applicant's signature

Patrick J. Myers, Special Agent, FBI
Printed name a.nd title

Sworn to before me and signed in my presence.

Judge's signature

City and state: Washington, D.C.

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 11 of 59

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY TWITTER, INC.

SEP 2 6 2016
Clsrk, U.S. Dlst(fct & Bankruptcy
Courts for the Dfstrlct of Columbia

Case: 1:18-sc-02905
Assigned To : Howell, Beryl A.
Assign. Date : 9/26/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the Twitter account

, which is

stored at premises owned, maintained, controlled or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California.

Upon receipt of the information described in Attachment A, government-authorized persons will
review that information to locate the items described in Attachment B.
2.

I am a Special Agent with the Federal Bureau of Investigation ("FBI") assigned to

FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is

-1-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 12 of 59

intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of

-2-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 13 of 59

Donald J. Trump (the "Campaign") until August 2015 . Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7.

Jerome CORSI is a political commentator who, according to publicly available

information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

.,3_

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 14 of 59

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 15 of 59

in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

-5-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 16 of 59

18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

the DNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

-6-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 17 of 59

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJr, STONE tweeted: "Trust me, it will

-7-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 18 of 59

soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16., 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,

"Wednesday @ HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

-8-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 19 of 59

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked

-9-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 20 of 59

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 21 of 59

indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONE's

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

emailed CORSI: "Here is my flight

On or about May 15, 2016,

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI

-11-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 22 of 59

appears to have forwarded the message to STONE a

who replied to

CORSI that, "May meet Manafort -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE a

with the title, "Roger -- why don't you look this over before I send it to

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

sent an email to

On July 25, 2016, STONE, using

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.]
Trump[.]
46.

emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist- turn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,

for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to

-12-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 23 of 59

be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

an associate of STONE's, emailed

On or about August 5, 2016,

STONE at

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SAN GE. STONE told

he was joking and

had not actually met AS SAN GE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will

-13-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 24 of 59

call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.
On or about August 15, 2016, CORSI emailed STONE at

49.

"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution- Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 25 of 59

54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer
democrat."

-15-

is a big

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 26 of 59

58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
59.

According to a publicly available news article, 3 at approximately 11 AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875 e-2cl bfe94 3b66_story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 27 of 59

64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE usin

"I expect

that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
68.
usin

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on

-17-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 28 of 59

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

and

with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the
71.

Account, "Got them and used them."

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, ''Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

-18-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 29 of 59

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

, a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

-19-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 30 of 59

75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no'advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."

-20-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 31 of 59

80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

 Case Document 29-23 Filed 04/28/20 Page 32 of 59

 

Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 33 of 59

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks
88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such asse1iions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be con-ect. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.

-23-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 34 of 59

89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement heen in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Ban-el Yet?" In that aiiicle, STONE stated: "[l]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."

J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote

-24-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 35 of 59

back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one of us indicted for perjury[.]"
94.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HP SCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]

-25-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 36 of 59

confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
97.

On or about December 1, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of tis has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you' re a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you' re stupid enough to testify[.]"
98.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told

4

Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 37 of 59

STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't kriow how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year."

I 02.

CREDI CO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103.

On or about April 13, 2018, news repo1is stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away

-27-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 38 of 59

from you," referring to CREDICO's therapy dog. CREDJCO stated that it was "ce11ainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
K. The Target Account

5

https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-ro ger-stonethreatened-dog-135911370 .html
6
https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 39 of 59

BACKGROUND CONCERNING TWITTER
110.

Twitter owns and operates a free-access social-networking website of the same

name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own

-29-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 40 of 59

profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also pennits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
more detail below.
111.

Upon creating a Twitter account, a Twitter user must create a unique Twitter

usemame and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
usemame, password, and name without having to open a new Twitter account.
112.

Twitter asks users to provide basic identity and contact information, either during

the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
113.

A Twitter user can post a personal photograph or image (also known as an

"avatar") to his or her profile, and can also change the profile background or theme for his or her
account page. In addition, Twitter users can post "bias" of 160 characters or fewer to their profile
pages.
114.

Twitter also keeps IP logs for each user. These logs contain information about the

user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.

-30-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 41 of 59

115.

As discussed above, Twitter users can use their Twitter accounts to post "Tweets"

of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
of all "mentions" and "replies" for that username ).
116.

Twitter users can include photographs or images in their Tweets. Each Twitter

account also 'is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
117.

Twitter users can also opt to include location data in their Tweets, which will

reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.
118.

When Twitter users want to post a Tweet that includes a link to a website, they

can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
119.

A Twitter user can "follow" other Twitter users, which means subscribing to

those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that user (i.e., the user's "followers" list) and a list of people whom that user follows

(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are

-31-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 42 of 59

visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
120.

In addition to posting Tweets, a Twitter user can also send Direct Messages

(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular user, but older DMs are stored on Twitter's database.
121.

Twitter users can configure the settings for their Twitter accounts in numerous

ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
will not be sent to the user's phone.
122.

Twitter includes a search function that enables its users to search all public

Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
123.

Twitter users can connect their Twitter accounts to third-party websites and

applications, which may grant these websites and applications access to the users' public Twitter
profiles.
124.

If a Twitter user does not want to interact with another user on Twitter, the first

user can "block" the second user from following his or her account.

-32-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 43 of 59

125.

In some cases, Twitter users may communicate directly with Twitter about issues

relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
from using Twitter's services.
126.

As explained herein, information stored in connection with a Twitter account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a r~sidence. For example, profile contact information, communications,
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of

-33-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 44 of 59

Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
automatically added to "tweeted" communications. This geographic and timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal
evidence from law enforcement).
127.

Therefore, the computers of Twitter are likely to contain all the material described

above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other account
information.

FILTER REVIEW PROCEDURES
128.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
129.

Based on the forgoing, I request that the Court issue the proposed search warrant.

130.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-34-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 45 of 59

REQUEST FOR SEALING

131.

I fmther request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

c~
Special Agent
Federal Bureau of Investigation
Subscribed and sworn to before me on this ~,1Zy of September, 2018.

~d/~

The Honorable Beryl A. Howell
Chief United States District Judge

-35-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 46 of 59

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Twitter accoun~s, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California:

- 1-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 47 of 59

ATTACHMENT B

I.

Information to be disclosed by Twitter
To the extent that the info1mation described in Attachment A is within the possession,

custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
information to the government for each account listed in Attachment A:
A.

All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

B.

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

C.

All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;

D.

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

E.

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");

F.

All photographs and images in the user gallery for the account;

G.

All location data associated with the account, including all information collected by the
"Tweet With Location" service;

H.

All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

I.

All data and information that has been deleted by the user;

J.

A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);

K.

A list of all users that the account has "unfollowed" or blocked;

L.

All "lists" created by the account;
-2-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 48 of 59

M.

All information on the "Who to Follow" list for the account;

N.

All privacy and account settings;

0.

All records of Twitter searches performed by the account, including all past searches saved
by the account;

P.

All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;

Q.

All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

R.

All past and current usemames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

S.

All data and information associated with the profile page, including photographs;

T.

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;

U.

The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;

V.

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

W.

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
information regarding the types of devices used to access the account;

X.

All activity logs for the account;

Y.

All location information for the account, including all location data collected by any
plugins or widgets;

Z.

The types of service utilized by the user;
-3-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 49 of 59

AA.

All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;

BB.

All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;

CC.

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

DD.

All data and information that has been deleted by the user;

EE.

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

FF.

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

GG.

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identifier;

HH.

Information regarding accounts linked to accounts to which the Target Accounts are linked;

II.

All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from March 1, 2016 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 50 of 59

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, any

individual associated with the Trump Campaign, or any witness in the
investigation;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 51 of 59

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 52 of 59

III.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect ~vidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-7-

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 53 of 59

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY TWITTER

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct TWITTER, LLC ("TWITTER"), an electronic
communication and/or remote computing services provider headquartered in San Francisco,
California, not to notify any other person (except attorneys for TWITTER for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing

Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 54 of 59

"district court of the United States ... that - has jurisdiction over the offense being investigated."
18 U.S.C. § 2711 (3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b). TWITTER provides an "electronic communications service," as defined in 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§,2701-2712, governs how TWITTER may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant paii, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endangering the life or physical safety of an individual;
1

Section 270.S(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.

2

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 55 of 59

(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(h) must he issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command TWITTER not to notify any other person (except attorneys for TWITTER for the
purpose ofreceiving legal advice) of the existence of the Subpoena for a period of one year or until
further order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

The Federal Bureau oflnvestigation ("FBI") is investigating violations of 18 U.S.C.

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject

3

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 56 of 59

· Offenses"), arising out of the conduct of Roger Stone and others. It does not appear that Stone is
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this
warrant to Stone could lead him to destroy evidence or notify others who may delete information
relevant to the investigation.
7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that TWITTER and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and avoid future prosecution. In particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or encrypt digital evidence relating to their
criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

4

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 57 of 59

9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b )(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in confidentiality to justify the government's sealing request.

See Robinson, 935 F.2d at 287-89.
10.

Based on prior dealings with TWITTER, the United States is aware that, absent a

court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
TWITTER not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of
one year or until further order of the Court.
Respectfully submitted,
ROBERTS. MUELLER, III
Special Counsel
Dated: :) /2 (o /l'3

By:
Kyl
The
cial Counsel's Office
(202) 616-3812

5

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 58 of 59

1L'
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION AS SOCIA TED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY TWITTER

SEP 2 6 2018
Clerk, U.S. District & Bankruptcy
Courts for the District of Golumb/a

Case: 1:18-sc-02905
Assigned To : Howell, Beryl A.
Assign. Date : 9/26/2018
Description: Search & Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require TWITTER, INC. ("TWITTER"), an electronic communication and/or remote
computing services provider headquartered in San Francisco, California, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 59 of 59

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.

TIIEHON&t~LL

CHIEF UNITED STATES DISTRICT JUDGE

2

 Case Document 29-24 Filed 04/28/20 Page 1 of 58

A0 93 (Rev. 1 1113) Search and Seizure Warrant

 

UNITED STATES DISTRICT COURT

for the
District of Columbia
In the Matter of the Search of 
(Brie?y describe the property to be searched Case: 1 :18?Sc?02906
or identi?/ the person by name and address) Assigned T0 . HOWBII Beryl A
INFORMATION ASSOCIATED WITH ONE ACCOUNT 3 Assign. Date 2 9/26/2018
STORED AT PREMISES - 
rI tI n. Search SeIzure Warrant
CONTROLLED BY GOOGLE 0

SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the lflorthern District of California
the person or describe the property to be searched and give its location):

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search Will reveal (identify the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 9. 2018 (not to exceed 14 days)
in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
United States Magistrate Judge)

Cl Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)

CI for days (not to exceed 30) El until, the facts justifying, the later speci?c date of

Date and time issued: ?ag/yo/Y?/T? 
ge signature

City and state: Washington, DC Hon. Be_ryl_ A. Howell, Chief U. 8. District _Judge

?Printed name and title

 

Case Document 29-24 Filed 04/28/20 Page 2 of 58

A0 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

 

Retu rn

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date: 

Executing o?icer 's signature

Printed name and title

 

 

Case Document 29-24 Filed 04/28/20 Page 3 of 58

ATTACHMENT A

 

Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC (?Google?), a

company headquartered in Mountain View, California:

Case Document 29-24 Filed 04/28/20 Page 4 of 58

ATTACHMENT 

I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,

custody, or control of Google, LLC (?Google?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Google, or have been preserved

pursuant to a request made under 18 U.S.C. 2703(f), Google is required to disclose the following

information to the government for each account listed in Attachment A:

a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number);

The types of service utilized;

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,

and ?les;

Case Document 29-24 Filed 04/28/20 Page 5 of 58

e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of

actions taken;

f. All subscriber ?change history? associated with the account;

g. All search history and web history associated with the account;

h. All location and maps information associated with the account;

i. All Google Analytics information associated with the account (including all

properties and UA codes associated with the account, and, for each of these

proprieties and UA codes, all usernames and email accounts associated with them);

j. All Google Developers Console information associated with the account;
k. All Minutemaid information associated with the account;

1. All Android information associated with the account;

m. All Google Docs associated with the account;

n. All YouTube information associated with the account;

0. All Google Hangouts information associated with the account;

p. All Google Voice information associated with the account;

q. All Web App Activity associated with the account;

r. All Google Drive information associated with the account;
5. All Google+ information associated with the account;
t. All device information associated with the account, including all instrument or

telephone numbers (including MAC addresses, Electronic Serial Numbers
Mobile Electronic Identity Numbers Mobile Equipment

Identi?er Mobile Identification Numbers Subscriber Identity

Case Document 29-24 Filed 04/28/20 Page 6 of 58

Modules Mobile Subscriber Integrated Services Digital Network Number
International Mobile Subscriber Identifiers or
International Mobile Equipment Identities and
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in AttachmentA are the recovery email address,
provide all records or other information regarding the identi?cation of the account,
to include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log?in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number).
II. Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized
access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.
1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

Case Document 29-24 Filed 04/28/20 Page 7 of 58

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, _ulian

individual associated with the Trump Campaign, any witness in the investigation;

0, Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

(1. Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or

foreign principals;

Case Document 29-24 Filed 04/28/20 Page 8 of 58

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

I. The identity of any non-U.S. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection 

Case Document 29-24 Filed 04/28/20 Page 9 of 58

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case 1: 19- mc- 00029- CRC Document 29- 24 Filed 04/28/20 Page 10 of 58

A0 [06 (Rev 04/l0) Application for a Search Warrant
"s




I5 ti 1* ?i E.-
UNITED STATES DISTRICT COURT SEP 2 51m

for the 316111. US. District 8. Bankruptcy
District of Columbia for The 01 Columbla

 

In the Matter of the Search of

(Brit?u describe the property to he searched
or itiuntt'?/ the person by itcit'tm! mm? 

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY GOOGI .

Case: 1: 18? ?sc?02906

Assigned To: Howell, BerylA.

Assign. Date: 9t26t2018

Description: Search Seizure Warrant



APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identi?l the person or describe the
property to be searched and give its locatiOn):

See Attachment A
located in the Northern District of . California there is now concealed (identt? the

person or describe the property to be seizeaD:
See Attachment 

 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
[Erevidence of a crime;
Moontraband, fruits of crime, or other items illegally possessed;
[irproperty designed for use, intended for use, or used in committing a crime;
CI a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section O?ense Description
52 U.S.C. 30121 Foreign Contribution Ban
18 U.S.C. 1001, 1030. 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Affidavit for add'l
The application is based on these facts:
See attached Affidavit.

Continued on the attached sheet.
El Delayed notice of days (give exact ending date if more than 30 days: is requested
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.



 

 


. _a?Jeerf -
Rev1ewed by Applicant signature
Kyle R. Freeny (ASC) Patrick J. Myers, Special Agent, 

 

 

 

 

Printed name and title

Sworn to before me and signed in my presence.

Date: 7?425 [la/f" 

Judge signature

 

City and state: Washington, DC. Hon. BerylA. Howell, Chier. S. DistrictJudge

 

Printed name and title

Case Document 29-24 Filed 04/28/20 Page 11 of 58

IN THE UNITED STATES DISTRICT COURT 

FOR THE DISTRICT OF COLUMBIA 
IN THE MATTER OF THE SEARCH OF Case; 
INFORMATION ASSOCIATED WITH Assigned To - Howe? Be I A
ONE ACCOUNT STORED AT PREMISES Assign Date'. 9/26/2518 ry 

CONTROLLED BY Description: Search Seizure Warrant

 

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick J. Myers, being ?rst duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1. I make this af?davit in support of an application for a search warrant for

information associated with the Google account?

which is stored at premises owned, maintained, controlled or operated by Google, LLC

  

(?Google?), a company headquartered in Mountain View, California.

 

Upon receipt of the information described in Attachment A, govemment-authorized

persons will review that information to locate the items described in Attachment B.

2. I am a Special Agent with the Federal Bureau of Investigation assigned to
FBI Pittsburgh working directly with the Special Counsel?s Of?ce. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this af?davit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This af?davit is

Case Document 29-24 Filed 04/28/20 Page 12 of 58

intended to show merely that there is suf?cient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this af?davit,
there is probable cause to believe that the Target Account contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision ofa felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION

5. This Court has jurisdiction to issue the requested warrant because it is ?a court of

competent jurisdiction? as de?ned by 18 U.S.C. 2711. Id. 2703(a), 
Speci?cally, the Court is ?a district court of the United States (including a magistrate
judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C.
2711(3)(A)(i). The offense conduct included activities in Washington, DC, as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US politics for decades. STONE worked on the presidential campaign of

Case Document 29-24 Filed 04/28/20 Page 13 of 58

Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7. Jerome CORSI is a political commentator who, according to publicly available
information, currently serves as the ?Washington Bureau Chief for Inforwars.com.? According
to publicly?available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a ndmber of
books regarding Democratic presidential candidates. As described further below, CORSI was in

contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

Case Document 29-24 Filed 04/28/20 Page 14 of 58

 

B. Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

9. On January 6, 2017, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following:

Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the

US presidential election. Russia?s goals were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her

electability and potential presidency. We further assess Putin and the Russian

Government developed a clear preference for President?elect Trump.

10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber
activity?with overt efforts by Russian Government agencies, state?funded media, third?party
intermediaries, and paid social media users or ?trolls.??

11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties.? Further, July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks

and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted

-4-

Case Document 29-24 Filed 04/28/20 Page 15 of 58

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political
?gures. By May, the GRU had ex?ltrated large volumes of data from the 

12. With respect to the release of stolen materials, the USIC assessed ?with high
con?dence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud?based computers by creating backups of
the cloud-based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts.

16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida counties.

Case Document 29-24 Filed 04/28/20 Page 16 of 58

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States V. Viktor Borisovz'ch et al. (Case No. 1 

C. Public Interactions with Guccifer 2.0 and WikiLeaks

19. On June 14, 2016, the forensic ?rm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.?
In that post, Guccifer 2.0 also began releasing hacked DNC documents.

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, ?Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he explains who he is and
why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC ?les and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican

Case Document 29-24 Filed 04/28/20 Page 17 of 58

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
AS SANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a tweet using @RogerJ Stone] calling
Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0?s Twitter account was reinstated.

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJ StoneJ paying you
back.? Guccifer also sent a private message to @RogerJ StoneJ stating ?i?m pleased to say 
great man. please tell me if I can help anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying ?rms to in?uence US.
policy toward Ukraine.

27. On August 21, 2016, using @RogerJ Stone] R, STONE tweeted: ?Trust me, it will

Case Document 29-24 Filed 04/28/20 Page 18 of 58

soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a C-SPAN interview that same
day, STONE reiterated that because of the work of a ??mutual acquaintance? of both his and
the public [could] expect to see much more from the exiled whistleblower in the
form of strategically?dumped Clinton email batches.? He added: ?Well, ?rst of all, I think Julian
Assange is a I think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all ofthose emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.?

28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.?

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.?

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in LondonSANGE announcement which was
part of WikiLeaks? 10?year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr
to tweet: ?Payload coming. #Lockthemup.?

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

Case Document 29-24 Filed 04/28/20 Page 19 of 58

The Podesta Emails #HillaryClinton #Podesta #imWithHer? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21,
2016 and Twitter references argued publicly that ?[it is] a reasonable assumption to 
or at least a reasonable conclusion - that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any
in?uence with him or that I have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta?s email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant orjust a good guesser because the
limited things I did predict (Oct disclosures) all came true.?

D. STON E?s Private Twitter Direct Messages with WikiLeaks and ASSAN GE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Case Document 29-24 Filed 04/28/20 Page 20 of 58

Podesta emails, the Twitter account @RogerJ Stone] sent a private direct message to the Twitter
account @wikileaks.1 The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me? cordially 

36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t go there if you don?t want us to correct you.?

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct\" me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

38. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to communicate.?

39. In addition, @RogerJ Stone] also exchanged direct messages with AS SANGE,
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAs'sange, an address associated with ASSANGE in numerous public reports, stating:
?Still nonsense. As a journalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were

 

1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJ StoneJ r.

-10-

Case Document 29-24 Filed 04/28/20 Page 21 of 58

indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you 1 will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped 1 don?t know of any crime you need to be pardoned for - best regards. That
same day, @JulianAssange responded: ?Between CIA and Do] they?re doing quite a lot. On the
side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal.?

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

E. Communications with Others Regarding
Forthcoming Leaks

  

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for -address, ?On October

17, 2017, Chief Judge Howell issued a search warrant for one of STONES-addresses,

_n or about December 19, 2017, Chief Judge Howell issued a search

warrant for -email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for iCloud account. Information recovered pursuant to those

   

search warrants indicated the following:

42. On or about May 15, 2016, -emailed CORSI: ?Here is my ?ight
schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

Case Document 29-24 Filed 04/28/20 Page 22 of 58

appears to have forwarded the message to STONE at _ho replied to

CORSI that, ?May meet Manafort guarantee nothing.?

   
 

43. On or about May 18, 2016, CORSI emailed STONE at

  

I believe that

    
  
 

with the title, ?Roger why don't you look this over before I send it to
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?

44. On July 25, 2016, STONE, using _sent an email to
CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks deal with
Foundation, allegedly.?

45. On or about July 31, 2016, STONE, using

  

CORSI with the subject line, ?Call me The body of the email read: hould see
Assange[.] _should ?nd Bernie [S]anders,brother who called Bill a Rapist turn him for
TrumpH -hould ?nd _or more proof of Bill getting kicked out.?
46. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at
_Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox
will have me on mid?Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to

-12-

Case Document 29-24 Filed 04/28/20 Page 23 of 58

be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016,-an associate of emailed
STONE at ?The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal
Julian Assange last night.? -subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet stated
that in 2018,-told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told -e was joking and
had not actually met AS SANGE.2

48. Through a search of iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to-to have ?dined? with ASSANGE. For example, an associate of
STONE sent a text to STONE at approximately on August 2, asking ?How did ur meeting

go in STONE responded. ?It?s this The following day, the associate asked,

?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

Case Document 29-24 Filed 04/28/20 Page 24 of 58

call later heading for airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had geo?location
information indicating that it was taken in Los Angeles.

49. On or about August 15, 2016, CORSI emailed STONE at

   

?Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it?s not over yet. More to come than anyone realizes. Won?t really get started
until after Labor Day. I?m in NYC this week. Jerry.?

50. On or about August 31, 2016, CORSI emailed STONE at
?Did you get the PODESTA writeup.? STONE replied 

51. On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation tied to Ukraine Yanukovych Panama papers reveals Podesta hired by
S[b]erbank, Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, CORSI emailed STONE at
Is NY Post going to use the Pedesta [sic] stuff??

53. On or about September 24, 2016,-mailed CORSI, will have much
more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded, ?We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again back, ?Awaiting secret ?le. Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!? CORSI responded, ?Keep me posted

about In a subsequent meeting with investigators,- indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

Case Document 29-24 Filed 04/28/20 Page 25 of 58

54. On or about October 3, 2016, an associate of STONE emailed STONE at
-nd asked: ?Assange what?s he got? Hope it?s good.? STONE wrote

back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled.? The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s
important.?

55. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then?candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the US. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the US. election-related documents would all come out before Election Day.

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.?

57. That same day, BANNON emailed STONE at ??What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done BANNON wrote back, ?He didn?t

cut deal w/ STONE replied, ?Don't think so BUT his lawyer-is a big

democrat.?

-15-

Case Document 29-24 Filed 04/28/20 Page 26 of 58

58. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

5 9. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.?

60. According to phone records? at approximately
11:27 AM, CORSI placed a call to STONE, which STONE did not answer.

61. At approximately STONE received a phone call from the Washington
Post. The call lasted approximately twenty minutes.

62.? At approximately STONE called CORSI and the two spoke for
approximately seventeen minutes.

63. At approximately CORSI called STONE and the two spoke for

approximately twenty minutes.

 

3 


-16-

Case Document 29-24 Filed 04/28/20 Page 27 of 58

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape.

65. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, CORSI emailed STONE using_ expect

that much of next dump focus, setting stage for Foundation debacle.?

66. At approximately _an author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the
newly?released Podesta emails. Approximately ten minutes later, STONE, using
PlayersO2@gmail.com, forwarded _message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual.

G. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI responded to STONE, ?Ok. I understand.? Approximately twenty
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job

numbers.?

68. On or about Wednesday, October 12, 2016, at approximately STONE,

using_ emailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?Ok. Monday. The remaining stuff on

-17-

Case Document 29-24 Filed 04/28/20 Page 28 of 58

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice??

69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at both?ith the subject
line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that
?Podesta is at the heart of a Russian-government money laundering operation that bene?ts
?nancially Podesta personally and the Clintons through the Clinton Foundation.?

70. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second timejust to be sure you got it.? STONE emailed
CORSI back via the Hotmail Account, ?Got them and used them.?

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

-- Joule ties to RUSSIA MONEY LAUNDERIN to
CLINTON STONE responded, ?Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook.? CORSI
wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me
like -skimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once-
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund account, there?s no telling how much money he laundered, or where it ended up.

Nothing in Clinton Foundation audited ?nancials or IRS Form 9908 about received via

-18-

Case Document 29-24 Filed 04/28/20 Page 29 of 58

Russia Metcombank[.] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI
sent STONE an email at -ith the subject, STONE article
RUSSIAN MAFLA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although I
have had some back?channel communications with Wikileaks I had no advance notice about the
hacking of Mr. POdesta nor I have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how much money did -a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by- with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Founda?on??

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

Case Document 29-24 Filed 04/28/20 Page 30 of 58

75. On or about October 17, 2016, CORSI emailed STONE at
subject ?Fwd.
AS SANGE. . .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man ?les that include Hillary.
It?s what they used to call a ?Mexican stand offH? Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.?

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbart.com in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

78. On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.?

-20-

Case Document 29-24 Filed 04/28/20 Page 31 of 58

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

Case Document 29-24 Filed 04/28/20 Page 32 of 58

 

Case Document 29-24 Filed 04/28/20 Page 33 of 58

 

I. Congressional Testimony and Public Statements About His Relationship
with Wikileaks

88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta?s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. . . .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, hadjust resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny. . . .

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. Thisjournalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go?between? and ?mutual friend.? All of these monikers are equally
true.

-23-

Case Document 29-24 Filed 04/28/20 Page 34 of 58

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.
Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or

encouragement been in any type of contact with Julian Assange??

MR. STONE: No.

Q: So throughout the many months in which you represented you were either in

communication with Assange or communication through an intermediary with Assange,

you were only referring to a single fact that you had con?rmed with the intermediary 
MR. STONE: That 

Q: -- was the length and the breadth of what you were referring to?

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasrons.

90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

J. Messaging to Randy CREDICO about ?Back channel?

91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identi?ed as his ?intermediary? to ASSANGE), messaged STONE, ?My
lawyer wants to see me today.? STONE responded, ??Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24-

Case Document 29-24 Filed 04/28/20 Page 35 of 58

back, ?That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what Nothing
happening in DC the day before Thanksgiving why are busting my chops??

93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them which he himself said in public b4 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuffL] I just followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for 

94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, ?Forensic evidence proves that there is no back Channel. So
now you can relax.?

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated Via text message more than a dozen
times.

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? In a public acebook post, STONE further stated that ?Credico merely 

-25-

Case Document 29-24 Filed 04/28/20 Page 36 of 58

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-mails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December I, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could have just told him the truth that you didn?t have a
back Channel they now know that I was not in London until September of this year[.] You had
no back?channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad Spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If
you testify you?re a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

"26?

Case Document 29-24 Filed 04/28/20 Page 37 of 58

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say 1 have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.?

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy
logs . . . 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get
off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] 1 was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that

-27-

Case Document 29-24 Filed 04/28/20 Page 38 of 58

stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my
lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to take that dog away
from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 

104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too.

He was depressed about it. Or was he lying.? The article noted that CREDICO stated he did not

have prostate cancer and did not have any such discussion with STONE.

 

 

5 

threatened-dog-13591 1370.html
6 ones.com/politics/20 1 8/ so ciate-prepare-to-die/

~28-

Case Document 29-24 Filed 04/28/20 Page 39 of 58

 

Case Document 29-24 Filed 04/28/20 Page 40 of 58

 

BACKGROUND CONCERNING GOOGLE

112. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail (?email?) access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account

application information. In my training and experience, such information may constitute evidence

-30-

Case Document 29-24 Filed 04/28/20 Page 41 of 58

of the crimes under investigation because the information can be used to identify the account?s
user or users.

113. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber?s full name, physical address, telephone numbers and other
identi?ers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account?s user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.

1 14. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(Le. session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed). the methods used to connect to the account (such as
logging into the account via the provider?s website), and other log ?les that re?ect usage of the
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.

115. In my training and experience, in some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as

-31-

Case Document 29-24 Filed 04/28/20 Page 42 of 58

technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider?s support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account?s user or users.

116. This application seeks a warrant to search all responsive records and information
under the control of Google, a provider subject to the jurisdiction of this court, regardless of Where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google?s possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.

117. As explained herein, information stored in connection with an email account may
provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This ?user attribution? evidence is analogous to the search for ?indicia of occupancy?
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may

indicate who used or controlled the account at a relevant time. Further, information maintained by

-32-

Case Document 29-24 Filed 04/28/20 Page 43 of 58

the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user?s account may further
indicate the geographic location of the account user at a particular time location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner?s state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner?s motive and intent to
commit a crime communications relating to the crime), or consciousness of guilt
deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES

118. Review of the items described in Attachment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated ??lter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
119. Based on the forgoing, I request that the Court issue the proposed search warrant.
120. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not

required for the service or execution of this warrant.

-33-

Case Document 29-24 Filed 04/28/20 Page 44 of 58

REQUEST FOR SEALING
121. I further request that the Court order that all papers in support of this application,
including the af?davit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these

documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

I 1:355" 

Patrick J. Myers
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this 7d? of September, 2018.



The Hbliora?le Beryl A. Howell
Chief United States District Judge

-34-

Case Document 29-24 Filed 04/28/20 Page 45 of 58

ATTACHMENT A

 

Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC (?Google?), a

company headquartered in Mountain View, California:

 

Case Document 29-24 Filed 04/28/20 Page 46 of 58

ATTACHMENT 

I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,

custody, or control of Google, LLC (?Google?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Google, or have been preserved

pursuant to a request made under 18 2703(f), Google is required to disclose the following

information to the government for each account listed in Attachment A:

a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number);

The types of service utilized;

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,

and ?les;

Case Document 29-24 Filed 04/28/20 Page 47 of 58

e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of

actions taken;

f. All subscriber ?change history? associated with the account;
g. All search history and web history associated with the account;
h. All location and maps information associated with the account;

i. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these

proprieties and UA codes, all usernames and email accounts associated With them);

j. All Google Developers Console information associated with the account;
k. All Minutemaid information associated with the account;

1. All Android information associated with the account;

m. All Google Docs associated with the account;

n. All YouTube information associated with the account;

0. All Google Hangouts information associated with the account;

p. All Google Voice information associated with the account;

q. All Web App Activity associated with the account;

r. All Google Drive information associated with the account;
3. All Goog1e+ information associated with the account;
t. All device information associated with the account, including all instrument or

telephone numbers (including MAC addresses, Electronic Serial Numbers
Mobile Electronic Identity Numbers Mobile Equipment

Identi?er Mobile Identi?cation Numbers Subscriber Identity

Case Document 29-24 Filed 04/28/20 Page 48 of 58

Modules Mobile Subscriber Integrated Services Digital Network Number
International Mobile Subscriber Identi?ers or
International Mobile Equipment Identities and
u. For any accounts linked to the accounts listed in Attachment A, including accounts

linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in AttachmentA are the recovery email address,
provide all records or other information regarding the identi?cation of the account,
to include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number).

II. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

Case Document 29-24 Filed 04/28/20 Page 49 of 58

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, - Julian

individual associated with the Trump Campaign, any witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

01. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or

foreign principals;

Case Document 29-24 Filed 04/28/20 Page 50 of 58

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;

i. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection 

Case Document 29-24 Filed 04/28/20 Page 51 of 58

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney?client and other
operative priVileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-24 Filed 04/28/20 Page 52 of 58

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF 0339; 1318?80?02906

INFORMATION ASSOCIATED WITH ONE Assigned To Howell Beryl A
ACCOUNT STORED AT PREMISES Assign. Date 9/26/2818 
CONTROLLED BY GOOGLE Description: Search Seizure Warrant

 

MOTION TO SEAL AND IMJCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 5:3 2705?)?!

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the ?Warrant?) under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. ?2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California, not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further order of the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court ?lings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (DC. Cir. 1980) (citing
Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (DC. Cir. 1991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a
court of competent jurisdiction? as defined by 18 U.S.C. 2711. Speci?cally, the Court is a

?district court of the United States . . . that has jurisdiction over the offense being investigated.?

Case Document 29-24 Filed 04/28/20 Page 53 of 58

18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, DC. See 18 U.S.C. 3237.

3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. ?2705(b). Google provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The
Stored Communications Act 18 U.S.C. 2701?2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber information? using a subpoena, Section 2703(d) allows the Government to obtain other
?non-content? information using a court order, and Section allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
noti?cation. In relevant part, Section 2705(b) provides as follows:1

Preclusion of notice to subject of governmental access. A governmental

entity acting under section 2703 . . . may apply to a court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court

deems appropriate, not to notify any other person of the existence of the warrant,

subpoena, or court order. The court shall enter such an order if it determines that

there is reason to believe that noti?cation of the existence of the warrant, subpoena,

or court order will result in?

endangering the life or physical safety of an individual;
(2) ?ight from prosecution;

 

1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.

Case Document 29-24 Filed 04/28/20 Page 54 of 58

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriouslyjeopardizing an investigation or unduly delaying a trial.
18 U.S.C. 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 US. C. 2705(1)) for Grand Jury
Subpoena 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating violations of 18 U.S.C.
2 (aiding and abetting); 18 U.S.C. 3 (accessory after the fact); 18 U.S.C. 4 (misprision of a
felony); 18 U.S.C. 371 (conspiracy); 18 U.S.C. 1030 (unauthorized access of a protected
computer); 18 U.S.C. 1343 (wire fraud); 18 U.S.C. 1349 (attempt and conspiracy to commit
wire fraud); and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject Offenses?), in
connection with efforts to compromise the networks of the Democratic National Convention
the Democratic Congressional Campaign Committee and the email accounts

of US. persons, followed by the public release of stolen materials through various outlets.

3

Case Document 29-24 Filed 04/28/20 Page 55 of 58

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or digital evidence relating to their criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

9. There is, therefore, reason to believe that noti?cation of the existence of the
Warrant will seriouslyjeopardize the investigation, including by giving the targets an opportunity
to ?ee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.

Because of such potential jeopardy to the investigation, there also exists a

Case Document 29-24 Filed 04/28/20 Page 56 of 58

compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287-89.

10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request,
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or
electronic communications for a certain account, notify the subscriber or customer of the existence
of the warrant prior to producing the material sought.

WHEREF ORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and af?davit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above?captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or
until further order of the Court.

Respectfully submitted,

ROBERT S. MUELLER, 111
Special Counse?lf_

   
 

 

(fa, 

{y . Freeny 
The *cial Counsel?s Of?ce
(202) 616-3812

 
 

Case Document 29-24 Filed 04/28/20 Page 2313

IN THE UNITED STATES DISTRICT COURT mm. U.S. mum 


.4 

f.

c? Bankruptc

FOR THE DISTRICT OF COLUMBIA InHurts: for the Mistrict or ColumbIa

IN THE MATTER OF THE SEARCH OF Case, 
INFORMATION ASSOCIATED WITH ONE Assigned To How 
ACCOUNT STORED AT PREMISES Assign 9 eryl A.
CONTROLLED BY GOOGLE a - 

 



The United States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and af?davit in support thereof (collectively the ?Warrant?),
and to require Google, an electronic communication and/or remote computing services provider
headquartered in Mountain View, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. 2705(b).

The Court ?nds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and af?davit in support thereof, all attachments thereto and other related

materials, the instant motion to seal, and this Order be SEALED until further order of the Court;

and

Description: Search Seizure Warrant

Case Document 29-24 Filed 04/28/20 Page 58 of 58

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. ?2705(b), Google and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Google for the purpose of ?receiving legal advice) for a period of one year or until

further order of the Court.

  
 

. 
THE BIERYL A. HOWEL .,

CHIEF UNITED STATES DISTRICT JUDGE

,Case Document 29-25 Filed 04/28/20 Page 1 of 61

A0 93 (Rev. 11! 3) Search and Seizure Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia
In the Matter of the Search of 
(Brie?y describe the property to be searched gas-e? 1 02918
or identify the person by name and address) SS!gne TO Beryl 
ASSign. Date 927/2018
INFORMATION ASSOCIATED WITH TWO ACCOUNTS Descri tion' Search - I
STORED AT PREMISES e?zure arm?
CONTROLLED BY TWITTER 
SEARCH AND SEIZURE WARRANT
To: Any authorized law enforcement of?cer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
{ideniijj} the person or describe the property to be searched and give its location): 

See Attachment A

I find that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (idemr?) the person or describe the property to be seized):

See Attachment 8

YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed J4 days)
[if in the daytime 6:00 am. to l0:00 p.1n. CI at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom or from whose premises the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to lion. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

El Pulsuant to 18 C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U. S. C.
2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice the person who, or whose
property, will be searched or SClzed (check the app: opr box) 

El for days (none exceed 30) I3 until, the facts justifying, the later speci?c date? of

Date and time issued: 47! 94"? dig/II KW

{Iudge? signature-

 

 

City and state: Washington, DC Hon. Beryl A. Howell Chief US District Judge

Pr hired name and title

 

 

 

Case Document 29-25 Filed 04/28/20 Page 2 of 61

A0 93 (Rev. 1 li? 13) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

 

 

Executing oj?cer Signature

Printed name and ri?e

 

 

 

Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 3 of 61

ATTACHMENT A
Property to be Searched

This wmrnnt applies to information associated with the Twitter accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Twitter, Inc. ("Twitter"), a company headquartered in San Francisco, California

-1-

 1.

Case Document 29-25 Filed 04/28/20 Page 4 of 61

ATTACHMENT 
Information to be disclosed by Twitter

To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. (?Twitter?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Twitter, or have been preserved

pursuant to a request made under 18 U.S.C. 2703 Twitter is required to disclose the following

information to the government for each account listed in Attachment A:

A.

H.

All ?Tweets? and Direct Messages sent, received, ?favorited,? or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

All data and information associated with the profile page, including photographs, ?bios,?
and profile backgrounds and themes;

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account ?mentions? or ?replies?);

All photographs and images in the user gallery for the account;

All location data associated with the account, including all information collected by the
?Tweet With Location? service;

All information about the account?s use of Twitter?s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

All data and information that has been deleted by the user;

A list of all of the people that the user follows on Twitter and all people who are following
the user the user?s ?following? list and ?followers? list);

A list of all users that the account has ?unfollowed? or blocked;

All ?lists? created by the account;

 

Case Document 29-25 Filed 04/28/20 Page 5 of 61

All information on the ?Who to Follow? list for the account;
All privacy and account settings;

All records of Twitter searches performed by the account, including all past searches saved
by the account;

All current and historical subscriber and payment information, including full name, e?mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identi?cation numbers, security questions. and answers,
registration IP address, payment history, and other personal identi?ers;

All email addresses and telephone numbers ever registered (Whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

All data and information associated with the profile page, including photographs;

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to- access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created; -

The dates and times at which the account and pro?le were created, and the Internet Protocol
address at the time of sign?up;

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identi?er, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers
Mobile Equipment Identifiers Mobile Identi?cation Numbers
Subscriber Identity Modules Mobile Subscriber Integrated Services
. Digital Network Number International Mobile Subscriber Identi?ers
or International Mobile Equipment Identities and any other
information regarding the types of devices used to access the account;

All activity logs for the account;

All location information for the account, including all location data collected by any
plugins or widgets;

The types of service utilized by the user;

-3-

 

BB.

CC.

DD.

EE.

FF.

GG.

HH.

II.

Case Document 29-25 Filed 04/28/20 Page 6 of 61

All information about the account? 8 use of Twitter? 3 link service, including all website links
embedded in, exporting data to, or importing data from, the account?s website or blog;

All full website links that were shortened by Twitter?s link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked; -

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

All data and information that has been deleted by the user;

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked; -

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identi?er, or any other account or device identi?er;

Information regarding accounts linked to accounts towhich the Target Accounts are linked;

All records pertaining to communications between the Service Provider and any person
regarding the user or the user?s account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consiSts of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), l8

U.S.C. 371 (conspiracy), l8 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), l8 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:



 

Case Document 29-25 Filed 04/28/20 Page 7 of 61

a. All records, information, documents or tangible materials that relate in any Way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, -Julian
Ass any

individual associated with the Trump Campaign, any Witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or

foreign principals;

 

Case Document 29-25 Filed 04/28/20 Page 8 of 61

 

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection .

Case Document 29-25 Filed 04/28/20 Page 9 of 61

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 

Case Document 29-25 Filed 04/28/20 Page 10 of 61

FILED
SEP272018

I Clark. U.S. District Bankruptc
IN THE UNITED STATES DISTRICT COURT cm, to, m, 3mm 0, commie

FOR THE DISTRICT OF COLUMBIA

 

 

IN THE MATTER OF THE SEARCH OF Case: 1 :18~sc?0291 8

INFORMATION ASSOCIATED WITH TWO Assigned To Howell, Beryl A.

ACCOUNTS STORED AT PREMISES Assign. Date 9/27/2018

CONTROLLED BY TWITTER Description: Search Seizure Warrant


The United States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the ?Warrant?),
and to require TWITTER, INC. an electronic communication and/or remote
computing services provider headquartered in San Francisco, California, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. 2705(b).

The Court ?nds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 I

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and af?davit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;

and

 

Case Document 29-25 Filed 04/28/20 Page 11 of 61

. IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. 2705(1)), TWITTER and its
employees shall not disclose the existence or content of the Warrant to any other person (except

attorneys for TWITTER for the purpose of receiving lega} advice) for a period of one year or until

THE HONORAELE BERYL A. HOWELL

CHIEF UNITED STATES DISTRICT JUDGE

further order of the Court.

12/72? r3 -

Date

 

Case Document 29-25 Filed 04/28/20 Page 12 of 61

A0 106 (Rev. OHIO) Applicatton for a Search Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia

SEP 27 2018

Glut, U.S. District Bankruptcy
Courts for the District of Coiumhia

in the Matter of the Search of

Brie?y describe the property to be searched
or idemy?; the person by name and address)

ASSOCIATED WITH
TWO ACCOUNTS STORED AT PREMISES
CONTROLLED BY TWITTER .

Case: 1'18-sc
. . ~02918
?ss?igned To Howell, BerylA
DSSigii. pate 9/27/2018 
Search 8. Seizure Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal iaw enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the

property to be searched and give its location):

See Attachment A

located in the Northern District of
person or describe the property to be seized):

See Attachment 

Catifornta there is now concealed (identify the

 

 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
devidence ofa crime;
[if contraband, fruits of crime, or other items possessed;
[if property designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is uniawfuity restrained.

The search is related to a violation of:

Code Section O?ense Description
52 3012?! Foreign Contribution Ban 
18 U.S.C. 1001. 1030, 371 False Statements. Unauthorized Access of Protected Computer. Conspiracy
See Af?davit for add!

The application is based on these facts:
See attached Affidavit.

[if Continued on the attached sheet.

Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.



Applicant '5 signature

is requested

Reviewed by 

IKyte R. Freeny (ASC) Patrick J. Myers, Special Agent, 

Printed name and titie

 

Sworn to before me and signed in my presence.
Date: 2 ?ag We 
Judge '5 signature

Hon. Beryl A. Howeit, Chief US. District Judge

Printed name and ri?e

City and state: WashingtoiD,C_

 

Case Document 29-25 Filed 04/28/20 Page 13 of 61

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02913

INFORMATION ASSOCIATED WITH TWO - Assigned To Howell 89 IA
ACCOUNTS STORED AT PREMISES Assign. Date 9/27/2618 
CONTROLLED BY TWITTER Description: Search 8: Seizure Warrant

 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 2705(@

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and af?davit
in support thereof (collectively herein the ?Warrant?) under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 ?2705(b). In regardto the non?
disclosure, the proposed Order would direct TWITTER, LLC an electronic
communication and/or remote computing services previder headquartered in San Francisco,
California, not to notify any other person (except attorneys for TWITTER for the purpose Of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further orderof the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court ?lings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315?16 Cir. 1980) (citing
Nixon 1). Warner Communications, Inc, 589, 598 (1978)). The Court may also seal the
Warrant to prevent-serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir.l991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a

court of competent jurisdiction? 83 de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

 

Case Document 29-25 Filed 04/28/20 Page 14 of 61

?district court of the United States . . . that hasjurisdiction over the offense being investigated.?
18 .S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. 3237.

3. Further, the Court has authority to require nonedisclosure of the Warrant under 18
U.S.C. 2705(1)). TWITTER provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. The
Stored Communications Act 18 U.S.C. 27014712, governs how TWITTER may be
compelled to-supply communications and other records using a subpoena, court order, or search
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber inforrnatiOn? using a subpoena, Section 2703 allows the Government to obtain other
?non-content? information using a court order, and Section allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
noti?cation. In relevant part, Section 2705(b) provides as follows:E

Preclusion of notice to subject of governmental access. *9 A governmental

entity acting under section 2703 . . . may apply to a court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court

deems not to notify any other person of the existence of the warrant,

subpoena, or court order. The court shall enter such an order if it determines that

there is reason to believe that noti?cation of the existence of the warrant, subpoena,

or court order will result in?
endangering the life or physical safety of an individual;

 

Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision. 

2

 

 

Case Documen129-25 Filed 04/28/20 Page 15 of 61

(2) ?ight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial
18 U.S.C. The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(1)) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705(b), the court is required to
issue the non?disclosure order

In re Application for Order of Nondisclosure Pursuant to 18 2705(b) for Grand Jury
Subpoena 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command TWITTER not to notify any other person (except attorneys for TWITTER for the
purpose of receiving legal advice) of the existence of the Subpoena for a-period of one year or until
further order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating violations of 1 8 US .C.
2 (aiding and abetting), 18 U.S.C. 3 the fact), 18 U.S.C. ?4 (misprision ofa
felony), 18 .S.C. 371 (conspiracy), 18 U.S.C. 951 (acting as an unregistered foreign agent),
18 U.S.C. 1001 (false I statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer); 18 US C. 1343 (wire fraud), 18 U. 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), and 22 U.S.C. ?611 et seq.

(Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject

 

Case Document 29-25 Filed 04/28/20 Page 16 of 61

Offenses?), arising out of the?conduct of Roger Stone and others. it does not appear that Stone is
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this
warrant to Stone could lead him to destroy evidence or notify others who may delete information
relevant to the investigation. I

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that TWITTER and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
Bl. Once alerted to this information, potential targets would be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and'avoid future prosecution. in particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or digital evidence relating to their
criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered mendisclosure under Section 2705(b) becomes no

longer needed, the Government will notify the Court and seek appropriate relief.

 

Case Document 29-25 Filed 04/28/20 Page 17 of 61

9. There is, therefore, reason to believe that noti?cation of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity-
to flee from prosecution, destroy or tamper. with evidence, and intimidate witnesses. See 18 U.S.C.
Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287?89.

10. Based on prior dealings with TWITTER, the United States is aware that, absent a
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.

WHERBFORE, for all the foregoing reasons, the government respectfully requests that the
above?captioned warrant, the application and af?davit in support thereof, and all attachments
thereto and other reiated materials be placed under seal, and furthermore, that the Court command
TWITTER not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of
one year or until further order of the Court. I

Respectfully submitted,

ROBERT s. MUELLER, 111
Special Counsel

Dated: 2123? /l By: :lr

Mtg]. Freon)! 
Th eciat Counsel?s Of?ce
(202) 616-3812

 

 

Case Document 29-25 Filed 04/28/20 Page 18 of 61 -

FILED

IN THE UNITED STATES DISTRICT COURT SEP 2 7 2013

FOR THEDISTRICT OF COLUMBIA Clerk. U.S. District Sni?ankruptcy
Courts tor the District at Columbla

IN THE MATTER OF THE SEARCH OF Case; 1118?50-02918 .
INFORMATION ASSOCIATED WITH Assigned To -. Howell. Beryl A.

TWO ACCOUNTS STORED AT PREMISES Assign Date 9127;2018 
CONTROLLED BY TWITTER D?scription: Search a Seizure Warrant

 

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

l, Patrick J. Myers, being ?rst duiy sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I tnake this affidavit in support of an appIiCation tor a search warrant for
information associated with the two Twitter accounts (the ?Target Accounts?), stored at premises

owned, maintained, controlled or operated by Twitter, Inc. (?Twitter?), a company headquartered

in San Francisco, California. As set forth below, the Target Accounts

Upon receipt

 

of the information described in Attachment A, government-authorized persons will review that
information to locate the items described in Attachment B.

2. I am a Special Agent With the Federal Bureau of Investigation assigned to
FBI Pittsburgh working directly with the Special Counsel?s Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately ?fteen years, including fer the FBI. As a Special Agent, I have conducted nations!
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this af?davit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This af?davit is

 

Case Document 29-25 Filed 04/28/20 Page 19 of 61

intended to show merely that there is suf?cient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. . Based on my training and experience and. the facts as set forth in this af?davit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instruinentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to conimit
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B. I

I JURISDICTION -

5. This Court has jurisdiction to issue the requested warrant because it is ?a court of

competent jurisdiction? as de?ned by 18 U.S.C. 2711. Id. 2703(a), 
Speci?cally, the-Court is ?a district court of the United States (including a magistrate
judge of such a court) . . . that hasjurisdiction over the offense being investigated.? 18 U.S.C.
271 The offense conduct included activities in Washington, DC, as detailed beldw.
I PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger 8TONE I
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US. politics for decades. STONE worked on the presidential campaign of

-2-

 

Case . Document 29-25 Filed 04/28/20 Page 20 of 61

Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support 'of the Campaign. AS described further below,
STONE also maintained contact with individuals employed by the Campaign, including then?
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome 

Jerome CORSI is a political commentator who, according to publicly available
information, served as the ?Washington Bureau Chief for Inforwarscom.? According to
publicly?available sources, from-2014 until January 2017, was a ?senior staff reporter"
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of
boolts regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

 

Case Document 29-25 Filed 04/28/20 Page 21 of 61

 

I B. Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

. 9. On January 6, 20l7, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following:

Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the

US presidential election. Russia?s goals were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State I?lillary] Clinton, and harm her

electability and potential presidency. We further assess Putin and the Russian

Government developed a clear preference for President-elect Trump.

it). In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber
activity+with overt efforts by Russian Government agencies, state?funded media, third-party
intermediaries, and paid social media users or ?trolls.?

11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks

- and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted

-4-

 

Case Document 29-25 Filed 04/28/20 Page 22 of 61

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political
?gures. By May, the GRU had ex?ltrated large volumes of data from the - 

12. With respect to the release of stolen materials, the USIC assessed ?with high -
con?dence that the GRU used the Guccifer 2.0 persona. DCLeaks.com, and WikiLeaks to I
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

l3. Guccifer 2.0, who claimed to be an independent Remanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third~party cloud-computing service. In or around late
September, these individuals stole data from these cloud~based computers by creating backups of
the cloud?based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts. I

16. On orabout September 4, 2016, individuals assdciated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida ecunties.

 

Case Document 29-25 Filed 04/28/20 Page 23 of 61

18. On luly 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Vikror Borisovich NegIksho, er al. (Case No. 

C. Public Interactions. with Guccifer 2.0 and WikiLeaks

19. On June 14, 2016, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC back. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.?

In that post, Guccifer 2.0 also began releasing hacked DNC documents. I

20. I On July 22, 2016, WikiLcaks published approximately 20,000 email-s stolen from
meDNc.

21. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 20?s website. Have a look and you?ll see he explains who he is and
why he. did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks With the DNC ?les and the rest is history. Now the World would
see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican



 

Case Document 29-25 Filed 04/28/20 Page 24 of 61

Organization. During his speech, he was asked about a statement by WikiLcaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.

23. On August 12,- 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a'twe-et using @RogerJStoneJr calling
Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0?3 Twitter account was reinstated. I

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJ Stone] paying you
back.? iuccifer also sent a private message to @RogerJStoneJr stating ?i?rn pleased to say 
great man. please tell me if I can help anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that worked with a Washington D.C.~based lobbying ?rms to in?uence U.S. .
policy toward Ukraine. 

27. 'On August 2i, 2016, using @RogerJStoneJR, STONE twe'eted: ?Trust me, it will

 

Case Document 29-25 Filed 04/28/20 Page 25 of 61

soon the [sic] Podesta?s time in the barrel.#CreokedHi11ary.? in a interview that same
day, STONE reiterated that becairse of the work of a ??mutual acquaintance? of both his and
the public [could] expect to see much more from the exiled whistleblower in the
form of strategically?dumped Clinton email batches.? He added: ?Weil, ?rst of all, I think Julian
Assange is a hero. .. i think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all ofthose emails that Hume Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and alot more. These are like the Watergate tapes.?

28. On September 16, 2016, STONE said in a radio stems with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.?

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinto-n is done. #WikiLeaks.? I

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tw'eeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the clay of the ASSANGE announcement which was
part of WikiLeaks? 10-year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr
to tweet: ?Payload coming. #Lockthemup.?

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article Containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading



 

Case Document 29-25 Filed 04/28/20 Page 26 of 61

The Podesta Emails #HillaryClinton #Podesta #imWithHer? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21,
2016 and Twitter references argued ?[it is] a reasonable assumption to 
or at least a reasonable conclusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that-he had never met or spoken
with Assange, saying that ?we have a mutual friend whole traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any
in?uence with him or that i have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e?rnails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since 1 never commnnicated with WikiLeaks, I guess I must be innocent of -
charges I knew abbut the hacking of Podesta?s email (speculation and conjecture) and the timing
or scepe of their subsequent disclosures. So 1 am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true.?

I). Private Twitter Direct Messages with WikiLeaks and ASSANGE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

-9-

 

Case Document 29-25 Filed 04/28/20 Page 27 of 61

I Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikilealts.I The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since 1 was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are.
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me? cordially 

36. Less than an hour later, @wikileaks responded by direct message: ?We'appreciate 
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t go there if you don?t want us to correct you.?

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

38. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to communicate.?

39. In addition, @RogerJStoneJl' also exchanged direct messages with ASSANGE,
the founder of WikiLeaks. For example, onJune 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
?Still nonsense. As ajournalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were

 

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.

-10-

 

Case Document 29-25 Filed 04/28/20 Page 28 of 61

indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped?up sexual assault
charges dropped I don?t know of any crime you need to be pardoned for best regards. That
same'day, @JulianAssange responded: ?Between CIA and Do] they?re doing quite a lot. On the
Do} side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

40. On Saturday, June l0, 20-17, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

E. Communications with Others Regarding
Forthcoming Leaks

41. On September 1 1, 2017, Chief Judge Beryl A. Howell of thelDistrict'of Columbia

issued a search warrant for -address,? On October 17,

2017, Chief Judge Howell issued a search warrant for one of -a'ddresses,

On or about December 19, 2017, Chief Judge Howell issued a search

 
 

warrantfor email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for iCloud account. Information recovered pursuant to these

search warrants indicated the following:

42. On or about May 15, 201 6-emailed CORSI: ?Here is my ?ight

schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

 

Case Document 29-25 Filed 04/28/20 Page 29 of 61

appears to have forwarded the message to STONE at?who replied to

CORSI that, ?May meet Manafort guarantee nothing.?

43. 011 of about May 18, 2016, coasr emailed STONE at?

with the title, ?Roger -- why don?t you look this over before I send it to-I believe that I

com
and I did manage to see Mr. Trump for a few minutes today as we were

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and

 

 

was very cordial. He would look for this memo from you this afternoon.?

44. On July 25, 2016, STONE, using _ent an email to
CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
Foundation, allegedly.? 

45. I On or about July 31, 2016, STONE, using ?emailed
CORSI with the subject line, ?Call me The body of the email read: -should see
AssangeL] -should ?nd Bernie [S]anders brother who called Bill a Rapist turn him for
Trump[.] -should ?nd -or more proof of Bill getting kicked out.?

46.. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), OORSI emailed STONE at I

??Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox
will have me on mideAug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in preseason games. Time to let more than Podesta to

-12-

 

Case Document 29-25 Filed 04/28/20 Page 30 of 61

be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, .settingstage for Foundation
debacle." Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016, __an associate of emailed
STONE at? The email contained a link to a poll indicating that-Clinton

led Trump by 15 points. STONE responded ?enjoy it while can[.] i dined with my new pal
Julian Assange last night.? - subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet stated
that in STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting ASSANGE. STONE toid- he was joking and
had not actually met ASSANGE.2

48. Through a search of iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to -0 have ?dined? with ASSANGE. For example, an associate of
STONE. sent a text to STONE at approximately on August 2, asking ?How did ur meeting

go in STONE responded. ?it?s this The following day, the associate asked,

?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

 

Case Document 29-25 Filed 04/28/20 Page 31 of 61

call later heading for airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had geowlocation
information indicating that it was taken in Los Angeles.
. On or about August 15, 2016, CORSI emailed STONE at 
??Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it?s not over yet. More to come than anybne realizes. Won?t really get started
until after Labor Day. i?rn in NYC this week. Jerry.?
50 . On or about August 31, 2016, emailed STONE at
_?Did you get the PODESTA writeup.? STONE replied 

On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation tied to Ukraine Yanukovych ?a Panama papers reveals Podesta hired by
Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, emailed STONE at I

Is NY Post going to use the Pedesta [sic] stuff??
53. On or about September 24, 2016,-emailed CORSI, will have much

more on Turkey. Need a back channel highly sensitive stuf x? CORSI responded, ?We have

secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about

it again back, ?Awaiting secret ?le. Hope you are well.

Can?t wait for the debate. Channeling Reagan, I hope!? CORSII responded, ?Keep me posted

about In a subsequent meeting with investigators,-indicated this .

conversation concemed'possible derogatory information he was trying to obtain from Turkey.

-14-

 

Case Document 29-25 Filed 04/28/20 Page 32 of 61

54. On or about October 3, 2016, an associate of STONE eniailed STONE at
and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote

back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in JaniMany scores will be settled.? 'I?heassociate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See'
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s
important.?

55. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to thenwcandidate Clinton, but WikiLeaks did

. not make any new releases. Instead, ASSANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various-subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud 
?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.?

57. That same day, BANNON emailed STONE at? ?What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done BANNON wrote back, ?He didn?t
eat deal w/ STONE replied, ?Don't think so BUT his lawye-is a big

demo crat.?

-15-

 

Case Document 29-25 Filed 04/28/20 Page 33 of 61

58. When BANNON spoke with investigators during a voluntary interview on.
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE-about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Padesta Emails
Are Released. 

59. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,



calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.-?

60. According to phone records at approximately

1 1:27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for

approximately seventeen minutes.

63. At approximately CORSI called STONE and the two spoke for

approximately twenty minutes.

 

3 
d747l 4-80e5-1 lc6-87Se?2cl bfe943 b66_story.html

?i6-

 

Case Document 29-25 Filed 04/28/20 Page 34 of 61

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape. 

65. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, CORSI emailed STONE using expect

that rnuch of next dump focus, setting stage for Foundation debacle.?

66. At approximately author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with. STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? withla link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using

forwarded-message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual. I

G. STONE Asks CORSI for to Post About Podcsta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI reSponded to STONE, ?Ok. I understand.? Approximately twenty-
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job

numbers.?

68. On or about Wednesday, October 12, 2016, at approximately STONE,

using _mailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?Ok. Monday. The remaining stuff on

-17- .

 

Case Document 29-25 Filed 04/28/20 Page 35 of 61

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice??

69. On or about that same day, October 12, 2016, Podcsta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at both ?With the subject
line ?Podesta talking points.? Attached to the email was a file labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that
?Podesta is at the heart of a Russian?government money laundering operation that bene?ts
?nancially Podesta personally and the Clintons throngh the Clinton Foundation.?

70. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second timejust to be sure you got it.? STONE emailed
back via the-Account, ?Got them and used them.?

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

Joule ties to RUSSIA MONEY LAUNDERING to

CLINTON STONE responded, ?Nice but I was hoping for a piece I could

 

post under my lay-line since I am the one under attack by Podesta and now Mook.? CORSI
wrote back to STONE, ?I'll give you one more NOBODY YET HAS It looks to me
like -kimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund acCount, there?s no telling hriw much money he laundered, or where it ended up.

Nothing in Clinton Foundation audited ?nancials or IRS Form 9903 about received via

-13-

 

 

Case Document 29-25 Filed 04/28/20 Page 36 of 61

Russia Metcombank[.] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI
sent STONE an email at?with the subject, STONE article
RUSSIAN MAFIA STYLE G, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although 
have had some communications with Wikilcaks I had no advance notice about the
backing of Mr. Podesta nor 1 have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by -With the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?? I

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. - On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
?On Assange, can you call me now before STONE responded, ?Missed -?just
landed JFK on lnfowars now.? wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

 

Case Document 29-25 Filed 04/28/20 Page 37 of 61

75. On or about October 17, 2016, CORSI emailed STONE at
. .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if
they move to extradite him. My guess-is that he has a set of dead man files that include Hillary.
It?s what they used to call a ?Mexican stand off[.] Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.? Based on review of the original email that CORSI forwarded, the
?trusted source? was a self?identi?ed retired librarian who gathers information from public chat
rooms.

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbartcom in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated that, predicted that Podesta?s business dealings would be eXposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

73. I On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.? 

H20-

 

Case Document 29-25 Filed 04/28/20 Page 38 of 61

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

 Document 29-25 Filed 04/28/20 Page 39 of 61

 

Case Document 29-25 Filed 04/28/20 Page 40 of 61 - 

 

I. Congressional Testimony and Public Statements About His Relationship
with Wikileaks -

88. On September 26, 2017, STONE testi?ed before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time .
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Turnip
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my

Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,

would come under public scrutiny. . . .

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange? announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked ajournalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go-between? and ?mutual friend." All of these monikers are equally
true.

-23-

 

Case Document 29-25 Filed 04/28/20 Page 41 of 61

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or

encouragement been in any type of contact with Julian Assange?

MR. STONE: No.

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange,

you were only referring to a single fact that you had con?rmed with the intermediary 

MR. STONE: That 

Q: was the length and the breadth of what you were referring to? -

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, I
2017, STONE published an article on his website, stoneeoldtruth.eom, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

J. Messaging to Randy CREDICO about ?Back channel?

91. On or about November 19, 2017, Randy CREDICO (who, as described further.
below, STONE publicly identi?ed as his ?intermediary? to ASSANGE), messaged STONE, ?My
lawyer wants to see me today.? STONE responded, ?Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told-that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24.

 

Case Document 29-25 Filed 04/28/20 Page 42 of 61

back, ?That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a dea STONE wrote back, ?To do what Nothing
happening in DC the day before Thanksgiving why are busting my chops??

93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 11 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] Ijust followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for 

94. I STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, ?_?Forensic evidence proves that there is no back Channel. So
now you can relax.?

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? in a public Facebook post, STONE further stated that ?Credico merely 

-25-

 

Case Document 29-25 Filed 04/28/20 Page 43 of 61

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-rnails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could haVe just told him the truth that you didn?t have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If 
you testify you?re a fool. Becauseiof tromp [sic] i could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

-26..

 

Case Document 29-25 Filed 04/28/20 Page 44 of 61

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say i haVe solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?Yiou got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.?

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?EmbasSy
logs . . -. 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get
off because you?re friends with Trump so don?t worry. .1 have all the forensic evidence[.] 1 was
not a ba[cl<] Channel and I have all those emails from September of 201 6 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that

-27-

 

Case Document 29-25 Filed 04/28/20 Page 45 of 61

stated, "You are a rat. You are a stoolie. You hackstab your friends run your mouth my
lawyers are dying Rip you to shreds." Another message stated, ?I?m going to talte that dog away
from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 
104? On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2013,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . I. . It was sent in response to that. We talked about it too.

He was depressed about it. Or was he The article noted that CREDICO stated he did not

have prostate cancer and did not have any such discussion with STONE.

K. The Target Accounts

 

 

5 
threatened?dog? 35 91 13 70.html
6 

~28? 

 

Case Document 29-25 Filed 04/28/20 Page 46 of 61 .

 

Case Document 29-25 Filed 04/28/20 Page 47 of 61

 

Case Document 29-25 Filed 04/28/20 Page 48 of 61

BACKGROUND CONCERNING TWITTER
115. In my training and experience, Twitter owns and operates a free?aecess social?

networking website of the same name that can be accessed at Twitter

 

Case Document 29-25 Filed 04/28/20 Page 49 of 61

allows its users to create their own pro?le pages, which can include a short biography, a photo of
themselves, and location information. Twitter also permits users create and read l40-character
messages called ?Tweets,? and to restrict their ?Tweets? to individuals whom they approve. These
features are described in more detail below.

1 16. Upon creating a Twitter account, a Twitter user must create a unique Twitter
username and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.

117. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafterrThis information may include the user?s full name, e?mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identi?ers. For eaCh user, Twitter may retain information about
the date and time at which the user?s profile was created, the date and time at which the account
was created, and the Internet Protocol address at the time of sign?up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which Computers or other devices were used to access a given Twitter account.

18. A Twitter user can post a personal photograph or image (also known as an
??avatar") to his or her profile, and can also change the pro?le background or theme for his or her
account page. In addition, Twitter users can post ?bios? of 160 characters or fewer to their pro?le
pages.

ll9. Twitter also keeps 1P logs for each user. These logs contain information about the
user?s logins to Twitter including, for each access, the 1P address assigned to the user and the

date stamp at the time the user accessed his or her pro?le.

-32-

 

Case Document 29-25 Filed 04/28/20 Page 50 of 61

91

120. As discussed above, 'l?witter users can use their Twitter accounts to post ?Tweets
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also ?favorite,? ?retweet,? or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter usernaine, often preceded by the sign,
Twitter designates that Tweet a ?mention? of the identi?ed user. In the ?Connect? tab for each
account, Twitter provides the user with a list of other users who have ?favorited? or ?retweeted?
the user?s own Tweets, as well as a list of all Tweets that include the user?s usernarne (ta, ailist
of all ?mentions? and ?replies? for that usernarne).

121. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that?the user has shared on Twitter,
including images uploaded by other services. I

122. Twitter users can also opt to include location data in their Tweets, which will
reveal the users? locations at thetime they post each Tweet. This ?Tweet With Location?
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.

123. When Twitter users want to post a Tweet that includes a link to awebsite, they
can use Twitter?s link service, which converts the longer website link into a shortened link that
begins with This link service measures how many times a link has been clicked.

124. A Twitter user can ?follow? other Twitter users, which means subscribing to
those users? 'l?weets and site updates. Each user pro?le page includes a list of the people who are
folloWing that user (119., the user?s ?followers? list) and a list of people whom that user follows
(218., the user?s ?following? list). Twitters users can ?unfollow? users whom they previously

followed, and they can also adjust the privacy settings for their pro?le so that their Tweets are

-33-

 

Case Document 29-25 Filed 04/28/20 Page 51 of 61

visible only to the peeple whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into ?lists? that display on the right 
side of the user?s home page on Twitter. Twitter also provides users with a list of ?Who to
Follow,? which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.

125. in addition to posting Tweets, a Twitter user can. also send Direct Messages
(DMS) to one of his or her followers. These messages are typically visible only-to the sender and
the recipient, and both the sender and the recipient have the power to delete the message'from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular ?user, but older DMs are stored on Twitter?s database. I

126. Twitter users can con?gure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can con?gure his or her Twitter account to send updates to the
user?s mobile phone, and the user can also set up a ?sleep time? during which Twitter updates
will not be sent to the user?s phone.

127. Twitter includes a search function that enables its users to search all public
Tweets for keywords, uscrnames, or subject, among other things. A Twitter user may save up to
25 past searches.

128. . Twitter users can connect their Twitter accounts to third?party websites and
applications, which may grant these websites and applications access to the users? public Twitter
pro?les.

129. If a Twitter user does not want to interact with another user on Twitter, the ?rst 

user can ?block? the second user from following his or her account.

-34-

 

Case Document 29-25 Filed 04/28/20 Page 52 of 61

130. In some cases, Twitter users may communicate directly with Twitter about issues
relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider?s support services, as well as records of any actions taken by
the provider or user as a result of the cemmunications. Twitter may also suspend a particular user-
for breaching Twitter?s terms of service, during which time the Twitter user will be prevented
from using Twitter?s services.

131. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user?s account information, log, storedelectronic communications, and other data

retained by Twitter, can indicate who has used or controlled the Twitter account. This ?user
attribution? evidence is analogous to the search for ?indicia of occupancy? while executing a
search warrant at a residence. For example, pro?le contact information, communications,
?tweets? (status updates) and ?tweeted? photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant

time. Further, Twitter account activity can show how and when the account was acCessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along. with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.

Such information allows investigators to understand the geographic and chronological context of

-35-

 

Case Document 29-25 Filed 04/28/20 Page 53 of 61

Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds gee?location into some of its services, If enabled by the user, physical location is
automatically added to ?tweeted? communications. This geographic and'timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitteraccount owner?s state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner?s motive and intent to commit a crime information indicating a criminal
plan) or consciousness of guilt deleting account information in an effort to conceal
evidence from law enforcement).

132. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information

FILTER REVIEW PROCEDURES

133. Review of the items described in Attachment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney?client and
other operative privileges; The procedures include use, if necessary, of a designated ??lter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION

 

134. Based on the forgoing, I request that the Court issue the proposed search warrant.
135. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-36?

 

Case Document 29-25 Filed 04/28/20 Page 54 of 61

REQUEST FOR SEALING
136. I further request that the Court order that all papers in support of this application,
including the af?davit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
doCuments because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

9%

z?atrick J. Myers
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this day of September, 2018}



The Honorable Bleryl A. Howell
Chief United States District Judge

-37-

 

Case Document 29-25 Filed 04/28/20 Page 55 of 61

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Twitter aecounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or

operated by Twitter, Inc. (?Twitter?), a company headquartered in San Francisco, California

 



 

Case Document 29-25 Filed 04/28/20 Page 56 of 61

I.

ATTACHMENT 

Information to be disclosed by Twitter

To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. (?Twitter?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Twitter, or have been preserved

pursuant to-a request made under 18 U.S.C. 2703 Twitter is required to disclose the following

information to the government for each account listed in Attachment A:

A.

All ?Tweets? and Direct Messages sent, received, ?favorited,? or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

The content of all communications (public or private) sent to or from, stored in draft form

in, or otherwise associated with the account, including the content of all messages,

attachments, and header information;

All data and information associated with the pro?le page, including photographs, ?bios,?
and pro?le backgrounds and themes; 

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, phdtos, and videos; 

All information from the "Connect? tab for the account, including all lists of Twitter users

who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets

that include the username associated with the account ?mentions" or ?replies?);
All photographs and images in the user gallery for the account;

All location data associated with the account, including all information collected by the
?Tweet With Location? service;

All information about the account's use of Twitter?s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked; 

. All data and information that has been deleted by the user;

A list of all of the people that the user follows on Twitter and all people who are following
the user the user?s ?folloWing? list and ?followers? list); 

A list of all users that the account has ?unfollowed? or blocked;

All ?lists? created by the account; -

 

Case Document 29-25 Filed 04/28/20 Page 57 of 61

All information on the ?Who to Follow? list for the account;
All privacy and account settings;

All records of Twitter searches performed by the account, including all past searches saved
by the account; -

All current and historical subscriber and payment information, including full name, e?mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identi?cation numbers, security questions. and answers,
registration address, payment history, and other personal identi?ers;

All email addresses and telephone numbers ever registered (whether successfully or not)

- to the account, including dates of any changes and the IP addresses used for any changes;

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;-

All data and information associated with the pro?le page, including photographs;

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created; 

The dates and times at which the account and profile were created, and the Internet Protocol
address at the time of sign-up;

All transactional records associated with the account, including any logs or other records
of session times and durations; 

Any information identifying the device or devices used to access-the account, including a
device serial number, a GUID or Global Unique Identi?er, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers
Mobile Equipment Identi?ers Mobile Identi?cation Numbers
Subscriber identity Modules Mobile Subscriber Integrated Services

Digital Network Number International Mobile Subscriber Identi?ers
. or International Mobile Equipment Identities and any other

information regarding the types of devices used to access the account;

All activity logs for the account;

All location information for the account, including all location data collected by any
plugins or widgets;

The types of service utilized by the user;

-3-

 

Case Document 29-25 Filed 04/28/20 Page 58 of 61

BB.

CC.

DD.

EB.

FF.

GG.

HH.

11.

II.

All information about the account?s use of Twitter?s link service, including all website links
embedded in, exporting data to, or importing data from, the acco unt?s website or blog;

. All full website links that were shortened by Twitter?s link service, all resulting shortened

links, and all information about the number of times that a link posted by the account was
clicked;

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

All data and information that has been deleted by the user;

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration 11? address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identi?er; 

Information regarding accounts linked to accounts to which the Target Accounts are linked;

All records pertaining to communications between the Service Provider and any person
regarding the user or the user?s account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber. -

. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, ?nite, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 13-

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 .S.C. 1030 (unauthorized

access ofa protected computer); 18 U.S.C. 1505 and 1512 (obstruction ofjustice),18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

-4.

 

Case Document 29-25 Filed 04/28/20 Page 59 of 61

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or regarding disinformation, denial, disSernbling
or other ob?lscation about knowledge of, or access to, hacked material;

b. Ali records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, - Julian

individual associated with the Trump Campaign, any witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals; -

e. I All images, messages, communications, calendar entries, search terms, ?address
book? entries and I contacts, including any and all preparatory steps taken in
?irtherance of the above-listed offenses;

f. Communications, records, documents, and pther ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t? of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or

foreign principals;

 

Case Document 29-25 Filed 04/28/20 Page 60 of 61

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under inVestigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;

i. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such 

j. I Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account; I

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non?US. persontsy?including records that help reveal the
whereabouts of the made any eitpenditure, independent
expenditure, or disbursement for an electioneering communication; and

In. The identity Of any records that help reveal the whereabouts
of the person(s)mwho communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals. I I

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection Ha.

 

Case Document 29-25 Filed 04/28/20 Page 61 of 61

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney?client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 

 

Case Document 29-26 Filed 04/28/20 Page 1 of 71

A0 93 (Rev. 1 1233) Search and Seizure warrant

UNITED STATES DISTRICT COURT

for the
District of Columbia

In the Matter of the Search of Case: 1:1 
(Brie?y describe the property to be searched A 8"30?0291 9 i
or identi?; the person by name and address) ASSiQned TO. Beryl A i
Date: 9/27/201 i
ASSOCIATED WITH FOUR Description 8 8 i
ACCOUNTS STORED AT PREMISES earch Seizure Warrant i
CONTROLLED BY FACEBOOK i

SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
(identi?; the person or describe the property to be searched and give its location):

 

See Attachment A

1 ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search Will reveal (identi?) the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 1 1 . 2018 (not to exceed 14 days)

in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from Whose premises, the property was taken, 01' leave the copy and receipt at the place where the

property was taken.
The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

El Pursuant to 18 U. S. C. 3103a(b), i find that immediate noti?cation may have an adverseiesult listed In 18 S. C.
2705 (except for delay of t11al), and authorize the of?cer executing this warrant to delayr notice te the. person who, or whose

property, will be searched 01 seized (check the appropriate box) 
for days (not to exceed 30) El until, the facts justifying, the later specific date of-

 

 

Date and time issued: 7/2? ?19 f/?q 

 

fudge? signatw 

Hon. Beryl A. Howell, Judge

Printed Home and title

City and state: DC

 

 

Case Document 29-26 Filed 04/28/20 Page 2 of 71

A0 93 (Rev. LUI3) Search and Seizure Warrant (Page 2)

 

Return

 

Case 0.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and. was returned along with the original warrant to the
designatedjudge.

Date:

 

 

Executing o?icer ?s signature

 

Printed name and title

 

 

Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 3 of 71

ATTACHMENT A
Property to be Searched

This wanant applies to infonnation associated with the Facebook accounts registered to
the following email addresses ("Target Facebook Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook, Inc. ("Facebook"), a company headquartered in
Menlo Park, California:

This wanant also applies to information associated with the Instagram accounts registered
to the following email addresses ("Target Instagram Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook:

1-

 Case Document 29-26 Filed 04/28/20 Page 4 of 71

ATTACHMENT 

I. Information to be disclosed by 

A.

To the extent that the information described in Attachment A is within the

possession, custody, or control of the acebook, Inc. (hereinafter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, files, logs, or information that have been deleted but are still

available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target Facebook Accounts listed in Attachment A:





(0)



All contact and personal identifying information, including full name, user
identi?cation number, birth date, gender, contact e?mail addresses, physical address
(including city, state, and Zip code), telephone numbers, screen names, websites,
and other personal identi?ers.

All activity 10 gs for the account and all other documents showing the user?s posts
and other Facebook activities;

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated with those photos and-videos;
All pro?le information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends? Facebook user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Facebook group identi?cation numb ers;
future and past event postings; rejected ?Friend? requests; comments; gifts; pokes;

tags; and information about the user?s access and use of Facebook applications;

-2-

 

Case Document 29-26 Filed 04/28/20 Page All other records of communications and messages made or received by the user,
including all private messages, chat history, Video calling history, and pending
?Friend? requests;

All records relating to machine cookies;

All ?check ins? and other location information, including records of the user?s
latitude and longitude;

All IP logs, including all records of the IP addresses that logged into the account;
All records of the account?s usage of the ?Like? feature, including all acebook
posts and all non-Facebook webpages and content that the user has ?liked?;

All information about, the Facebook pages that the account is or was a ?fan? of;
All past and present lists of friends created by the account;

All records of Facebook searches performed by the account;

All information about the user?s access and use of Facebook Marketplace;

The types of service utilized by the user;

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

Group identi?cation numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group pro?le page;

All past and present Admins for the group;

The ?Creator? of the group;

 

Case Document 29-26 Fi-Ied 04/28/20 Page 6 of 71

(S)



B.

All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

All records pertaining to communications between Facebook and any person
regarding the user or the user?s Facebook account, including contacts with support
services and records of actions taken;

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and-queried.

To the extent that the information described in Attachment A is within the

possession, custody, or control of the Facebook, Inc. (hereinafter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

- available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target Instagram Accounts listed in Attachment A:

a.

All contact and personal identifying information, including full name, user
identi?cation number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identi?ers;

All past and current usernames associated with the account;

All activity logs for the account and all other documents showing the user?s posts

and other Instagrarn activities;

 

Case Document 29-26 Filed 04/28/20 Page 7 of 71

d. The dates and times at which the account and pro?le were created, and the Internet
Protocol address at the time of sign-up;

e. All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated with those photos and videos;

f. All pro?le information; News Feed informatidn; status updates; Videos,
photographs, articles, and other items; Notes; friend lists, including the friends? and
followers? Instagram user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Instagram group identi?cation numbers;
future and past event postings; tags;

g. All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending

?Friend? or ?follower? requests;

h. All records relating to machine cookies;

i. All ?check ins? and other location information, including records of the user?s
latitude and longitude;

j. All IP logs, including all records of the IP addresses that logged into the account;

k. All records of the account?s usage of the ?follow? feature, including all Instagram

posts and all non-Instagram webpages and content that the user has ?liked?;

I. All past and present lists of friends created by the account;
m. All records of Instagram searches performed by the acdount;
n. The types of service utilized by the user;

 

II.

Case Document 29-26 Filed 04/28/20 Page 8 of 71

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

All information regarding the particular device or devices used to login to or access
the account, including device identi?er information or cookie information,
including all information about the particular device or devices used to access the
account and the date and time of those accesses;

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

All past and present Admins for the group;

The ?Creator? of the group;

All privacy settings and other account settings, including privacy settings for
individual Instagrarn posts and activities, and all records showing which Instagram
users have been blocked by the account;

All records pertaining to communications between Facebook or Instagram and any
person regarding the user or the user?s Instagram accOunt, including contacts with

support services and records of actions taken.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

 

Case Document 29-26 Filed 04/28/20 Page 9 of 71

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

at

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, _Julian

individual associated with the Trump Campaign, any witness in the investigation;
Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;
Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in

furtherance of the abdve-listed offenses;

 

Case Document 29-26 Filed 04/28/20 Page 10 of 71

f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user? state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement; I

l. The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the conununicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign

principals.

 

Case Document 29-26 Filed 04/28/20 Page 11 of 71

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed
in subsection 

111. Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 

 Document 29-26 Filed 04/28/20 Page 12 of 71

can? 
IN THE UNITED STATES DISTRICT COURT 2' 2%

FOR THE DISTRICT OF COLUMBIA Wt. as. District at at - . .
. @0111! is for the District 

IN THE MATTER OF THE- SEARCH OF
INFOREIATION ASSOCIATED WITH FOUR
ACCOUNTS STORED AT PREMISES
CONTROLLED BY FACEBOOK

Case: 

Assigned To Howell, Beryl A.

Date 9/27/2018

Description: Search Seizure Warrant

 

em
The United. States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and a?davit in support thereof (collectively the 
and to require Facebook, Inc. an electronic communication and/or remote
computing services provider headquartered in Menlo Park, California, not to disclose the existence
or'contents of the Warrant pursuant to 18 U.S.C. 2705(b). I
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. 
. . IT IS THEREFORE ORDERED that the motion is and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related

materials, the instant motion to Seal, and this Order be SEALED until further order of the Court;

and

Case Document 29-26 Filed04/28/20 Page 13 Of 71

IT IS FURTHER ORDERED that, pursuant to 18 27050)), Facebook and its
employees shall not disclose the existence-or content of the Wan'ant to any other person (except
attorneys for Facebook for the purpose of receiving legal advice) fof a period of one year or until

further order of the Court.

x4473 - .W
THE HONORABLE HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

. 7117720 72?.

Date

 Document 29- 26 Filed 04/28/20 Page 14 of 71

[hf-H?


til?h .



If. 
i

UNITED STATES DISTRICT COURT 3? i

for the 33in} 3- i? 

District Of Columbia ?lerk Ux?l iJistriLt 8. Bankruptcy
Courts tor the District of Columbia

?3.1

In the Matter of the Search of

(Bi ie?y describe the pi ope? [y to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED 
FOUR ACCOUNTS-STORED AT PREMISES
CONTROLLED BY FACEBOOK

Case: 1: 18 sc? 02919

Assigned To: Howell BerylA.
Assign Date: 9/27/2018

Description. Search Seizure Warrant



APPLICATION FOR SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identt?/ the person or describe the

property to be searched and give its location): 
See Attachment A
located in the Northern District Of California there is now concealed (identity the

 

 

person or describe the property to be seized):

See Attachment 

The basis ?01 the search under Fed. R. Crim. P. 41(c) 18 (check one orrnore):

[Elevidence of a crime;
lifeontiaband, fruits of crime, or other items illegally possessed;

property designed for use, intended for use, or used in Committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a Violation of: 

Code Section O?ense Description
52 U.S.C. 30121 - Foreign Contribution Ban 
18 U.S.C. 1001, 1030," 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Af?davit for ad d?l 

The application is based on these facts:
See attached Affidavit.

Er Continued on the attached sheet.
i3 Delayed notice of days (give exact ending date if more than 30 days:
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.

@Zp? ff??
Reviewed by I Applieant? signature
Patrick J. Myers, Special Agent, FBI

Printed name and tide

is requested

 

 

 

 

Kyie R. Freeny (ASC)

 

Sworn to before me and signed in my presence.

 

Date: 7/}f/213/2 @f 

Judge signature

Hon. Beryl A. Howell, Chief US. District Judge

Printed name and title

City and state: D-C-

Case Document 29-26 Filed 04/28/20 Page 15 of 71
I 1:3 $3253 5-ng
LL LL LL33 .3):

. SE 2 29323
IN THE UNITED STATES DISTRICT COURT
?1 '1 Clerk, US Dlat?eiE-i Bankruptcy
FOR THE DISTRICT OF COLUMBIA Semis fer the District of Columbia

IN THE MATTER OF THE SEARCH OF

INFORMATION ASSOCIATED WITH Case: 1 

Assigned To: Howell BerylA.
FOUR ACCOI NFS STORED AI
Assign. Date: 9/27/2018

PREMISES CONTROLLED BY

FACEBOOK Description: Search Seizure Warrant

 

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick If Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I make. this affidavit in support of an application for a search warrant for
information associated with the two Facebook accounts and two Instagram accounts (the ?Target
Accounts?), stored at premises owned maintained, controlled or operated by acebook A Inc.
(?Facebook?), a company headquartered in Menlo Park, California. As set forth below, the Target

Accounts are believed to be

 

Up on receipt of the information described in Attachment A, government-authorized

persons will review that information to locate the items described in Attachment B.

2. I am a Special Agent-with the Federal Bureau of Investigation assigned to .
FBI Pittsburgh werking directly-with the Special Counsel?s Office. I have been a Special Agent
with the FBI since-2017. I was previously employed as a network andsoftware engineer for
approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national-
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this affidavit come from my personal observations, my training and

experience, and informationobtained from other FBI personnel and witnesses. This affidavit is

-1-

Case Document 29-26 Filed 04/28/20 Page 16 of 71

intended to Show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instrumentalities of Violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (acCessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit
Wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign'expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instlurnentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION A

5. i This Court has jurisdiction to issue the requested warrant because it is ?a court of

competent jurisdiction? as defined by 2711. Id. 2703(a), 
Speci?cally, the Court is ?a district court of the United States (including-a magistrate
judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C. I
2711(3)(A)(i). The offense conduct included activities in Washington, DC, as detailed below.
PROBABLE CAUSE I
A. Background on Relevant Individuals
I Roger STONE
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US. politics for decades. STONE worked on the presidential campaign of



Case Document 29-26 Filed 04/28/20 Page 17 of 71

Donald J. Trump (the ?Ca1npaign?) until August 2015. Although Stone had no official
relationship with the Campaignthereafter, maintained his support for Trump and
continued to make media appearances in support of the, Campaign. As described further below,
STONE also maintained contact with individuals employed. by the Campaign, including then~
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI I I

7. Jerome CCRSI is a political commentator who", according to publicly available
information, served as the ?Washington Bureau Chief for Inforwarscom.? According to
publicly?available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?\VNDeom.? CORSI has also written a number of I
books regarding Democratic presidential candidates. As described further below, ICORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by. WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

Casell:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 18 of 71

 

Russian Government?Backed Hacking Activity During the 2016 Presidential
Election I

On January 6, 2017, the USIC released a declaSsi?ed version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following: - I

Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the-

US presidential election. Russia?s goals Were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her

?electability and potential presidency. We further assess Putin and the Russian

Government developed a clear preference for President?elect Trump.

10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?snob as cyber
activity?With overt efforts by Russian Government agencies, state?funded media, third?party
intermediaries, and paid social media users or ?trolls.??

.1 l. . With-respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services condu0ted cyber operations against targets associated with the 2016 US presidential I
election, including targets associated with both major US political parties.? Further, July-
2015, Russian intelligence gained access to DemocraticNational Committee (DNC) networks

and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence DirectOrate: operations res-ulted I



Case Documentl29-26 Filed 04/28/20 Page 19 of 71

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political
figures. By May, the GRU had extiltrated large volumes of data from the 

12. With respect to the release of stolen materials, the USIC assessed ?with high
con?dence that the GRU used the Guccifer 2.0 persona, DCLealcscom, and WildLeaks t0 
release US victim data obtained in cyber operations publicly and in exclusives-to media outlets.?

13. . Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Office has. determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential-election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
- access to DNC computers housed on a third-party cloud+computing service. In or around late 
September, these individuals stole datalfrom these cloud?based computers by creating backups of
the cloud?based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts. I

16. Cum about September 4, 2016, individuals associated with the IGRU stole the
emails from a former White House adviser who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida counties.

Case Document 29-26 Filed 04/28/20 Page 20 of 71

18., On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to in?uence the 20 i 6
presidential election, including conspiracy to commit authorized access to protected computers.
See United States Viktor Borisovich at at]. (Case No. 

C. Public Interactions with Guccifer 2.0 and WikiLeaks

19. On June 14, 2016, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of ?les and mails, I gave to Wikileaks. They will publish them soon.?

In that post, Ouccifer 2.0 also began releasing hacked DNC documents.

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from .
the DNC. -

21. I On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear-
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of IGuccifer
I The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he eXplains who he is and
why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He. went to WikiLeaks with the DNC ?les and the rest is history. Now the world would
'see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican

-5-

Case Docuiment 29-26 Filed 04/28/20 Page 21 of 71

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
AS SANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?" STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the-Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary. I

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
. numbers and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr'calling
Guccifer 2.0 a after Guccifer 2.0 had been banned. from Twitter. The next day, I
Guccifer 2.0?s Twitter account was reinstated;

25. On August 17, 2016, Guccifer 2.0 publicly tweeted?, ?@RogerJStoneJr paying you
back.? Guccifer also sent a private message to gerJ Stone] stating ?i?m pleased to say 
great man. please tell me if 1 can help it anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a?Washington D.C.?based lobbying ?rms to in?uence US. I
policy toward Ukraine.

27. On August 21, 2016, using @Roger] Stonel R, STONE tweeted: ?Trust me, it will

Case Document 29-26 Filed 04/28/20 Page 22 of 71

soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a interview that same
day, STONE reiterated that because of the work of a ?mutual acquaintance? of both his and
SAN the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches.? He added: ?Well, ?rst of all, Ithink Julian
Assange is a hero. . I think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those-emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot'rnore. These are lilte the Watergate tapes.?

28. On September 16, 2016, STONE said'in a radio interview with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new. documents on Hillary on a Weekly -
basis fairly soon. And that-of course will answer the question as to what exactly what was erased
on that email server.?

29. - On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.? I

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in LondonSANGE announcement which was
part of WikiLeaks? 10-year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerlStoneJr
to tweet: ?Payload coming. #Lothhemup.? .

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of ler remarks.

32. I Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

.8.

Case Document 29-26 Filed 04/28/20 Page 23 of 71

The Podesta Emails #HillaryClinton #Podesta #imWithI-Ier? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s-personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
1 Day, November 8, 2016. on October 12, 2016, Pedesta referring back to August 21,
2016 and Twitter references argued publicly that ?[it is] a reasonable assumption to 
or at least a reasonable conClusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we?have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of commu'niCations. I?m not implying I have any
in?uence with hint or that I have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e?mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, Writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of
charges Iknew about the hacking of Podesta?s email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct dis-closures)- all came true.?

D. Private Twitter Direct Messages with WikiLeaks and ASSANGE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

-9-

Case Document 2926 Filed 04/28/20 Page 24 of 71

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks.l The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since 1 was allover
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up be you may want
to rexarnine the strategy of attacking rne? cordially 

?36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t 'go there if you don?t want us to correct you? 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to.
@wikileaks: ?Ha! The more you \"correct me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

3 8. On or about November-9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @Roger] Stone] containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to cornniunicate.?

39. in addition, @Ro gerJ Stone] 1' also exchanged direct messages With AS SAN 
the founder of IWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SANGE in numerous public reports, stating:
?Still-nonsense. As a journalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were

 

I On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @Ro gerJ Stone} r. - .

. ?10-

Case Document 29-26 Filed 04/28/20 Page 25 of 71

indisputably stolen from the government and the courts ruled it was legal to do so. and refused to
issue an order restraining the paper from publishing additional articles. If the US. government

moves on you I will bring down the entire house of cards. With the trumped?up sexual assault
charges dropped 1 don?t know of any crime you need to be pardOned for best regards. That
same day, @JulianAssange responded: ?Between CIA and Do] they?re doing quite a lot. On the
side. that?s coming most strongly from those obsessed with taking down Trump tryingto
squeeze us into a deal.?

'40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct inessage to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Governrnent. Fed treatment of you and WikiLeaks is an outrage. Must be cireurnspect in
this forum. as experience demonstrates it is monitored. Best regards 

E. Communications with STONE, -a1_1d Others Regarding
Forthcoming Leaks

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for -address,? On October 17, I

2017, Chief Judge Howell issued a search warrant for one of -addresses,

 

On or about December 19, 2017, Chief Judge Howell issued a search

   

warrant for email account. On or about March 14, 2018, Chief Judge Howell

  

issued a search-warrant for iCloud account. Information recovered pursuant to those

search warrants indicated the following:

42. On or about May 15, 2016,-e1nailed CORSI: ?Here is my ?ight
schedule. Need to get somethingcon?nned now . . . CORSI responded, copied Roger 

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

Case Document 29-26 Filed 04/28/20 Page 26 of 71

appears to have forwarded the message to STONE at?who replied to

CORSI that, ?May meet Manafort guarantee nothing.?

43. On or about May 18, 2016, CORSI emailed STONE at?

with the title, ?Roger Why don?t you look this over before I send it to-I believe that

CORSI wrote,

 
 

nd 1 did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?
44. On July 25, 2016-, STONE, usi_ sent an email to
CORSI with the subject line, ?Get to Assange.? The-body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
. Foundation, allegedly.? 

45. On or about July 31, 2016, STONE, using emailed

CORSI with the subject line, ?Call me The bod},r of the email read1-should see

 

Assange[.] -should find Bernie [S]anders brother who called Bill a Rapist turn him'for
Trump[.] -should ?nd _or more proof of Bill getting kicked out. 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at
?Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are ox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine. to surface Victor,
for now. bump for an'artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in pre?season games. Time to let more than Podesta to

-12-

Case Document 29-26 Filed 04/28/20 Page 27 of 71

be exposed as in bed enemy if they are not ready to HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke 
neither he nor she well. I expect that much of next dump focus, Setting stage for Foundation
debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016_ an associate of emailed
STONE at ?The email contained a link to a poll indicating that Clinton - 

led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal
Julian Assange last night.? -ubsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet stated
that in 2018,-told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol- he was joking and
had not actually met -

48. Through asearch of iCloud account, the FBI has uricovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to - to have ?dined? with ASSANGE. For example, an associate of
STONE sent a text to STONE at approximately 3 :3 8PM on August 2, asking ?How did ur meeting

go in STONE responded. ?It?s this The following day, the associate asked,

?Any report from at meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

 

Case . Document 29-26 Filed 04/28/20 Page 28 of 71

call later heading for-airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had goo?location
information indicating that it was taken in 'Los Angeles. I I

49. . 0a or- about August 15, 2016,?C0Rsr emailed STONE at

?Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it?s not over yet. More to come than anyone realizes. Won?t really get started

 

until after Labor Day. I?m in NYC this week. Jerry.? . .
50. On or about August 31, 2016, CORSI emailed STONE at
?Did you get the PODESTA na'iteup.? STONE replied 

51. On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatorn in Giustra scandal. Podesta now under FBI
investigation tied to. Ukraine Yanukovych 4 Panama papers reveals Podesta hired by
S[b]erbank, Russia?s largest ?nancial institution Pod-esta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, CORSI emailed STONE. at

. ls NY Post going to use the Pedesta [sic] stuf 

53. On or about September 24, 2016- emailed coast ?1 will have much -

 

more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded, ?We have

secure back channel through Roger. 1 saw him again in NYC last Friday and spoke to him about

it again back, ?Awaiting secret ?le. Explosives. Hope you are well.

Can't wait for the debate. Channeling Reagan, I'hope!? responded, ?Keep me posted
about In a subsequent meeting with investigators,- indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

Case DOCUment 29-26 Filed 04/28/20 Page 29 of 71

54. On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: ?Assange what?s he got? Plope it?s good.? STONE wrote
back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled.? The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote:??You should call Roger. See
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s I
important.?
55. . On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did-
not make any new releases. Instead, AS SAN GE promised more documents, including I
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the US election process.? AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the US. election?related documents would all come out before Election Day.
56'. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
?Assange made a fool of himself. Has nothing or he. would have released it. Total BS hype.? 
57. That same day, BANN ON emailed STONE at? ?What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill-him and the London police are standing done BANNON wrote back, ?He didn?t

cut deal w/ STONE replied, ?Don?t think so BUT his lawyer -is a big

democrat.?

-15-

Case Document 29-26 Filed 04/28/20 Page 30 of 71

58. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANN ON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANN ON had been hoping for releases of damaging information that morning.

. F. STONE and CORSI Communications on October 7, 2016, when the Pedesta Emails
Are Released. . - -

5 9. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received-a phone call from
a sOurce regarding a previously unaired Video of candidate Trump. According to the same I
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of foetage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.? .

60. According to phone records? at approximately I
11:27 AM, cons: placed a call to STONE, which-STONE did not answer. 

61. At approximately STONE received a phone call from the Washington
Post. The approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for
approximately seventeen minutes. I

63. At approximately CORSI called STONE and the two spoke for

approximately twenty minutes.

 

3 stoom/ lifestyle! 
ceS ?1 1e6-875 6?20 1 bfe943b66__story.html

~16?

Case Document 29-26 Filed 04/28/20? Page 31 of 71

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape. I

65. At. approximately 4:3 0PM, WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, coast emailed STONE using expect

that much of next dump focus, setting stage for Foundation debacle.?

66. - At approximately author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the .

newly?released Podesta' emails. Approximately ten minutes later, STONE, using

-orwarded .message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.

 

G. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI responded to STONE, ?Ok. I understand.? Approximately twenty
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbersabout Wednesday, October 12, 2016, at approximately STONE,

using ?mailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?0k. Monday. The remaining stuff on

-17-

Case Document 29-26 Filed 04/28/20 Page 32 of 71

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will. take weekend. Your choice??

69. On or about that same day, October 12, 20l6, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at bot? with the subject
line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that

I ?Podesta is at the. heart of a Russian-government money laundering operation that benefits
?nancially- Podesta personally and the Clintons through the Clinton Foundation.?

70. I CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed
CORSI back via the Hotmail Account, ?Got them and used them.? 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

Joule ties to RUSSIA MONEY LAUNDERTNG to
CLINTON STONE responded, ?Nice but I was hoping for a piece I could
post under my by?line since I am the one under attack by Fodesta and-now Mook.? CORSI-
wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me
like -skimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America? 
Clinton Fund account, there?s no telling how much money he laundered, or where it ended up.

I Nothing in Clinton Foundation audited ?nancials or IRS Form 9903 about received via

-13-

Case Document 29-26 Filed 04/28/20 Page 33 of 71

Russia 85 Metcombank[.] I?m working on that angle now.? STONE-replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI 

sent STONE an email a_ith the subject, article I
RUSSIAN MARIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton oundatitin and John Podesta.? In that post, STONE wrote, ?although I
have had some back?channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how muchrnoney did a controversial Russian billionaire -
investor with ties to the Vladimir Putin and the Russian government, launder through
Meteornbank, a Russian regional bank owned 99.978 percent by -with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that. is-operated by the Clinton
I Foundation??

73. I On or about October 14, 2016, CORSI sent a message to. STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
?On Assange, can you call me now before STONE responded, ?Missed just I
landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

Case Document 29-26 Filed 04/28/20 Page 34 of 71

75. On or about October 17, 2016, CORSI emailed STONE at
?with the subject, ?Fwd:
ASSANGE. . .URGENT. . wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set bf dead man ?les that include Hillary.
It?s what they used to call a ?Mexican stand offH? Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.? Based on review of the original email that CORSI forwarded, the
?trusted source? was a self?identi?ed retired librarian who gathers information from public chat
rooms. I
'76. On or about October 18', 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbartcom in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-inails.?
STONE. stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.?

?20? 

Case Document 29-26 Filed 04/28/20 Page 35 ?of 71

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

Case Document 29-26 Filed 04/28/20 Page 36 of 71

 

Case Document 29-26 Filed 04/28/20 Page 37 of 71-

 

I. Congressional Testimony and Public Statements About His Relationship
with Wildleaks

88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
remitted here today. The charge that I knew in advance about, and predicted, the hacking
cf Clinton campaign chairman John Podesta?s email, that I had advanced knowledge of

the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or

that, my now public exchange with a persona that our intelligence agencies claim, but

cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,

such assertions are conjecture, supposition, projection, and allegations but none of them
are facts?

My Tweet of August 21, 2016, in which 1 said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time
that'my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweetof August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers business activities in Russia with the
oligarchs alound Putin, their uranium deal, theit bank deal, and their Gazprorn deal,
would come under public scrutiny?

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange? announced that he was in possession of Clinton DNC emails.
.I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go-between? and ?mutual friend.? All of these monikers are equally
true.

-23 

Case Document 29-26 Filed 04/28/20 Page 38 of 71

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic

- members of HPSCI published excerpts from Stone?s September 2017 testimony before 

Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange? 
MR. STONE: No.

Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had con?rmed with the intermediary 

STONE: That 

Q: was the length and the breadth of what you were referring to?

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions.

90. In the month that followed his testimony before HPSCI, on or about October 24,
i 2017, STONE published an article on his website, stonecoldtruth.corn, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. .I . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story?. I

J. Messaging to Randy CREDICO about ?Back channel?

91'. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his ?intermediary? to ASSANGE), messaged STONE, ?My
laWyer wants to see me today.? STONE responded, ?Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24-

Case Document 29?26 Filed 04/28/20 Page 39 of 71

back, ?That was the point at which your lawyers should have told them you would assert your,
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what Nothing
happening in DC the day before Thanksgiving why are busting my chops??

'93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good once meeting with him is perfectly legal and all you ever told me was

i he had the goods [o]n Hillary and would publish them which he himself said in public b4 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it On. I told you to watch his Tweets in October not before that I knew nothing .
about the DNC stuffL] I just followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for I
. 94. STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, ?fForensic evidence proves that there is no back Channel. So
now you can relaxabout November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28,- 2017, CREDICO and STONE communicated via text message more than a dozen
times. I

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? In a public Facebook post, STONE further stated that ?Credico merely 

-25-

- Case Document 29-26 Filed 04/28/20 Page 40 of 71

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e?rnails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could have just told him-the truth that you didn?t have a
back Channel they now know that I was not until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] [But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICOI
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If
you testify you?re a fool. Because of tromp [sic] I could never get away! with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 [Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

~26?

Case Document 29-26 Filed 04/28/20 Page 41 of 71

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to-
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPS CI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email frOm his chief of staff August 25th 2016 to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.? .

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy
logs. . . 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you-?11 get
off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 

reporters cepies of email messages he had received from STONE in the prior few days that

.27..

Case Document 29-26 Filed 04/28/20 Page 42 of 71

stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my
lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to-talre that dog away
from you,? referring to therapy do g. CREDICO stated that it was ?certainly scary .-
. . When you start bringing up my dog, you?re crossing the I
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.5 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it-on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too.'

He was depressed about it. Or was he lying.? The article noted that CREDICO stated he?did not

have prostate cancer and did not have any such discussion with STONE.

K. The Target Accounts

 

 

5 I
threatened?dOg?l 3 591 1370.htm1
6 8/0 5/10 

-23-

Case Document 29-26 Filed 04/28/20 Page 43 of 71

 

Case Document 29-26 Filed 04/28/20 Page 44 of 71

 

- Case Document 29-26 Filed 04/28/20 Page 45 of 71

 

Case Document 29-26 Filed 04/28/20 Page 46 of 71.

BACKGROUND CONCERNING FACEBOOK

116.. Facebook owns and operates a free?access social networking website of the same
name that can be accessed at http://wwfaceboolccom. Facebook allows its users .to establish
accounts withFacebook, and users can then use their accounts to share written news, photographs,
videos, and other information with 'other Facebook users, and sometimes with the general public.

117. Facebook asks users to provide basic contact and personal identifying information
to Faceboolc, either during the registration process or thereafter. This information may include the
. user?s full name, birth date, gender, contact e?mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identi?ers. acebook
also assigns a user identi?cation number to each account.

'118. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identi reation number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a ?Friend Request.? If the recipient of a ?Friend Request?
accepts the request, then the two users will become ?Friends? for purposes of Facebook and can
exchange communications or View information about each other. Each Facebook user?s account
includes a list of that user? 3 ?Friends? and a ?News Feed,? which highlights information about the
user?s ?Friends,? such as pro?le changes, upcoming events, and birthdays.

119. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook

users, or to anyone with access to the Internet, including people who are not Facebook users. A

32?

Case Document 29-26 Filed 04/28/20 Page 47 of 71

Facebo-ok user can also. create ?lists? of Facebook friends to facilitate the application of these
privacy settings. acebook accounts also include other account settings that users can adjust to
control, for example, the types of noti?cations they receive from Facebook.

120. Facebook users can create, pro?les that include photographs, lists of personal
interests, and other information. Faeebobk users ?can also post ?status? updates about their
whereabouts and actions, as well" as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming ?events,?
such as social occasions, bylisting the event?s time, location, host, and guest list. In addition,
Facebook users can ?check in? to particular locations or add their geographic locations to their
Faceboolc posts, thereby revealing their geographic locations at particular dates and times. A
particular user?s pro?le page also includes which is a space where the user and his or
her-?Friends? can post messages, attachments, and links that will typically be visible to anyone
who can view the user?s pro?le.

121. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted when s/he uploaded-the photo or video. It also
provides users the ability to ?tag? label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a noti?cation of the tag and a link to. see the
photo or video. For Facebook?s purposes, the photos and videos associated with a user?s account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that: user tagged in them.

122. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e?mail messages, are sent to thelrecipient?s ?Inbox? on

acebook, which also stores copies of messages sent by the recipient, as well as other information.

-33-

Case Document 29-26 Filed 04/28/20 Page 48 of 71

Facebook users can also post comments on the Facebook pro?les of other users or on their own
pro?les; such comments are typically associated with a speci?c posting or item on the pro?le. In
addition, Facebook- has a Chat feature that allows users to send and receive instant messages
through Facebook. I These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call. I

123. If a Facebook user does not want to interact with another user on Facebook, the
?rst user-can ?block? the second user from seeing his or her account. -

124. Facebook has a ?like? feature that allows users to give positive feedback or connect
to particular pages. Facebook users can ?like? Facebook posts or updates, as well as webpages or
content on third?party (tie. non?Facebook) websites. Facebook users can also become ?fans? of
particular Facebook pages.

125. Facebook has a search function that enables its users to search Facebook for
keywords, usernames, or pages, among other things.

126. Each Facebook account has-an activity log, which is a list of the user?s posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as ?liking? a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user?s Facebook page. . 

127. Facebook Notes is a blogging feature available-to Facebook users, and it enables
users to write and post notes or personal web logs (?blogs?), or to import their blogs ?orn other

services, such as Xanga, LiveJournal, and Blogger.

-34-

Case Document 29-26 Filed 04/28/20 Page 49 of 71

128. The Facebook Gifts feature allows users to send Virtual ?gifts? to their friends that
appear as icons on the recipient?s pro?le page. Gifts cost money to purchase,and apersonalized
message can be attached to each gift. Facebook users can also send each other ?pokes,? which are
free and simply result in a noti?cation to the recipient that he or she has been?poked? by the
sender.

129. Facebook also has a Marketplace feature, which allows users to post free classi?ed
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.

130. In addition to the applications described above, Facebook also provides its users
with access to thousands of other applications (?apps?) on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user?s access or
use of that application may appear on the user?s pro?le page.

131. Some Facebook pages are af?liated with groups of users, rather than one individual
user. Membership. in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and. reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator andfor creator of the group. FacebOok uses the term ?Group Contaot Info? to
describe the contact information for the group?s creator and/or administrator, as well as a PDF of
the'current status of the group pro?le page. I

132. Facebook uses the term ?Neoprint? to describe an expanded View of a given user
pro?le. The ?Neoprint? for a given user can include the following. information from the user?s
pro?le: pro?le contact information; News. Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends?

Facebook user identi?cation numbers; groups and networks of which the user is a member,

-3 5-

 Case Document 29-26 Filed 04/28/20 Page 50 ofi71

including the groups? Facebook group identi?cation numbers; future and past event postings;
rejected ?Friend? requests; comments; gifts; pokes; tags; and information about the user?s access
and use of Facebook applications. 

. 133. Facebook also retains Internet Protocol logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook pro?le,
that user?s IP log would re?ect thelfact that the user viewed the pro?le, and would Show when and
from what IP address the user did so.

134. Social networking providers like ac'ebook typically retain additional information
about their users? accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). - In some cases, Facebook users may 

communicate directly With Facebook about issues relating to their accounts, 'such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
,Facebook typically retain records about such corhrhunications, including records of I contacts
between the user and the provider?s support services, as well as records of any actions taken by
the provider or user as a result of the communications.

135. As explained herein, information stored in connection with a Facebook account
may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal
conduct under investigation, thus enabling the United States to establish and prOve each element
or alternatively, to exclude the innocent from further. suspicion, In my training and experience, a

Facebook user?s ?Neoprint,? IP log, stored electronic communications, and other data retained by

-35-

Case DoCument 29-26 Filed 04/28/20 Page 51 of 71

Facebook, can indicate who has used or controlled the Facebook account. This ?user attribution?
evidence is analogous to the search for ?indicia of occupancy? while executing a search warrant
at a residence. For example, pro?le contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be 7
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (lP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context of Facebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo?location into
some of its services. Geo-location allows, for example, users to ?tag? their location in posts and
Facebook ?friends? to locate each other. This geOgraphic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, acebook account activity may
provide relevant insight into the Facebook account owner?s state of mind as it relates to the offense .
under .investigatiOn. 'For example, information on the Facebook account may indicate the oWner?s
motive and intent to commit a crime information indicating a plan to commit a crime), or
consciousness of guilt (eig., deleting account information in an effort to conceal evidence from
law enforcement).

136. Therefore, the computers of Facebook are likely to contain all the material

described above, including stored electronic communications and information concerning

-3 7-

Case Document 29-26 Filed 04/28/20' Page 52 of 71

subscribers and their use of Facebook, such as account access information, transaction information,
and other account information. -
BACKGROUND CONCERNING INSTAGRAM
137. From my review of publicly available information provided by lnstagram about
its service, including instagrain?s ?Privacy. Policy,? I am aware of the following about Instagram
and about the informationcollected and retained by Instagrarn. I
I 138. Instagram is a social networking service owned by Facebook, Inc. Instagrarn
owns and operates a free?access social?networking website of the same name that can be
accessed at http:/fmvwinstagramcom. Instagrarn allows its users to. create their own profile
pages, which can include a short biography, a photo of themselves, and other information. Users
can access Instagrarn through the Instagram website or by using-a special electronic application
created by the company that allows-users to access the service through a mobile device.
139. Instagrarn permits users to post photos-to their pro?les on Instagrarn and
otherwise share photos with others on Instagrarn, as well as certain other social?media services,
including Flickr, Facebook, and Twitter. When posting or sharing a photo on Instagrarn, auser
can add to the photo: a caption; various ?tags? that can be used to search for the. photo (8. g. a
user made add the tag #vw so that people interested in Volkswagen vehicles can search for and
?nd the photo); location information; and other information. A user can also apply a variety of -
?filters? or other visual effects that modify the look of the posted photos. In addition, Instagrarn
allows users to make comments on posted photos,'including photos that the user posts or photos

posted by otherusers of Instagram. Users can also f?like? photos.

-33-

Case Document 29-26 Filed 04/28/20 Page'53 of 71

140. Upon creating an lnstagram account, an Instagram user must create a unique
Instagram username and an account password. This information is collected and maintained by
lnstagram.

l41. Instagram asks users to provide basic identity and contact information upon
registration and also allows users to provide additional identity information for their user pro?le.
This information may include the user?s full name, e?mail addresses, and phone numbers, as well
as potentially other persbnal information provided directly by the user to Instagram.? Once an
account is created, users may also adjust various privacy and account settings for the account on
Instagram. Instagram collects and maintains this information.

142'. 'Instagram- allows users to have ?friends,? which are other individuals with whom
the user can share information without making the information public. Friends on Instagram
may come from either contact lists maintained by the user, other third-party social media
websites and information, or searches conducted by the user on Instagram profiles. Instagram
collects and maintains this information.

143. Instagram also allows users to ?follow? another user, which means that they
receive updates about posts made by the other user. Users may also ?unfollow? users, that is,
stop following them or block the, which prevents the bloCked user ?om following that user.

144. Instagram allow users to post and share various types of user content, including
photos, Videos, captions, comments, and other materials. Instagrarn collects and maintains user
content that users post to Instagram or share through Instagram.

I 145; Instagram users may send photos and videos to select individuals or groups Via

Instagram Direct. Information sent Via lnstagram Direct does not appear in a user?s feed, search

history, 'or profile.

-39-

Case Document 29-26 Filed 04/28/20 Page 54 of 71

146. Users on lnstagrarn may also search Instagram for other users or particular types
of photos or other content.

l47. For each user, Instagram also collects and retains information, called ?log ?le?
information, every time a user requests access to lnstagram, whether through a web page or
through an app. Among the log ?le information that lnstagi?arn?s servers automatically record is
the particular web requests, any Internet Protocol address associated with the request, type?
of browser used, any referringtexit web pages and associated URLs, pages viewed, dates and
times of access, and other information. I

148. Instagram also collects and maintains are small text ?les
containing a string of numbers that are placed on a user?s computer or mobile device and that
allows Instagram to collect information about how a user uses Instagram. For example,
lnstagram uses cbokies to help users navigate between pages ef?ciently, to remember
preferences, and to ensure advertisements are relevant to a user?s interests.

149. Instagrarn also collects information on the particular devices used to access
Instagram. In particular, Instagram may record ?device identi?ers,? which includes data ?les
and other information that may identify the particular electronic device that was used to access
Instagram.

150. Instagram also collects other data associated with user content. For example,
lnstagram collects any ?hashtags? associated with user content keywords used), ?geotags?
that mark the location of a photo and which may include latitude and longitude information,
comments on photos, and other information.

151. Instagram also may communicate with the user, by email or otherwise. lnstagram

collects and maintains copies of communications between Instagram and the user.

_40_

Case Document 29-26 Filed 04/28/20 Page 55 lot 71

152. As explained herein, information stored in connection with an Instagrarn account
may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience,
an lnstagrarn user?s account activity, IP log, stored electronic communications, and other data
retained by lnstagram, can indicate who has used or controlled the Instagram account. This
?user attribution? evidence is analogous tothe search for. ?indicia of occupancy? while executing
a search warrant at a residence. For example, pro?le contact information, direct messaging lo gs,
shared photos and videos, and captions (and the data associated with the foregoing, such as geo?
location, date and time) may be evidence of who used or controlled the Instagram account at a-
relevant time. Further, Instagram account activity can show how and when the account was
accessed or used. or example, as described herein, lnstagram logs the Internet Protocol (IP)
addresses from which users access their accounts along with the time and date. By determining
the physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the account access and use relating to the crime under
investigation. Such information allows investigators to understand the geographic and
chronological context of Instagram access, use, and events relating to the crime under
investigation. Additionally, Instagram builds gee?location into some of its services. Geo- 
location allows, for example, users to ?tag? their location in posts and Instagram ?friends? to
locate each other. This geographic and timeline information may tend to either ineulpate or
exculpate the Instagram account owner. Last, Instagram account activity may provide relevant
insight into the Instagram account owner?s state of mind as it relates to the offense under

investigation. For example, information on the Instagram account may indicate the owner?s

-41-

Case Document 29-26 Filed 04/28/20 Page 56 of 71

motive and intent to commit a crime information indicating a plan to commit a crime), or
consciousness of guilt deleting account information in an effort to conceal evidence from
law enforcement).

153. Based on the information above, the computers of lnstagram are likely to contain
all the material described above with respect to the Target Instagram Accounts, including stored
electronic communications and information concerning subscribers and their use of Instagram,
such as account access information, which would include information such as the IP addresses
and devices used to access the account, as well as other account information that might be used
to identify the actual user or users of the account at particular times.

FILTER REVIEW PROCEDURES

154. Review of the items described in AttaChment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorneysclient and .
other operative privileges. The procedures include use, if necessary, of a designated ?filter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION

155. Based on the forgoing, I request that the Court issue the proposed search warrant.

156.. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not
required for the service or execution of this warrant. 

REQUEST FOR SEALING

157. I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These

documents discuss an ongoing criminal investigation, the full nature and extent of which is not

-42-

Case Document 29-26 Filed 04/28/20 Page 57 of 71

known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

 

 

PEE?iclc J. Myers
Special Agent
?Federal Bureau of Investigation

Subscribed and sworn to before me on this 22 day of September, 2018.



The Honorable Beryl A. Howell
Chief United States District Judge

-43_

Case Document 29-26 - Filed 04/28/20 Page 58 of 71

A
Property to be Searched
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses (?Target Facebook Accounts?), stored at premises owned,
maintained, controlled, or operated by Facebook, Inc. (?Faceboolc?), a company headquartered in

Menlo Park, California:

  

This warrant also applies to information associated with the Instagram accounts registered
to the following email addresses (?Target Instagram Accounts?), stored at premises owned,

maintained, controlled, or operated by Facebook:

 

Case Document 29-26 Filed 04/28/20 Page 59 of 71 

I

ATTACHMENT 

I. Information to be disclosed by acebook/Instagram

A.

To the extent that the information described in Attachment A is Within the

possession, custody, or control of the Faecbook, Inc. (hereina?lter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target'Facebook'A'ecounts listed in Attachment A:









All contact and personal identifying informatiOn, ineluding full name, user
identi?cation number, birth date, gender, contact e~rnail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

All activity logs for the account and all other documents showing the user?s posts .
and other acebook activities;

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated With those photos and videos;
All pro?le information; News Feed information; status updates; videos,
photographs, articles, and other items; Netes; Wall postings; friend lists, including 
the friends.? Facebook user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Facebook group identification numbers;
future and past event postings; rejected ?Friend? requests; comments; gifts; pokes;

tags; and information about the user?s access and use of Faeebook applications;

-2-

Case Document 29-26 Filed 04/28/20 Page All other records of communications and messages made or received by the user;
including all private messages, chat history; video calling history; and pending
?Friend? requests; I
All records relating to machine Cookies;

All ?check ins? and other location information; including records of the user?s
latitude and'longitude;

All IP logs; including all records of the'IP addresses that logged into the account;
All records of the-account?s usage of the ?Like? feature; including all Facebook

'1

posts and all non?Facebook webpages and content that the user has ?liked?;

All information about the Facebook pages that the account is or was a an? of;

All past and present lists of friends created bv the account;
All records of Facebook searches performed by the accoiint;

All information about the user?s access and use of Facebook Marketplace;

I The types of service utilized by the user;

The; length of service (including start }d_ate) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

Group identi?cation numbers; a list of users currently registered to the group; a list

of users who like the page; group or page contact information; including all contact

information for the creator and/or administrator of the group and a PDF of the

current status of the group pro?le page;
All past and. present Admins for the group;

The ?Creator? of the group;

Case 1:19-rnc-00029-CRC Document 29-26 Filed 04/28/20 Page 61 of 71 

(S)



(11)

B.

All privacy settings and other account settings, including priva?ey settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

All records pertaining to communications between Facebook and any person
regarding the user or the user?s Facebook account, including contacts with support
services and records of actions taken;

All records related to advertisements and advertising conducted through, the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and?queried.

To the extent that the information described in Attachment A . is Within the

possession, custody, or control of the Facebook, Inc. (hereinafter ?the Provider?), regardless of

whether such informationis stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

available to the Provider, the'Provider is required to disclose the following information to the .I

government for each of the Target Instagram Accounts listed in Attachment A:

a.

All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e?mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal, identifiers;

All past and current usernames associated with the account;-

All activity logs for the account and all other documents showing the user?s posts

and other Instagram activities;

Case Document 29-26 Filed 04/28/20 Page 62 of 71

d. The dates and times at which the account and pro?le were created, and the Internet
- Protocol address at the tinieof sign?up; 

c. All photos and videos-uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged-in them, including Exchangeable Image File -
data and any other metadata associated with those photos and Videos;

f. All pro?le information; News Feed . information; status updates; Videos,

I photographs, articles, and other items; Notes; friend lists, including the ?'iends? and
followers? Instagram user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Instagram group identi?cation numbers;
future and past event postings; tags; I

g. i All other records Iof comrhunications and me_sSages made or received by the user,
including all private messages, chat history, Video calling history, and. pending

?Friend? or.?follower? requests; .

h. All records relating to machine Cookies;

i. All ?check ins? and other location information, including records of the user?s
latitude and longitude; I

j. All IP 10 gs, including all records of the IP addresses that logged into the account;

k. I All records of the account?s usage of the ?follow? feature, including all Instagrarn

posts and all non?lns?tagrarn webpages and content that the user has ?liked?;
I. 'All past and present lists of friends created by the account;
7

n1. All records of Instagrarn searches performed by the account;

n. The types of service utilized by the user;

11.

Case Document 29-26 Filed 04/28/20 Page 63 of 71

The length of service (including start date) and the means and source of any

payments associated with the service (including any credit card or bank account

number);



All information regarding the particular device or devices used to login to or access
the account, including device identi?er information or cookie information,
including all information about the particular device or devices used to access the
account and the date and time of those accesses;

Group identi?cation numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator andfor administrator of the group and a PDF of the
current status of the group pro?le page;

All past and present Admins for the group;

The ?Creator? of the group; I

All privacy settings and other account settings including privacy settings for
individual Instagram posts and activities, and all records showing which Instagram
users have been blocked by the account;

All records pertaining to communications between acebook or-Instagram and any

person regarding the user or the user?s Instagrarn accOunt, including contacts with

support services and records of actions taken.

Information to be Seized by. the Government

Any and all records that relate in any way to the accounts described in Attachment A

whichconsists of evidence, ?uits, or instrumentali-ties of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

Case Document 29-26 Filed 04/28/20 Page 64 of 71

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1.512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ham-for the

period from March 1, 2016 to the present, including:

a.

All records, information, documents or tangible materials that relate in any Way to

communications regarding hacking, release cf hacked material, communications

I with persons or entities associated with WikiLealts, including but not limited to

Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to

   
 

communications or meetings introlving Jerome Corsi, Julian

Assange, Randy Credico, any
individual associatedwith the Trump Campaign, any witness in the investigation;
Communications, records, documents, and other ?les related to any expenditure,
independent eitpenditure, or disbursement for an electioneering communication;
Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals; 

All images, messages, cemmunications, calendar entries, search terms, ?address

. book?_ entries and contacts, including any and all preparatory steps taken in

furtherance of the above?listed offenses;

Case Document 29-26 Filed 04/28/20 Page 65 of 71

f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any I foreign government, foreign of?cials, foreign entities, foreign persons, or
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

I that help reveal the whereabouts of such 

j.l Credit card and Other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement; I

l. The identity of any non?US. records that help reveal the I
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering comr'nunication; and

m; The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating-
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign

principals.

Case Document 29-26 Filed 04/28/20 Page 66 of 71

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;
. o. All existing printouts from original storage which concern the categories identi?ed .
in subsection I
Review Protocols
Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney?client and other
operative privileges. When appropriate, the procedures shall include use of a designated ?filter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-26 Filed 04/28/20 Page 67 of 71

IN THE UNITED STATES DISTRICT COURT
OR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF Case: 1:18?50?0291 9
INFORMATION ASSOCIATED WITH FOUR Assigned To Howell, Beryl A.
ACCOUNTS STORED AT PREMISES Assign. Date 

 

CONTROLLED BY FACEEOOK Description: Search St Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 2705(b)

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (colleCtively herein the ?warrant? under seal, and precluding the provider from.
notifying any person of the Warrant pursuant to 18 U.S.C. ?2705(b). In regard to the non?
disclosure, the proposed Order would direct Facebook, Inc. acebook?), an electronic
communication and/or remote computing services provider headquartered in Menlo Park,-
California, not to notify any other person (except attorneys for Facebook for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
further order of the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court ?lings when appropriate,
including the Warrant. United States v. Hubbard,_650 F.2d 293, 315?16 (DC. Cir. 1980) (citing
Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, suchjedpardy creates-a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287?89 (DC. Cir. 1991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a

court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

Case Document 029-26- Filed 04/28/20 Page 68 of 71

?district court of the United States . . . that has jurisdiction over the offense being investigated.?
18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, DC. See 18 U.S.C. 3237.

.3. Further, the Court has authority to require non?disclosure of the Warrant under 18
U.S.C. 2705(b). Facebook provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The
Stored CommunicatiOns Act 18 U.S.C. 2701?2712, governs how Faceboolt may be
compelled to supply communications and other records using a subpoena, court order, or search-
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber information? using a subpoena, SectiOn 2703 allows the Government to obtain other
- ?non-content? information using a court order, and Section allows the
Government to obtain contents iof using a search Warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, When necessary,
Section 27-05(b) of the SCA enables the Government to obtain a courtgorder to preclude such .
noti?catiOn. In relevant part, Section 2705(1)) provides as follows".1

Preclusion of notice to subject of governmental access. A governmental 

entity acting under section2703 . may apply to a? court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order; The court shall enter such an order if it determines that

there IS reason to believe that noti?cation of the existence of the warrant, subpoena,
or court order will result 1n?

 

Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U. S. 
2703(b)(1)(B), but the GOvernrnent does not seek to use the proposed Order for any legal process
under that provision.

Case Document 29-26 Filed 04/28/20 Page 69 of 71

endangering the life or physical safety of an individual;
(2) ?ight from prosecution; -
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. 2705(b). he United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(1)) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705 make clear that if a courts [Sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705 the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705 the court is required to
issue the non-disclosure order.

In re AppZicatz'on for Order ofNondz?chosure Pursuant to 18 US. C. 551270565) for Grand Jury
Subpoena 41 F. supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this .motion to seal sets forth facts "showing reasonable grounds to
command Facebook not to notify any other person (except attorneys for acebooic for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year 011111111 further
order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating, among other things, -
violations of 18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C.
4 (misprision of a felony), 18 U.S.C. 371 (conSpiracy), 18 U.S.C. 951 (acting as an
unregistered foreign agent), 18 U.S.C. 1030' (unauthorized access of a protected computer);
18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to cormnit wire fraud),
and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign

contribution ban) (the ?Subject Offenses?), in connection with. efforts to compromise the networks

3

Case Document 29-26 Filed 04/28/20 Page 70 of 71

of the Democratic National Convention the Democratic Congressional Campaign
Committee and the email accounts of US. persons involved in the 2016 presidential
election, followed by the public release of stolen materials through various outlets.

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Facebook and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Faeebook for the purpose of receiving
legal advice)'l for a period of one year or until further order of the Court. Such an order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may-alert
these targets to the nature, scope, and'focus of the ongoing investigation. Disclosure of the Warrant
and related papers may also alert the targets to the scope of information known- to the FBI. Once
alerted to. this information, potential targets would be inunediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take I
steps to undermine the investigation and avoid future prosecution. I In particular, given that they.
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or digital evidence relating to their criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
. and also given that-the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court?ordered nondisclosure under Section 2705 becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

9. There is, therefore, reason to believe that noti?cation of the existence of the

Warrant will seriouslyjeopardize the investigation, including by giving the targets an opportunity

Case Document 29-26 Filed 04/28/20 Page 71 of 71

to ?ee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
2705 Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287~89.

10. Based on prior dealings with Facebook, the United States is aware that, absent a
court order under Section 2705 commanding Faceboolc not to notify anyone about a legal
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored Wire
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material-sought.

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above?captioned warrant, the application and affidavit in support thereof, and all. attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Facebook not to notify any other person of the existence or contents of the ab ove?captioned warrant
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year
or until further order Iof the Court. I

I Respectfully submitted,
ROBERT S. MUELLER, HI

. Special Gk
By 

Dated: - 5:121 . 
Kyle . reen
The Specral Counsel?s Of?ce

(202) 616?3812

Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 1 of 56
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)
)
)
)
)

INFORMATION ASSOCIATED WITH THREE
ACCOUNTS STORED AT PREMISES
CONTROLLED BY MICROSOFT

Case: 1: 18-sc-02920
Assigned To : Howell, Be /
Ass,g~. Date: 9/27/2018 ry A.
Descnpt,on: Search & S .
e1zure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the govenunent requests the search
of the following person or property located in the
Western
District of
Washington
(Mentify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (;dentify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
October 11, 2018
(not to exceed 14 days)
;/ in the daytime 6:00 a.m. to 10:00 p.m.
D at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
D for
days (not to e,ceed 30) D until, the facts justifying, the later specific date of

Date and time issued:

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge

-----·

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 2 of 56
AO 93 (Rev. I 1/13) Search and Seizure Warranl (Page 2)

Retum
Case No.:

Date aud time warrant executed:

Copy ofwanant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare nnder penalty of petjury that this inventory is correct and was returned along with the original wanant to the
designated judge.

Date:
Ei:ecuting officer's signature
-·---,.,,-- ...

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 3 of 56

ATTACHMENT A
Property to be Searched

This wanant applies to information associated with the following Microsoft accounts,
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation
("Microsoft"), a company headquartered in Redmond, Washington:

This wanant also applies to infmmation associated with the following Skype usernames
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
Corporation, an electronic communication and/or remote computing service provider with
headquarters in Redmond, Washington:

-1-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 4 of 56

ATTACHMENTB

I.

Information to be disclosed by Microsoft

To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such infmmation is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
conversation history for the account;

c.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

d.

The types of service utilized;
-2-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 5 of 56

e.

All Windows Live and OneDrive data and content;

f.

All Microsoft Developer information and content and any other information and
content relating to software development and testing;

g.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

h.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

1.

All Lyne content;

j.

All subscriber "change history" associated with the account;

k.

All search history and web history associated with the account (including Bing
history);

I.

All location and maps info1mation associated with the account;

m.

All device infonnation associated with the account, including all instrument or

'

telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
n.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for

-3-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 6 of 56

which the accounts described in Attachment A are the recovery email address,
provide all records or other information regm·ding the identification of the account,
to include full nmne, physical addrnss, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U .S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from March 1, 2016 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or connnunications regm·ding disinformation, denial, dissembling
or other obfuscation about lmowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 7 of 56

b.

All records, infonnation, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, any

individual associated with the Trump Campaign, any witness in the investigation;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

-5-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 8 of 56

J.

Credit card and other financial information, inclnding but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any 11011-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

III.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-6-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 9 of 56

\;t~: '!i'
~

tt{

IN THE UNITED STATES DISTRJCT COURT
FOR THE DISTRICT OF COLUMBIA

lL [i'c'. r~
\:J.;;.,:

,.,oS,; <,..'.:<

Stf1 2 7 2t118
Clerk, U.S. lll8trlct e, ll~~lm,p!GY

Courts for the District of Columbia

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED
AT PREMISES CONTROLLED BY
MICROSOFT CORPORATION

Case: 1:18-sc-02920
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in suppo1i thereof (collectively the "Warrant"),
and to require Microsoft Corporation ("Microsoft"), an electronic communication and/or remote
computing services provider headquartered in Redmond, Washington, not to disclose the existence
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Corui;
and

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 10 of 56

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Microsoft and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Microsoft for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.

THEHONO~t~~
CHIEF UNITED STATES DISTRICT JUDGE

2

 Case
1:19-mc-00029-CRC
AO !06 (Rev. 04/10)
Application
for a Search Warrant

Document 29-27 Filed 04/28/20 Page 11 of 56

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED AT PREMISES
CONTROLLED BY MICROSOFT

)
)
)
)
)
)

SEP 2 7 2018
Clark, U.S. District & Bankruptcy
!111wt,1 lor 11m l.ll0lrlc1 u1 Gi;:rni,\tfffi

Case: 1: 18-sc-02920
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the goverument, request a search warrant and state under
penalty of perjury that I.have reason to believe that on the following person or property (identify the person or describe the
property lo be searched and give its location):

See Attachment A
located in the

Western

District of _ _ ___,W=a,,,sh...i..
n,,_gt"o""n'-~·

, there is now concealed (identify the

person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):

~ evidence of a crime;

ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained .
.The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

r;/ Continued on the attached sheet.
0 Delayed notice of

days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:

~

~ c a n t ' s Signature

Patrick J. Myers, Special Agent, FBI- - - -

Fyle R. Free~y (ASC)

Printed name and title

Sworn to before me and signed in my presence. ·

Judge's signature

City and state: Washington, D.C.

Hon. Beryl A Howell, Chief U.S. District Judge

---

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 12 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY
MICROSOFT

SEP 2 ! 2018
Clerk, U.S. DIHtrlct & Bankruptcy
Courts for tl10 District ot Columbia

Case: 1:18-sc-02920
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH ARRANT

,v

I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for

information associated with the Microsoft email account
Accounts 1") and the Skype accounts registered to
2") and to

( "Target
("Target Account

("Target Account 3"), stored at premises owned,

maintained, controlled or operated by Microsoft Corporation ("Microsoft"), a company
headquartered in Redmond, Washington.

Upon receipt of the information described in Attachment A, government-authorized persons will
. review that information to locate the items described in Attachment B.
2.

I am a Special Agent with the Federal Bureau ofinvestigation ("FBI") assigned to

FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Specia!Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.

-1-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 13 of 56

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set fmih in this affidavit,

there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditnre ban). There also is probable
cause to search the infonnation described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION
5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l )(A). · Specifically, the Co111i is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

-2-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 14 of 56

PROBABLE CAUSE

A. Background on Relevant Individuals
i. Roger STONE
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome CORSI
7.

Jerome CORSI is a political commentator who, according to publicly available

'
information, served as the "Washington Bureau Chief for Inforwars.com." According to

publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the sunrmer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 15 of 56

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and hmm her
electability and potential presidency. We further assess Putin and the Russian
Govermnent developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian gove1mnent employed during its interference. The USIC summarized the effo1is
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence
-4-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 16 of 56

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guecifer 2.0 persona, DCLeaks.com, and WikiLealcs to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud~based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These

-5-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 17 of 56

emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

. spearphishcd over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).
C. STONE's. Public Interactions with Guccifcr 2.0 and WikiLeaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the doclL.rnents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and

-6-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 18 of 56

why he did the hack of the DNC." The article also stated: "Gliccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addrnsses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifI can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

-7-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 19 of 56

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
fmm of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday@HillatyClinton is done. #WildLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regariling an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his inte1mediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."

-8-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 20 of 56

31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta-refening back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to

[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of connnunications. I'm not implying I have any
influence with him or that I have advanced knowledge ofthe specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Cmnpaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing

-9-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 21 of 56

or scope of their subsequent disclosures. S9 I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came tme."
D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexarnine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wildleaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition,@RogerJStoneJr also exchanged direct messages with ASSANGE,

or about August 7, 2017, Chief Judge Beryl A Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
1 On

-10-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 22 of 56

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SAN GE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from 1he government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

2017, Chief Judge Howell issued a search warrant for one of STONE's

On October 17,
addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iC!oud account. Information recovered pursuant to those
search warrants indicated the following:
-11-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 23 of 56

42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafmt and DT this coming week." CORSI
appears to have forwarded the message to STONE at

who replied to

CORSI that, "May meet Manafort -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent an email to

CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read:
Assange[.J
Trump[.]
46.

emailed
should see

should find Bernie [SJ anders brother who called Bill a Rapist - turn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox

-12-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 24 of 56

will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious staiiing Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memmy bad, has stroke -neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI' s reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

On or about August 5, 2016,

STONE at

an associate ofSTONE's, emailed

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SANGE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For exainple, an associate of

-13-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 25 of 56

STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STUNE's iC!oud that appears to have been taken on August 3, 2016 and had gco-location
information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
"Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One - was hired by Rosatom in Giustra sca.'1dal. Podesta now under FBI
investigation - tied to Ukraine Yanukovyeh - Panama papers reveals Podesta hired by
S [bJerbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

-14-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 26 of 56

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
54.

On or about October 3, 2016, an associate of STONE emailed STONE at
sked: "Assange -what's he got?Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be ont in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stnffto worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." AS SAN GE also stated that
WikiLealcs would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE at

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going

-15-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 27 of 56

to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer

is a big

democrat."
58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
·Are Released.
59.

According to a publicly available news article,3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a0lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07/3 ld74714-8ce5-l le6-875e-2cl
bfe943b66- story.html
.

3

-16-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 28 of 56

63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release ofemails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
"I expect

On or about August 2, 2016, CORSI emailed STONE using
that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
68.
usin

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
-17-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 29 of 56

CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
· Podesta is complicated. Two articles in length. I can give you in raw forni the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

ith the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
71.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombm1k to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

-18-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 30 of 56

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel conununications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99 .978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New Yark City, with the money
ending up in a private bank account in the 'Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iC!oud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17, 2016, CORSI messaged STONE at his iC!oud account,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

-19-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 31 of 56

75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Keny, Ecuador and U .K. He will drop the goods on them ii
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off{.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iC!oud account,

"Congratulations, Roger. He could not have done it without you."

-20-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 32 of 56

80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Arc you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-21-

 Case Document 29-27 Filed-O4/28/20 Page 33 of 56

 

Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 34 of 56

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikiieaks

88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trnst me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrntiny ....
[L]et me address the charge· that I had advance knowledge of the timing, content and
source of the WikiLealcs disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this· report, and he subsequently did. This journalist
assured me that WikiLeaks would release this infotmation in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be c01rect. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.

-23-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 35 of 56

89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with.Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
cmmnunication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intennediary MR. STONE: That .
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In tl1at article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."

J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote

-24-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 36 of 56

back, "That was the point at which your lawyers should have told them you would asse1t your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving- why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDlCO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o Jn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94.

STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]

-25-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 37 of 56

confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillaty Clinton which are
pending publication,' ... Credico never said he ]mew or had any information as to source or
content of the material."
97.

On or about December 1, 2017, CREDlCO messaged STONE, "l don't know why

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September ofthis year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with assetiing for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts ofpe1jury[.] But I'm sme
that wasn't sworn testimony so you're probably clear[.] Council for t_l-1e committee !mows you
never had a back Channel and if you had just told the trnth wouldn't have put me in this bad spot
... you should go back ... and amend yom testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjmy if you're stupid enough to testify[.]"

4

Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 38 of 56

98.

STONE and CREDICO continued to message each other on or abont December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fnck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public repmiing, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDI CO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter,
STONE responded, "Hope u don't fuck Up my effmis to get Assange a pardon[.]" CREDICO
· messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of info1mation prove that I did not have any conversations with
Assange until September of last year."
102.

CREDICO and STONE continued to message each other, and on or about January

'
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103.

On or about April 13, 2018, news rep01is stated that CREDICO had shown

repmiers c~pies of email messages he had received from STONE in the prior few days that

-27-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 39 of 56

stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
K. The Target Accounts

5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-

threatened-dog-135911370.html
6 https ://www.motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-

 Case Document 29-27 Filed 04/28/20 Page 40 of 56

 

 Case DoCument29-27 Filed 04/28/20 Page 41"of 56

 

Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 42 of 56

BACKGROUND CONCERNING MICROSOFT

115.

In my training and experience, I have learned that Microsoft provides a variety of

online services, including electronic mail ("email") access, voice communications services such

-31-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 43 of 56

as Skype, Windows Live services, cloud storage services such as OneDrive, and software
development kit accounts, to the public. Subscribers obtain any of these types of accounts by
registering with Microsoft. During the registration process, Microsoft asks subscribers to provide
basic personal information. Therefore, the computers of Microsoft are likely to contain stored
electronic connnunications (including retrieved and unretrieved email for email subscribers and
information concerning subscribers and their use of email services, such as account access
information, email transaction information, and account application information. In my training
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
116.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying information when registering for a services account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank accou._'lt number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers inseit false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
117.

In my training and experience, email providers typically retain ce1tain transactional

information about the creation and use of each account on theit systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including

whether the account is inactive or closed), the methods used to connect to the account (such as

-32-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 44 of 56

logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with paiiicular logins
to the account. Because every device that connects to the Internet must use. an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
118.

In my training and experience, in some cases, account users will communicate

directly with a service provider about issues relating to the account, such as technical problems,
billing inquiries, or complaints from other users. Providers typically retain records about such
communications, including records of contacts between the user mid the provider's supp01i
services, as well as records of any actions taken by fue provider or user as a .result of the
communications. In my training and experience, such information may constitute evidence of the
crimes under investigation because the information can be used to identify fue account's user or
users.

119.

This application seeks a warrant to search all responsive records and information

under the control of Microsoft, a provider subject to tl1e jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or oilier infonnation pertaining to the customers or subscribers if such
communication, record, or otherinformation is within Microsoft's possession, custody, or control,
regardless of whether such communication, record, or other information is stored, held, or
maintained outside the United States. It is my understanding that Microsoft has access to email
accounts with the top level domain .au, which is associated with Australia.

-33-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 45 of 56

120.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy"'while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the IP addresses from
which users access the email account, along with the time and date of that access. By
determining the physical location associated with the logged IP addresses, investigators can
understand the chronological and geographic context of the email account access and use relating
to the crime under investigation. This geographic and timeline information may tend to either
inculpate or exculpate the account owner. Additionally, information stored at the user's account
may further indicate the geographic location of the account user at a particular time (e,g.,
location infom1ation integrated into an image or video sent via email). Last, stored electronic
data may provide relevant insight into the email account owner's state of mind as it relates to the
· offense under investigation. For example, information in the email account may indicate the
owner's motive and intent to commit a crime (e.g., communications relating to the crime), or
consciousness of guilt (e.g., deleting communications in an effort to conceal them from law
enforcement).

-34-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 46 of 56

FILTER REVIEW PROCEDURES
121.

Review of the items described in Attaclnnent A and Attaclnnent B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated ''filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
122.

Based on the forgoing, I request that the Comt issue the proposed search warrant.

123.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

REQUEST FOR SEALING
124.

I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until fmiher order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
docmnents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

~~
~y-e-rs
____________
Special Agent
Federal Bureau oflnvestigation
Subscribed and sworn to before me on this

l~y of September, 2018.

~48

The Honorable Beryl A. Howell
Chief United States District Judge
-35-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 47 of 56

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the following Microsoft accounts,
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation
("MiLausufl''), a comprury headqurutered in Redmond, Washington:

This warrant also applies to information associated with the following Skype usernrunes
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
Corporation, an electronic communication and/or remote computing service provider with
headquarters in Redmond, Washington:

-1-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 48 of 56

ATTACHMENT B
I.

Information to be disclosed by Microsoft

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such information is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date arid time at which each
email was sent, and the size and length of each email;

b.

The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
conversation history for the account;

c.

All records or other information regarding the identification of the account, to
include full name, physical address, _telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
t¥e length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

d.

The types of service utilized;
-2-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 49 of 56

which 1he accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and oilier identifiers,
records of session times and durations, the date on which the account was created,
1he length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
I

provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).
II.

Information to be Seized by the Government
Any and all records 1hat relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations ofl8 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after 1he fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unau1horized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from March 1, 2016 to the present, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons ~r entities associated with WikiLealcs, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

-4-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 50 of 56

b.

All records, information, documents or tangible materials that relate in any way to
connnnnications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, any

individual associated with the Trump Campaign, any witness in the investigation;
c.

Connnnnications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering connnunication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials; foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, connnunications, calendar entries, search terms, "address
;

book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;
f.

Connnunications, records, documents, and other files that reveal eff01ts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign govermnent, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the acconnt was accessed or used, to determine

(

the geographic and chronological context of account access, use, and events relating
to the crimes nnder investigation and to the account owner;
h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

i.

The identity of the person(s) who created or used the acconnt, including records
that help reveal the whereabouts of such person(s);

-5-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 51 of 56

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts. of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign goverurnent, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access infonnl'ltion that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

III.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with·
professional responsibility requirements concerning the maintenance of attorney-client and .other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-6-

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 52 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
THREE ACCOUNTS STORED
AT PREMISES CONTROLLED BY
MICROSOFT CORPORATION

Case: 1: 18-sc-02920
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Wanant") under seal, and precluding the provider from
notifying any person of the WaiTant pursuant to 18 U.S.C. § 2705(b). In regard t9 the nondisclosure, the proposed Order wonld direct Microsoft Corporation ("Microsoft"), an electronic
communication and/or remote computing services provider headquartered in Redmond,
Washington, not to notify any other person (except attorneys for Microsoft for the purpose of
receiving legal advice) of the existence or content of the Wanant for a period of one year or until
further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal comt filings when appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the

Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 53 of 56

2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Comt is a
"district court of the United Slates ... that - has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occuned within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b). Microsoft provides an "electronic communications service," as defined in 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Microsoft may be
compelled to supply communications and other records using a subpoena, court order, or search
wanant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain ce1tain basic

. "subscriber information" using a subpoena, Section 2703( d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search wanant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
1 Section 2705(b) contains additional requirements

for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 54 of 56

deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(h). The United States District Court for the District of Columbia has made clear
that a nondisclosnre order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d I, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Microsoft not to notify any other person (except attorneys for Microsoft for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

The Federal Bureau ofinvestigation ("FBI") is investigating violations of 18 U.S.C.

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an umegistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
3

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 55 of 56

(foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public
release of stolen materials tln·ough various outlets.
7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that Microsoft and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Microsoft for the purpose of receiving
legal advice) for a period of one year or until further order of the Court. Such an. order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant.
and related papers may also ale1t the targets to the scope of information !mown to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

4

 Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 56 of 56

9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a

compelling governmental interest in confidentiality to justify the government's sealing request.
See Robinson, 935 f.2d at 287-89.
10.

Based on prior dealings with Microsoft, the United States is aware that, absent a

court order under Section 2705(b) commanding Microsoft not to notify anyone about a legal
request, Microsoft may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
existence of the wan-ant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Microsoft not to notify any other person of the existence oi: contents of the above-captioned
warrant (except attorneys for Microsoft for the purpose of receiving legal advice) for a period of
one year or until further order of the Court.
Respectfully submitted,
ROBERT S. MUELLER, III
Special Counsel

Dated: ':) IZ?:

/ \ Y2

By:

5

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 1 of 57
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of

)

(Briefly describe the property to be searched
or identify the person by name and address)

)
)

INFORMATION ASSOCIATED WITH TWO ACCOUNTS
STORED AT PREMISES
CONTROLLED BY GOOGLE

)
)
)

Case: 1:18-sc-02921
Assigned To: Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I find that the affidavit(s), or any recorded testimony; establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
October 11, 2018
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

r;t in the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the prope1iy was taken, or leave the copy and receipt at the place where the
prope1iy was taken.
The officer executing this warrant, or an officer present during the execution of the wanant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell, Chief U.S. District ~llQilL ______ .
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the pe1:son who, or whose
property, will be searched or seized (check the appropriate box)
'
·
I
0 for _ _ days (nottoexceed30) 0 until, the facts justifying, the later specific dat'(1bf - - - ~ - - - --~-----

~-~~

Date and time issued:

Judge 's signature

City and state:

Washington, DC

Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 2 of 57
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Date and time warrant executed:

Case No.:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

-

Executing officer's signature

·--··

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 3 of 57

ATTACHMENT A
Property to be Searched

This warrant applies to info1mation associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Google, LLC ("Google"), a company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 4 of 57

ATTACHMENT B

I.

Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
infmmation to the government for each account listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses,
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

-2-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 5 of 57

e.

All records pertaining to connnunications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search history and web history associated with the account;

h.

All location and maps inf01mation associated with the account;

1.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usernames and email accounts associated with them);

J.

All Google Developers Console inf01mation associated with the account;

k.

All Minutemaid information associated with the account;

1.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All Y ouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive inf01mation associated with the account;

s.

All Google+ infmmation associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 6 of 57

Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"),

International

Mobile

Subscriber

Identifiers

("IMSI"),

or

International Mobile Equipment Identities ("IMEI")); and
u.

For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number).

II.

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from March 1, 2016 to the present, including:

-4-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 7 of 57

a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
I

or other obfuscation about knowledge of, or access to, hacked material;
b.

All records, infonnation, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, any

individual associated with the Trump Campaign, any witness in the investigation;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 8 of 57

g.

Evidence indicating how and when the account was accessed or used, to detennine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial infonnation, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

L

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access info1mation that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 9 of 57

III.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-7-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 10 of 57

lf"\'i
,,r' 'J,r r1L, rt~
\h, '""''
SEP 2 l wm

;"',\;;;l

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH TWO
ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

Clerk U.S. rnstrlct & Bankru\ltcy

r.ourt; for \lie O\stric1 oi Columbia

Case: 1:18-sc-02921
Assigned To: Howell, Beryl A
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Google, an electronic communication and/or remote computing services provider
headquartered in Mountain View, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 270S(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the

warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 11 of 57

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its
employees shall not disclose the existence or content of the Wa.1Tant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.

THE HONORABLEBRYL A. HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

Wi,r(;pr!
Date

2

 Case
1:19-mc-00029-CRC
AO 106 (Rev. 04/lO)
Application
for a Search Warrant

Document 29-28 Filed 04/28/20 Page 12 of 57

UNITED STATES DISTRICT COURT
for the

tF: J! lL r;
SEP 2 '/ 201t\

District of Columbia

Clark, U.S. District & [)ankruptcy

Cm:rt::1 J1Jr thg nil'ltfict of Cnhnn.bla

In the Matter of the Search of

)
)
)
)
)
)

(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH
TWO ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

Case: 1:18-sc-02921
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure·Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property Jo be searched and give its location):

See Attachment A
_ __-C-.-a..li...fo,,.r_..n...,ia.__ _ _ , there is now concealed (identify the

Northern
District of
located in the - - ----person or describe the property to be seized):

See Attachment B

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):

r'lf evidence of a cri1ne;
ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section
52 U.S.C. § 30121
18 U.S.C. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.
·

r./

Continued on tbe attached sheet.

0 Delayed notice of
days (give exact ending date if more than 30 days: _ _ _ _ _ ) is reqnested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Applicant's signatui·e

Reviewed by AUSA/SAUSA:
!Kyle R. Fre~ny (ASC)

I

Patrick J. Myers, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

~--------,,,~d
~
7
Judge's signature
City and state: Washingto_n_,_D_.C_.________

Hon. Beryl A Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 13 of 57

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
TWO ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

er:1:i ·,·,. ·1 UI
,n1''G

;i;_

1

C1~rk, U.S. lllotrlct & Hankruptcy
Courts tor tt10 District o1 Golumbla

Case: 1:18~sc-02921
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support of an application for a search warrant for

information associated with the Google accounts registered to

and

(the "Target Accounts 1 & 2"), stored at premises owned, maintained,
controlled or operated by Google, LLC ("Google"), a company headquartered in Mountain View,
California. As set forth below, the Target Accounts

Upon receipt of the information
described in Attachment A, government-authorized persons will review that information to locate
the items described in Attachment B.
2.

I am a Special Agent with the Federal Bureau oflnvestigation ("FBI") assigned to

FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.
3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
-1-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 14 of 57

intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C, § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 3012l(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.
JURISDICTION

5.

This Court has jurisdiction to issue the requested warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18. U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE

6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of

-2-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 15 of 57

Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7.

Jerome CORSI is a political commentator who, according to publicly available

inf01mation, served as the "Washington Bureau Chief for Inforwars.com." According to
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 16 of 57

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian govennnent employed during its interference. The USIC summarized the effmis
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Govennnent agencies, state-funded media, third-pmiy
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 17 of 57

in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Connsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-compnting service. In or aronnd late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's ovm technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a fotmer White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

-5-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 18 of 57

18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.

See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLcaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian govermuent actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility fol' the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The atiicle also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

-6-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 19 of 57

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do'/" STU NE responded: ''Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will

-7-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 20 of 57

soon the [sic] Podesta's time in the ba1Tel. #CrookcdHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGEJ, the public [could] expect to see much more from the exiled whistle blower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday @HillaryClinton is done. #WildLeaks."
30.

On Sunday, October 2, 2016, MSNBC _Moming Joe producer Jesse Rodriquez

tweeted regarding an announcement AS SAN GE had scheduled foi" the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE am1ouncement -which was
part of WikiLeaks' 10-yeaT anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE nsed@RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeal(s sent a Tweet reading

-8-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 21 of 57

"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLealcs continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- refeITing back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this infonnation on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying l have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative of WikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLealcs was in the midst of releasing the hacked

-9-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 22 of 57

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikilcaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operationleaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SAN GE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get infonnation only that it is
accurate and authentic. The New Y orlc Times printed the Pentagon Papers which were

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
1

-10-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 23 of 57

indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restrnining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to

@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."

E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address

On October 17,

2017, Chief Judge Howell issued a search warrant for one ofSTONE's

addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant for

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI

-11-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 24 of 57

appears to have forwarded the message to STONE at

who replied to

CORSI that, "May meet Manafo1t -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recogpized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

On July 25, 2016, STONE, using

sent arr email to

CORSI with the subject line, "Get to Assarrge." The body of the message read: "Get to Assarrge
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
45.

On or about July 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read: "
Assarrge[.]
Trmnp[.]
46.

emailed
should see

should find Bernie [S]arrders brother who called Bill a Rapist-tmn him for
should find

or more proof of Bill getting kicked out."

On or about August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is frie11.d in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC arr artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to

-12-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 25 of 57

be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

an associate of STONE's, emailed

On or about August 5, 2016,

STONE at

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet AS SANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting ASSANGE. STONE told

he was joking and

had not actually met ASSANGE. 2
48.

Through a search of STONE's iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to

to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will

-13-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 26 of 57

call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
"Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to

invest in Uranium One -was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back chaunel highly sensitive stuff." CORSI responded, "We have
secure back chaunel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive... Hope you are well.

Can't wait for the debate. Chauneling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators,

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 27 of 57

54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows whatAssange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
57.

That same day, BANNON emailed STONE a

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer
democrat."

is a big

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 28 of 57

58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018; he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON aclmowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
59.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone records

at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.
62.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2:18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /3 ld74 714-8ce5-11e6-875e-2c 1bfe943b66_ story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 29 of 57

64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE using

"I expect

that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

an author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded

message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacldng bad job
numbers."
68.
using

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on

-17-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 30 of 57

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both

with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the
71.

Account, "Got them and used them."

On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via

-18-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 31 of 57

Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email at

with the subject, "ROGER STONE article

KUSS1AN MAJ:ilA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOrIN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99 .978 percent by

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now- before 2prn[.]" STONE responded, "Missed u-just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."

-19-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 32 of 57

75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

AS SAN GE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19; 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."

-20-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 33 of 57

80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-21-

 Case Document 29-28 Filed 04/28/20 Page 34 of 57

 

Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 35 of 57

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikilcaks
88.

On September 26, 2017, STONE testified before the House Pennanent Select

Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In. them, STONE stated:
Members of this Committee have made three basic asse1tions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman Jolm Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillm-y Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be exan1ined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regm·ding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] armounced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.

-23-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 36 of 57

89.

In a document dated March 26, 2018 titled "Minority Views," Democratic

members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only refe1Ting to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is con-ect, even though it was repeated to me on numerous separate
occasions.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta' s
Time in the B=el Yet?" In that ariicle, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the ban-el' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet refe1Ted to Podesta's business dealings with Russia, and the
expectation that it would become a news story."

J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
91.

On or about November 19,.2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........Richard Nixon[.]" CREDICO responded, "Ha ha."
92.

On or about November 21, 2017, CREDICO messaged STONE, "I was told that

the house connnittee lawyer told my lawyer that I will be getting a subpoena[.]'' STONE wrote

-24-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 37 of 57

back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, 'To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuffI.J I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my :first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjmy[.]"
94.

STONE and CREDI CO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]

-25-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 38 of 57

confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any infmmation as to source or
content of the material."
97.

On or about December 1, 2017, CREDICO messaged STONE, "I don't lmowwhy

you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now lmowthat I was not in London tmtil September of this year[.] You had
no back-chatmel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asse1iing for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO resp~nded, "You open yourself up to six counts ofpe1jury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the connnittee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and am.end your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
· you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"

4

Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 39 of 57

98.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
I 00.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a rep01ter.
STONE responded, "Hope u don't fuck Up my effo1ts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September oflast yeai."
102.

CREDICO and STONE continued to message each other, and on or about Januaty

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Tnunp so don't worr):'. I have all the forensic evidence[.] I was
not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103.

On or about April 13, 2018, news rep01ts stated that CREDICO had shown

repo1ters copies of email messages he had received from STONE in the prior few days that

-27-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 40 of 57

stated, "You arc a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO slated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The aiticle noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
K. The Target Accounts

5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviscr-roger-stone-

threatened-dog-135911370.html
6 https ://www.mothcrj ones.com/politics/2018/05/ro gcr-stone-to-associate-prcpare-to-die/
-28-

 Case Document 29-28 Filed 04/28/20 Page 41 of 57'

 

Case Document 29-28 Filed 04/28/20 Page 42 of 57

 

Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 43 of 57

BACKGROUND CONCERNING GOOGLE

115.

In my training and experience, I have learned that Google provides a variety of on-

line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (inclnding retrieved and umetrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account

-31-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 44 of 57

application inforn1ation. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account's
user or users.
116.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying inforn1ation when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false infonnation to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
117.

In my training and experience, email providers typically retain certain transactional

info1mation about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including

whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the IP address used to register the
account an.d the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.

-32-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 45 of 57

118.

In my training and cxpenence, m some cases, email account users will

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
119.

This application seeks a wanant to search all responsive records and information

under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested wanant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google's possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.
120.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search wanant at a residence. For example, email communications, contacts

-33-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 46 of 57

lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt

(e.g., deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES
121.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner c~nsistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
122.

Based on.the forgoing, I request that the Court issue the proposed search wanant.

-34-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 47 of 57

123.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.
REQUEST FOR SEALING
124.

I further request that the Court order that all papers in supp01i of this application,

including the affidavit and search warrant, be sealed until frniher order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

Special Agent
Federal Bureau oflnvestigation
Subscribed and sworn to before me on this ~ a y of September, 2018.

The Honorable Beryl A. Howell
Chief United States District Judge

-35-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 48 of 57

ATTACHMENT A
Property to be Searched

This warrant applies to information associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Google, LLC ("Google"), a company headquartered in Mountain View, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 49 of 57

e.

All records pe1taining to communications between the Provider and any person
regarding the account, including contacts with suppmt services and records of
actions taken;

f.

All subscriber "change history" associated with the account;

g.

All search hislory aml web hislory associated with the account;

h.

All location and maps information associated with the account;

1.

All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemarnes and email accounts associated with them);

j.

All Google Developers Console information associated with the account;

k.

All Minutemaid information associated with the account;

I.

All Android information associated with the account;

m.

All Google Docs associated with the account;

n.

All YouTube information associated with the account;

o.

All Google Hangouts information associated with the account;

p.

All Google Voice information associated with the account;

q.

All Web & App Activity associated with the account;

r.

All Google Drive information associated with the account;

s.

All Google+ information associated with the account;

t.

All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity

-3-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 50 of 57

a.

All records, infoimation, documents or tangible materials that relate in any way to
commnnications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material; '

b.

All records, infmmation, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico, any

individual associated with the Trump Campaign, any witness in the investigation;
c.

Commnnications, records, documents, and other files related· to any expenditure,
independent expenditure, or disbursement for an electioneering commnnication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
govermnent, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, commnnications, calendar entries, seaTch terms, "address
book" entries and contacts, including any and all preparatory steps talcen in
furtherance of the above-listed offenses;

f.

Commnnications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign govermnent, foreign officials, foreign entities, foreign persons, or
foreign principals;

-5-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 51 of 57

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;

1.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

1.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)-including records that help reveal the whereabouts
of the person(s}--who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
· principals.

n.

. Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

-6-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 52 of 57

III.

Review Protocols
Review of the items described in Attaclnnent A and Attaclnnent B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-7-

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 53 of 57

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH TWO
ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

Case: 1:18-sc-02921
Assigned To: Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof(collectively herein the "Wan-ant") under seal, and precluding the provider from
notifying any person of the Wan-ant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California, not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until fiuther order of the Comt.
WRISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when appropriate,

including the Wan-ant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Wmrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Comt has jurisdiction.to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
"district court of the United States ... that - has jurisdiction over the offense being investigated."

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 54 of 57

18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occmred within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the Warrant under 18

U.S.C. § 2705(b).

Google provides an "electronic communications service," as defined in 18

U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, comt order, or search
warrant.

Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" infmmation using a comt order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4.

The SCA does not set forth any obligation for providers to notify subscribers about

subpoenas, court orders, or search wanants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
1 Section 2705(b)

contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 55 of 57

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b ). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under§ 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

The Federal Bureau oflnvestigation ("FBI") is investigating violations ofl 8 U.S.C.

§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject Offenses"), in
connection with efforts to compromise the networks of the Democratic National Convention
("DNC"}, the Democratic Congressional Campaign Committee ("DCCC"), and the email accounts
of U.S. persons, followed by the public release of stolen materials through various outlets.
3

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 56 of 57

7.

In this matter, the government requests that the Warrant be sealed until further order

of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Wmrnnt (except attorneys for Google for the purpose ofreceiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Wanant relates to an ongoing criminal investigation, the scope and nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal.
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are !mown to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8.

Given the complex and sensitive nature of the criminal activity under investigation,

and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
9.

There is, therefore, reason to believe that notification of the existence of the

WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.

§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a

4

 Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 57 of 57

compelling govermnental interest in confidentiality to justify the govermnent's sealing request.
See Robinson, 935 F.2d at 287-89.

10.

Based on prior dealings with Google, the United States is aware that, absent a court

order under Section 2705(b) commanding Google not to notify anyone about a legal request,
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or
electronic communications for a certain account, notify the subscriber or customer of the existence
of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period ofone year or
until further order of the Court.
Respectfully submitted,
ROBERT S. MUELLER, III
Special Counsel

By:

/
Kyle . eeny
The Special Counsel '.s Office
(202) 616-3812

5

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 1 of 57
..1

and Seizure Warrant

.I

UNITED STATES DISTRICT COURT
for the
District of Columbia

In the Matter of the Search of

Case: 1: 18-sc-02922
Assigned To: Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

(Briefly describe the property to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES
CONTROLLED BY APPLE

/

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the govermnent requests the search
of the following person or property located in the
Northern
District of
California
(identify the person or describe the property to be searched and give its location):

See Attachment A

I fmd that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the pe1wn or describe the property to be seized):
See Attachment B

YOU ARE COMMANDED to execute this warrant on or before
October 11, 2018
(not to exceed 14 days)
,;{ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
prope,ty was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to -··
Hon. Beryl A. Howell, Chief U.S. District Judge ___
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), Ifind that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and autl1orize the officer executing this warrant to delay notice to the person who, or whose
propetty, will be searched or seized (check the appropriate box)
0 for
days (not to exceed 30) 0 until, the facts justifying, the later specific date of
'

Date and time issued:

__ 1/J--r/7p17 c/' f'ld/A ~ , , / . ~
, ·

City and state:

Washington, DC

Judge's signature

Hon. Beryl A. Howell, Chief U.S. District Judge
.___
Printed name and title

j
II

Ii
I
11

I!

I
,I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 2 of 57
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of pe1jury that this inventmy is correct and was returned along with the original warrant to the
designated judge.

Date: -

Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 3 of 57

ATTACHMENT A
Property to be Searched

This warrant applies to info1mation associated with the following accounts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company
headquartered in Cupertino, California:

-1-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 4 of 57

ATTACHMENT B

I.

Information to be disclosed by Apple

To the extent that the infonnation described in Attaclnnent A is within the possession,
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(:1:), the
Provider is required to disclose the following information to the govennnent for each account or
identifier listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;
-2-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 5 of 57

II.

f.

All search histo1y or web history;

g.

All records indicating the services available to subscribers of the accounts;

h.

All usernames associated with or sharing a login IP address or browser cookie with
the accounts;

i.

All cookies, including third-party cooldes, associated with the user;

J.

All records that are associated with the machine cookies associated with the user;
and

k.

All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic · Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMSI"), or International Mobile Equipment Identities
("IMEI").

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2016, to December 31, 2017, including:
a.

All records, infmmation, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to

-3-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 6 of 57

Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;
b.

All records, inf01mation, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi
Assang

, Julian
, Randy Creclico, Charles

Orte!, or any individual associated with the Tmmp Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expencliture, or disbursement for an electioneering communication;

d.

Records of any furids or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and aH preparatory steps taken in
furtherance of the above-listed offenses;

f.

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence inclicating the account user's state of mind as it relates to the crimes under
investigation;

-4-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 7 of 57

i.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

Th~ identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

III.

Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted

pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other

-5-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 8 of 57

operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apaii from the investigative team, in order to address potential privileges.

-6-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 9 of 57

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY APPLE, INC.

SEP 2 7 2018
Clerk, U.S. District & Bankruptcy
Courts for the District of Col~mbla

Case: 1:18-sc-02922
Assigned To : Howell, Beryl A.
Assign. Date : 9/27/2018
Description: Search & Seizure Warrant

ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Apple, Inc., an electronic conununication and/or remote computing services
provider headquartered in Cupertino, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. § 2705(b).
The Cowt finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 10 of 57

IT IS .FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
futther order of the Court.

THE HONORAJ3LEOR

LA. HOWELL

CHIEF UNITED STATES DISTRICT JUDGE

2

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 11 of 57
AO 106 (Rev, 04/ IO) Application for a Search Warrant

UNITED STATES DISTRICT COURT

SEP 27 2018

for the
District of Columbia
In the Malter of the Search of
(Briefly describe the property to he searched
or idenlijy the person by name and address)

INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
BY APPLE

)
)
)
)
)
)

FILED
Clark, U.S. District & Bankruptcy
Courts for the District of Columbia.

Case: 1:18-sc-02922
Assigned To : Howell, Beryl A.
Assign. Date : 9/27/2018
Description: Search & Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or prope1ty (identify the person or describe the
property to be searched and give its location):

See Attachment A
Northern
District of
---

located in the

California

·--~===----

, there is now concealed (identify the

person or describe the property to be setzed):

See Attachment B

The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or mo,e):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;

d

property designed for use, intended for use, or used in committing a crime;

0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section
52 u.s.c. § 30121
18 u.s.c. §§ 1001, 1030, 371
See Affidavit for add'I

Offense Description
Foreign Contribution Ban
False Statements, Unauthorized Access of Protected Computer, Conspiracy

The application is based on these facts:
See attached Affidavit.

r;( Continued on the attached sheet.
0

Delayed notice of
days (give exact ending date if more than 30 days: _ _ _ _ ) is requested
under I 8 U.S.C. § 3 I 03a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC)

Applicanr 's signawre

Patrick J. Myers, S_pecial Agent, FBI
Printed name and Jitle

Sworn to before me and signed in my presence.
Date:

_

t/;, ?j}!/1

City and state: Washington, _D_.c_._ _ _ _ __

~.
f(~~
Judge's signature
--~H~on. Beryl A Howell, Chief U.S. District Judge
Printed name and tille

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 12 of 57

FILED
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY APPLE

SEP 2 7 2018
Clerk, U.S. District & Bankruptcy
Courts tor th& Dlstrlct o1 Golumbl,

Case: 1:18-sc-02922
Assigned To: Howell, Beryl A.
Assign. Date : 9/27/2018
Description: Search & Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

I make this affidavit in support. of an application for a search warrant for

information associated with the Apple account

"Target Account"), stored at

premises owned, maintained, controlled or operated by Apple, Inc. ("Apple"), a company
headquartered in Cupertino, California. As set forth below, the Target Account is believed to be
used by an associate of STONE who was in communication with STONE on the day that
WikiLeaks first released emails stolen from Clinton Campaign chair John Podesta and who appears
to have met with STONE in October 2016 on the same day that STONE publicly claimed to have
had dinner with his back-channel to WikiLeaks founder Julian Assange. Upon receipt of the
information described in Attachment A, government-authorized persons will review that
info1mation to locate the items described in Attachment B.
2.

I am a Special Agent with the Federal Bureau of Investigation ("FBI") assigned to

FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.

-1-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 13 of 57

3.

The facts in this affidavit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
4.

Based on my training and experience and the facts as set forth in this affidavit,

there is probable cause to believe that the Target Account contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § I 001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.

,JURISDICTION
5.

This Court has jurisdiction to issue the requesteq warrant because it is "a court of

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)( 1)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.

-2-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 14 of 57

II

i!

!
PROBABLE CAUSE
A. Background on Relevant Individuals

I

!
.1

i. Roger STONE

I
6.

Roger STONE is a self-employed political strategist/consultant and has been

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including thencampaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI

7.

Jerome CORSI is a political commentator who, according to publicly available

information, served as the "Washington Bureau Chief for lnforwars.com." According to
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.

-3-

I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 15 of 57

B.

Russian Government-Backed Hacking Activity During the 2016 Presidential
Election
9.

On January 6, 2017, the USIC released a declassified version of an intelligence

assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
assessed the following:
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Govermnent developed a clear preference for President-elect Trump.
10.

In its assessment, the USIC also described, at a high level, some of the techniques

that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
11.

With respect to "cyber activity," the USIC assessed that "Russia's intelligence
-4-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 16 of 57

I

I

I

I'
,,

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Fmiher, "[i]n July

I
I
I
:1

2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
I 2.

With respect to the release of stolen materials, the USIC assessed "with high

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13.

Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple

contradictory statements and false claims about his identity throughout the election.
14.

The Special Counsel's Office has determined that individuals associated with the

GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
15.

For example, in or around September 2016, these individuals successfully gained

access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16.

On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These

-5-

I

I
r
'

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 17 of 57

emails were later post on DCLeaks.
17.

On or about November 1, 2016, individuals associated with the GRU

spearphished over I 00 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
18.

On July 13, 2018, a grand jury in the District of Columbia returned an indictment

against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks

19.

On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an

unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20.

On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from

theDNC.
21.

On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear

Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and

-6-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 18 of 57

why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
22.

On August 8, 2016, STONE addressed the Southwest Broward Republican

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assangc
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary.
23.

On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoncJr thanks that

u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the DCCC.
24.

On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling

Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
25.

On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you

back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26.

On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,

-7-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 19 of 57

I

I
I,
,1

i~

I!
,,

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
27.

On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will

soon the [sic] Podesta's time in the batTel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
[ASSANGE], the public (could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... [ think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abcdin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28.

On September 16, 2016, STONE said in a radio interview with Boston Herald

Radio that he expected WikiLcaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
29.

On Saturday, October!, 2016, using@RogerJStoneJr, STONE tweeted,

"Wednesday@ HillaryClinton is done. #WikiLeaks."
30.

On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez

tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told lnfowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."

-8-

I

Ii

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 20 of 57

31.

On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post

published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.
32.

Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33.

WikiLeaks continued to release John Podesta's hacked emails through Election

Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that 1-Juma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
34.

On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing

from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing

-9-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 21 of 57

I

I
Ji

1:

i/

t

or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."

D. STONE's Private Twitter Direct Messages with.WikiLeaks and ASSANGE
35.

On October 13, 2016, while WikiLcaks was in the midst of releasing the hacked

Podesta emails, the Twitter account @RogerJStoncJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
36.

Less than an hour later, @wikileaks responded by direct message: "We appreciate

that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
37.

On or about October 15, 2016, @RogerJStoneJr sent a direct message to

@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38.

On or about November 9, 2016, one day after the presidential election,

@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
39.

In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

1

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 22 of 57

the founder of WikiLcaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards .. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
40.

On Saturday, June 10, 2017, @RogcrJStoneJr sent a direct message to

@J ulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."
E. CORSl's Communications with STONE,
Forthcoming Leaks
41.

and Others Regarding

On September 11, 2017, ChiefJudge Beryl A. Howell of the District of Columbia

issued a search warrant for STONE's

address,

. 2017, Chief Judge Howell issued a search warrant for one ofSTONE'

On October 17,
addresses,

On or about December 19, 2017, Chief Judge Howell issued a search
warrant fo

email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
.search warrants indicated the following:

-11-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 23 of 57

42.

On or about May 15, 2016,

emailed CORSI: "Here is my flight

schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your ayailability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at

ho replied to

CORSI that, "May meet Manafort -guarantee nothing."
43.

On or about May 18, 2016, CORSI emailed STONE at

with the title, "Roger -- why don't you look this over before I send it to

I believe that
CORSI wrote,

and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
44.

ent an email to

On July 25, 2016, STONE, using

CORSI with the subject line, "Get to Assange." The body of the message read: "Get.to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly." The text of this email from STONE to CORSI substantially mirrored the
text of ah email that STONE received from

~a freelance blogger who had been

conducting research into the Clintons during presidential campaign---on or about the same day.
45.

On or aboutJuly 31, 2016, STONE, using

CORSI with the subject line, "Call me MON." The body of the email read: "
Assangc[.J
Trump[.]
46.

emailed
should see

should find Bernie [S]anders brother who called Bill a Rapist - tum him for
should find

or more proof of Bill getting kicked out."

On or ahout August 2, 2016 (approximately 19 days before STONE publicly

tweeted about "Podesta's time in the banel"), CORSI emailed STONE at

-12-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 24 of 57

11

)
i

"Word is friend in embassy plans 2 more dumps. One shortly after I'm

j

l

I

back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox

I
,,

will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential

I
I•

I
i

campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -neither he nor she well. I expect that much of next dump focus, setting stage for Foundation .
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47.

an associate of STONE's, emailed

On or about August 5, 2016,

STONE at

The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night."

subsequently stated to investigators that, around the

same time, STONE told him he had gone to London to meet ASSANGE.
that in 2018,

also stated

told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting ASSANGE. STONE told

he was joking and

had not actually met AS SAN GE. 2
48.

Tlu·ough a search of STONE's iCloud account, the FBI has uncovered evidence

-13-

~

i

I
Ii

I
I
I
r

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 25 of 57

j
ll.

I
[

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email t

, to have "dined" with ASSANGE. For example, an associate of

STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.
49.

On or about August 15, 2016, CORSI emailed STONE at
: "Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
50.

On or about August 31, 2016, CORSI emailed STONE at
Did you get the PODESTA writeup." STONE replied "[y]es."

51.

On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $ l 80k to

invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Y anukovych - Panama papers reveals Podesta hired by
S[b ]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
52.

On or about September 6, 2016, CORSI emailed STONE at
Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"

53.

On or about September 24, 2016,

emailed CORSI, "I will have much

more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have

-14-

i

II
I'

!

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 26 of 57

secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today."

wrote back, "Awaiting secret file. Explosive ... Hope you are well.

Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators

indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.
54.

On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange - what's he got? Hope it's good." STONE wrote

back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. Yon didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
55.

On or about October 4, 2016, ASSANGE gave a press conference at the

Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release infonnation damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including

information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56.

On or about October 4, 2016, CORSI messaged STONE at his iCloud account:

"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."

-15-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 27 of 57

57.

That same day, BANNON emailed STONE

"What was

that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer

is a big

democrat."

58.

When BANNON spoke with investigators during a voluntary interview on

February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
59.

According to a publicly available news article, 3 at approximately 11AM on

Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
60.

According to phone record

, at approximately

11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61.

At approximately 11 :53AM, STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.

3

https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /3 l d7 4 7 l 4-8ce5- l l e6-875e-2cl bfe943 b66_story.html
-16-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 28 of 57

62.

At approximately 1:42PM, STONE called CORSI and the two spoke for

approximately seventeen minutes.
63.

At approximately 2: 18PM, CORSI called STONE and the two spoke for

approximately twenty minutes.
64.

At approximately 4:00PM, the Washington Post published a story regarding the

Access Hollywood tape.
65.

At approximately 4:30PM, WikiLeaks tweeted out its first release of emails

hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE using

"I expect

that much of next dump focus, setting stage for Foundation debacle."
66.

At approximately 6:27PM,

-the person who originally suggested

"get[ting] to Assange," and who, according to emails and phone records, regularly
communicated with STONE-sent STONE an email titled, "WikiLeaks - The Podesta Emails,"
with a link to the newly-released Podesta emails. Approximately ten minutes later, STONE,
using

forwarded

message to CORSI without comment.

STONE does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE ls
Accused of Advance Knowledge of the Leak

67.

On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-

have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."

-17-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 29 of 57

68.

On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,

usin

m, emailed Corsi asking him to "send me your best podesta links."

STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69.

On or about that same day, October 12, 2016, Podesta accused STONE of having

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at bot

, with the subject

line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation."
70.

CORSI followed up several minutes later with another email titled, "Podesta

talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
71.

On or about Thursday, October 13, 2016, CORSI emailed STONE at
: "PO DEST A -- Joule & ties to RUSSIA MONEY LAUNDERING to

CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more- NOBODY YET HAS THIS[:] It looks to me
like

skimmed maybe billions off Skolkovo -

Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] (web link] Once

-18-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 30 of 57

had the channel open from Metcombank to Deutsche Bank America to Ban[k) of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72.

On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI

sent STONE an email a

with the subject, "ROGER STONE article

RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did

, a controversial Russian billionaire

investor with ties to the Vladimir Putin and the Russian goverrnnent, launder through
Metcombank, a Russian regional bank owned 99.978 percent b

with the money

transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73.

On or about October 14, 2016, CORSI sent a message to STONE at his iCloud

account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."

-19-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 31 of 57

74.

On or about October 17, 2016, CORSI messaged STONE at his iCloud account,

"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
75.

On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:

ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand offl.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat

rooms.
76.

On or about October 18, 2016, CORSI messaged STONE at his iCloud account,

"Pis call. Important."
77.

On or about October 19, 2016, STONE published an article on Breitbart.com in

which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on

-20-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 32 of 57

my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
78.

On or about November 8, 2016, the United States presidential election took place.

79.

On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

"Congratulations, Roger. He could not have done it without you."
80.

On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."

-21-

 Case Document 29-29 Filed 04/28/20 Page 33 of 57

 

Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 34 of 57

!
I
I

[

I

i

II
I!

I

I
I

I

I. STONE's Congressional Testimony and Public Statements About His Relationship
with Wikileaks

88.

On September 26, 2017, STONE testified before the House Permanent Select

Committee on Intelligence (HPSCJ). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that oµr intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's

time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranitun deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
-23-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 35 of 57

Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
89.

In a document dated March 26, 2018 titled "MinorityViews," Democratic

members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary MR. STONE: That Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90.

In the month that followed his testimony before HPSCI, on or about October 24,

2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
J, STONE's Messaging to Randy CREDICO about STONE's "Back channel"
91.

On or about November 19, 2017, Randy CREDICO (who, as described further

below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My

-24-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 36 of 57

II

!

lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
92.

On or about November 21, 2017, CREDI CO messaged STONE, "I was told that

the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, 'That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
93.

On or about November 24, 2017, STONE, texted CREDICO, "Assange is a

journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDI CO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94.

STONE and CREDI CO continued to exchange messages and on November 24,

2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
95.

On or about November 28, 2017, CREDI CO tweeted a copy of a subpoena he

received from HPSCI that was dated November 27, 2017. Toll records show that on November

-25-

t
'

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 37 of 57

27 and 28, 2017, CREDI CO and STONE communicated via text message more than a dozen
times.
96.

On November 29, 2017, STONE publicly stated that CREDICO was his

"intermediary." In a public Facebook post, STONE further stated that "Credico merely[)
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
97.

On or about December I, 2017, CREDICO messaged STONE, "I don't know why

you had to lie and say you had a back Channel now I had to give all ofmy forensic evidence to
the FBI today what a headache[.]' You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you tumed over anything to the FBI you're
a

fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure

that wasn't swom testimony so you 're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If

4

Contrary to his statement, CREDI CO had not at the time provided any forensic evidence to the
FBI.
-26-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 38 of 57

!
l•I

you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my

I

Fifth Amendment rights but you can. I guarantee you you [sicJ are the one who gets indicted for
fl

'

perjury if you're stupid enough to testify[.]"
98.

STONE and CREDICO continued to message each other on or about December 1,

2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
99.

On or about December 13, 2017, according to public reporting, CREDICO

indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100.

STONE and CREDICO continued to exchange text messages, and on or about

January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."

101.

On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy

logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September oflast year."
102.

CREDI CO and STONE continued to message each other, and on or about January

25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get

-27-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 39 of 57

I

I

l
f:

II

off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was

'~
I

!I

not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103.

On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends -

run your mouth my

lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
104.

On or about May 25, 2018, CREDICO provided additional messages he stated

were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.

K. STONE's Communications with
105.

As noted above, in late July 2016

emailed STONE to "get to Assange,"

which appears to have precipitated STONE's email to CORSI with the same instruction.
106.

On or about August 17, 2016

sent an email to STONE's Gmail account

with the subject line, "Introduction." The email was also sent to the work account o

5

https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stonethreatened-dog-1359113 70.htrnl
6
https: //www. motherj ones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-

I
11
11

I

I
Ii,1

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 40 of 57

listed both STONE'

telephone numbers, and he advised them, "You should find

time to chat."
107.

Toll records for STONE's cellphone show that between August 18, 2016 and

November 3, 2016

was in contact with STONE approximately 60 times. This

included several calls on October 7, 2016, the day that WikiLeaks began releasing Podesta's
called STONE at approximately 12:33PM, within an hour of

emails. On that day

STONE's call with the Washington Post, which was about to publish information about the
"Access Hollywood" tape. The call lasted approximately seven minutes.

appears to

be the first person, other than journalists, to talk to STONE after STONE's call with the
Washington Pos

called STONE a second time at approximately 2:38PM on the same

day. That call lasted approximately one minute. STONE also had a missed FaccTime call from
at approximately 3:32PM the same day. WikiLeaks released the first tranche of stolen
Podesta emails approximately one hour later.
108.

As noted above

told investigators that in January 2017, CORSI told

him that he (CORSI) and STONE were involved in and were aware of the timing and content of
the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta,
and CORSI implied, in sum and substance, that STONE was involved in the release of the
Podesta emails by WikiLeaks.
109.

According to open source information, on or about October 12, 2016, five days

after the first release of stolen Podesta emails, STONE told a local news outlet in Florida, "I do
have a back-channel communication with Assange, because we have a good mutual friend. That

-29-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 41 of 57

i

!

I!
friend travels back and forth from the United States to London and we talk. I had dinner with

II

him last Monday." 7 "Ibe Monday prior to the date ofSTONE's statement was October 10, 2016.

!

ri
!I

110.

!,

In the early hours of October 10, 2016, at approximately 3:26AM EDT

texted STONE: "H

. If you are still in NY we MUST meet tomorrow. Major major

stuff." At approximately 8:26AM the same day (but, effectively, the next morning, given the
hour o

R's text), STONE replied, "Ok- can we meet UES?" UES appears to be a

reference to the Upper East Side of New York City, where STONE maintained a residence.
texted STONE at approximately 9:02AM, "Sure. Lunch? Coffee? Time?" and again at
10:55AM, "What time works." Investigators have not located a response from STONE, although
called STONE at approximately 4:45PM°'with a call duration of approximately 4
seconds.
111.

Cell-site location data for STONE shows that he was in the Upper East Side on

the evening of October 10, 2016, when he claimed to have met with his contact to Assange,
Financial records for STONE

show a

transaction on October 10, 2016, at a pizza parlor located in the Upper East Side, in the amount
of approximately $20.
112.

Search warrant returns show that after WikiLeaks began to release Podesta's

emails in October 2016,

emailed STONE several times from the account

("Target Account") with links to WikiLeaks' website and discussion about the

us Podesta emails that WikiLeaks had released. For example, on or about
October 25, 2016,

sent an email from the Target Acconnt to STONE'

7

account

https ://miami .cbslocal.com/2016/1 0/12/trump-all y-roger-stone-admits-back-channel-tie-towikileaks/
-30-

I

I
I

iI

I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 42 of 57
I
i
j

[

with a link to the portion ofWikiLeaks' website containing Podesta emails, with the comment,

I

"Cheryl Mills & John Podesta panic to cover Obama's lies on Hillary emails."

!

I

I'

113.

Search warrant returns for CORSI

k account show th

was in

communication with CORSI at least in 2017. During an email exchange in June 2017 that
appears to relate to financial policy-makers, CORSI tol

that he was "concerned about

Mueller," following up shortly thereafter to clarify that had "meant Mnuchen," the Secretary of
Treasury. CORSI added, "Guess I have Special Counsel on mind these days."
114.

For the foregoing reasons, there is probable cause to believe that the Target

Account contains evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses.
BACKGROUND CONCERNING APPLE

115.

In my training and experience, I have learned that Apple provides a variety of on-

line services, including electronic mail ("email") access, to the public. Apple allows subscribers
to obtain email accounts at the domain name me.com, like the Target Account. Subscribers obtain
an account by registering with Apple. During the registration process, Apple asks subscribers to
provide basic personal information. Therefore, the computers of Apple are likely to contain stored
electronic communications (including retrieved and unretrieved email for Apple subscribers and
information concerning subscribers and their use of Apple services, such as account access

information, email transaction information, and account application information. In my training
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
116.

In my training and experience, email providers generally ask their subscribers to

provide certain personal identifying· information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other

-31-

j

I

I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 43 of 57

identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
117.

In my training and experience, email providers typically retain certain transactional

information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were.used to access
the email account.

118.

In my training and experience, in some cases, email account users will

.

communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute

-32-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 44 of 57

evidence of the crimes under investigation because the information can be used to identify the
account's user or users.

119.

This application seeks a wanant to search all responsive records and information

under the control of Apple, a provider subject to the jurisdiction of this court, regardless of where
Apple has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Apple's possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.
120.

As explained herein, information stored in connection with an email account may

provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts

lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the

-33-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 45 of 57

I

I

f

I

chronological and geographic context of the email account access and use relating to the crime

I
r1

I•
11

under investigation. This geographic and timeline information may tend to either inculpate or

I
I·,I

ii

exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.

II

I
I

II

For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt

(e.g., deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES
121.

Review of the items described in Attachment A and Attachment B will be

conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
122.

Based on the forgoing, I request that the Court issue the proposed search warrant.

123.

Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-34-

I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 46 of 57

I

I
Ii"
II
I
~

REQUEST FOR SEALING

124.

I further request that the Court order that all papers in supp01t of this application,

including the affidavit and search warrant, be scaled until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,

atrickJ.Myers
~
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this

.,,2}_~ of September, 2018.

hf/~

The Honorable Beryl A. Howell
Chief United States District Judge

-35-

I

I

i

1
I

i

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 47 of 57

II

!
i

ATTACHMENT A
Property to be Searched

II

I

1

!~

This warrant applies to information associated with the following acconnts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company

I
~j

headquartered in Cupe1tino, California:

ij"

I
11

II

"

-1-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 48 of 57

ATTACHMENTB
I.

Information to be disclosed by Apple

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
infonnation is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the
Provider is required to disclose the following information to the government for each account or
identifier listed in Attachment A:
a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b.

All records or other information regarding the identification of the account, to
include full name, physical address, telephone nnmbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

c.

The types of service utilized;

d.

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

e.

All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;

-2-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 49 of 57

II.

f.

All search history or web history;

g.

All records indicating the services available to subscribers of the accounts;

h.

All usernames associated with or sharing a login IP address or browser cookie with
the accounts;

1.

All cookies, including third-party cookies, associated with the user;

j.

All records that are associated with the machine cookies associated with the user;
and

k.

All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMS!"), or International Mobile Equipment Identities
("IMEI").

Information to be Seized by the Government
Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June I, 2016, to December 31, 2017, including:
a.

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to

-3-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 50 of 57

Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;
b.

All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi,
Assange,

Julian
Randy Credico,

or any individual associated with the-Trump Campaign;
c.

Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electionee1ing communication;

d.

Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

e.

All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f

Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials~ foreign entities, foreign persons, or

foreign principals;
g.

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h.

Evidence indicating the account user's slate of mind as it relates to the crimes under
investigation;

-4-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 51 of 57

i.

The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

J.

Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k.

All images, messages and communications regarding wiping software, encryption
or other methods to avoid detection by law enforcement;

I.

The identity of any non-U.S. person(s)--including records that help reveal the
whereabouts of the person(s)--who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m.

The identity of any person(s)--including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.

n.

Passwords and encryption keys, and other access inf01mation that may be necessary
to access the account and other associated accounts;

o.

All existing printouts from original storage which concern the categories identified
in subsection II.a.

III.

Review Protocols

Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other

-5-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 52 of 57

operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.

-6-

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 53 of 57

i

I

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

I
I

I
11

I

Ii

IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY APPLE

Case: 1:18-sc-02922
Assigned To : Howell, Beryl A.
Assign. Date: 9/27/2018
Description: Search & Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705{b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the nondisclosure, the proposed Order would direct Apple, Inc. ("Apple"), an electronic communication
.'
and/or remote computing services provider headquartered in Cupertino, California, not to notify
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year or until further order of the Court.
JURISDICTION AND LEGAL BACKGROUND
1.

The Court has the inherent power to seal court filings when .appropriate,

including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing

'\

Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
'
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2.

In addition, this Court has jurisdiction to issue the requested order because it is "a

court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
"district court of the United States .. , that - has jurisdiction over the offense being investigated."

I

I

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 54 of 57

18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
,occurred within Washington, D.C. See 18 U.S.C. § 3237.
3.

Further, the Court has authority to require non-disclosure of the W arraot under 18

U.S.C. § 2705(b).

Apple provides an "electronic communications service," as defined in 18

U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
compelled to supply communications aod other records using a subpoena, court order, or search
warrant.

Specifically, Section 27~3(c)(2) authorizes the Government to obtain certain basic

"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"no.n-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
J

Government to obtain contents of communications using a search warraot. See 18 U.S.C. § 2703.
4.

The SCA does not set forth aoy obligation for providers to notify subscribers about

subpoenas, court orders, or search warraots under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such ·
notification. In relevant part, Section 2705(b) provides as follows: 1
(b) Preclusion of notice to subject of governmental access. - A governmental
entity acting under section 2703 ... may apply to a court for ao order commaoding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period· as the court
deems appropriate, not to notify aoy other person of the existence of the warraot,
subpoena, or court order. The court shall enter such ao order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in(1) endaogering the life or physical safety of ao individual;
(2) flight from prosecution;
1

Section 2705(b) contains additional requirements for legal process obtained pursuaotto 18 U.S.C.
§ 2703(b)(I)(B), but the Govenunent does not seek to use the proposed Order for aoy legal process
,under that provislon.
2

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 55 of 57

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U .S.C. § 2705(b ). The United States District Court for the District of Cohunbia has made clear

'

that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under§ 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5.

Accordingly, this motion to seal sets forth facts showing reasonable grounds to

command Apple not to notify any other person (except attorneys for Apple for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6.

The Federal Bureau ofinvestigation ("FBI") is investigating violations of 18 U.S.C.

§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 '(conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U,S,C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S,C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National '
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
3

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 56 of 57

email accounts of U.S. persons, followed by the public release of stolen materials through various
outlets.
7.

In this matter, the government requests that the Warrant be sealed until further order ·

of the Court and that Apple and its employees be directed not to notify any other person of the ·
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such ar1 order is appropriate
because the Warrarit relates to an ongoing criminal investigation, the scope arid nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrarit and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8.

Given the complex arid sensitive nature of the criminal activity under.investigation,

and \tlso given that the criminal scheme may be ongoing, the, Government anticipates that this
confidential investigation will continue for the next year or longer.

However, should

circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief,
9.

There is, therefore, reason to believe that notification of the existence of the

Warrant will seriously jeopardize the investigation, including by giving the targets fill opportunity
to flee from prosecution, destroy or tamper with evidence, arid intimidate witnesses. See 18 U.S.C.

4

 Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 57 of 57

§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in confidentiality to justify the governmenfs sealing request.

See Robinson, 935 F.2d at 287-89.
I 0.

Based on prior dealings with Apple, the United States is aware that, absent a court

order under Section 2705(b) commanding Apple not to notify anyone about a legal request, Apple
may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic
communications for a certain account, notify the subscriber or customer of the existence of the
warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the governmentrespectfully requests that the
above-captioned watrant, the application and affidavit in support thereof, and all attachments
thereto'and other related materials be placed under seal, and furthermore, iliat the Court command
Apple not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or
until further order of the Court.
Respectfully submitted,
ROBERT S. MUELLER, III
Special Counsel

Dated:

'J/2...7: /\ '(>

By:'

Ky!
The. p al Counsel's Office
(202) 616-3812

5

 Case Document 29-30 Filed 04/28/20 Page 1 of 60

A0 93 (Rev. 11/13) Search and Seizure Warrant

 

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia

In the tte of the Search of

. .a Case: 
(Briefly describe the property to be searched 1 I A
or identi?) the person by name and address) TU- Hog?gu?t 3W 

INFORMATION ASSOCIATED WITH FOUR v. SEALED
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 

SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the Northern District of 7 California
(identi?) the person or describe the property to be searched and give its location):

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identi?J the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 18, 2018 (not to exceed 1 4 days)
in the daytime 6:00 am. to 10:00 pm. El at any time in the day or night because good cause has been established.

 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief US. District J?ge
United States Magistrate Judge)

El Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose
property, Will be searched or seized (check the appropriate box)

for days (not to exceed30) until, the facts justifying, the later speci?c date of

Date and time issued: 457/ 2a [/?signature

City and state: Washington, DC Hon. Beryl A. Howell, Chier. S. DistrictJudge

Printed name and title

 

 

 

 

Case Document 29-30 Filed 04/28/20 Page 2 of 60

A0 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date: 
Executing o?icer ?s signature

Printed name and title

 

 

Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 3 of 60

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Google, LLC ("Google"), a company headquartered in Mountain View, California:

-1-

 Case Document 29-30 Filed 04/28/20 Page 4 of 60

ATTACHMENT 

I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,

custody, or control of Google, LLC (?Google?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Google, or have been preserved

pursuant to a request made under 18 U.S.C. 2703 Google is required to disclose the following

information to the government for each account listed in Attachment A:

a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);

The types of service utilized;

All records or other information stored at any time by an individual using the

account, including address books, contact and buddy lists, calendar data, pictures,

and ?les;

Case Document 29-30 Filed 04/28/20 Page 5 of 60

e. All records pertaining to communications between the Provider and any person

regarding the account, including contacts with support services and records of

actions taken;

f. All subscriber ?change history? associated with the account;

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account;

i. All Google Analytics information associated with the account (including all

properties and UA codes associated with the account, and, for each of these

proprieties and UA codes, all usemames and email accounts associated with them);

j. All Google Developers Console information associated with the account;
1k. All Minutemaid information associated with the account;

1. All Android information associated with the account;

m. All Google Docs associated with the account;

n. All YouTube information associated with the account;

0. All Google Hangouts information associated with the account;

p. All Google Voice information associated with the account;

q. All Web App Activity associated with the account;

r. All Google Drive information associated with the account;
3. All Google+ information associated with the account;
t. All device information associated with the account, including all instrument or

telephone numbers (including MAC addresses, Electronic Serial Numbers
Mobile Electronic Identity Numbers Mobile Equipment

Identi?er Mobile Identi?cation Numbers Subscriber Identity

Case Document 29-30 Filed 04/28/20 Page 6 of 60

Modules Mobile Subscriber Integrated Services Digital Network Number
International Mobile Subscriber Identi?ers or
International Mobile Equipment Identities and
u. For any accounts linked to the accounts listed in Attachment A, including accounts

linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identi?cation of the account,
to include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number).

II. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030(unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

Case Document 29-30 Filed 04/28/20 Page 7 of 60

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi,? Julian

individual associated with the Trump Campaign, any witness in the investigation;

0. Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of

any foreign government, foreign officials, foreign entities, foreign persons, or

foreign principals;

Case Document 29-30 Filed 04/28/20 Page 8 of 60

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non?US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection 

Case Document 29-30 Filed 04/28/20 Page 9 of 60

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attomey?client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 Document 29-30 Filed 04/28/20 

UNITED STATES DISTRICT COURT OCT -5 

for the Clgrak, U-S. 
District of Columbia "minty COUPE

 

In the Matter of the Search of

(Brie?y desaribe the Jproperty to be searched
or identz?t the person by name and address}

INFORMATION ASSOCIATED WITH
FOUR ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE

Case: 1:18?3902994
Assigned To Howell, Beryl A.
Assign. Date 1052018
Description: USA v. SEALED

APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury thatI have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the Northern District of _California there is now concealed (identijj/ the

person or describe the property to be seized):

See Attachment 

 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
devidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;
lirproperty designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section O?ense Description
52 U.S.C. 30121 Foreign Contribution Ben
18 U.S.C. 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy

See Affidavit for add'l

The application is based on these facts:
See attached Affidavit.

Continued on the attached sheet.

CI Delayed notice of days (give exact ending date if more than 30 days: is requested
under 18 U.S.C. 3] 03a, the basis of which is set forth on the attached sheet.

 

 

 

(?if 

2
Reviewed by Applicant's 5W
lele R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI

 

 

 

Printed name and title

Sworn to before me and signed in my presence.

Date: #9111206) 

I

Judge 's signature

Hon. Beryl A. Howell, Chief US. District Judge

Printed name and title

City and state: waC.

 

Case Document 29-30 Filed 04/28/20 Pgilt?b

OCT -5 2018

IN THE UNITED STATES DISTRICT u.s. District and
FOR THE DISTRICT OF COLUMBIA Bankruptcy Courts

 

IN THE MATTER OF THE SEARCH OF 4 Case; 1 :18?sc-02994

INFORMATION ASSOCIATED WITH Assigned To Howell, Beryl A.

FOUR ACCOUNTS STORED AT . Assign Date 10/5/2018

PREMISES CONTROLLED BY GOOGLE Description: USA v. SEALED
AFFIDAVIT IN SUPPORT OF

AN APPLICATION FOR A WARRANT
I, Patrick J. Myers, being ?rst duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1. I make this af?davit in support of an application for a search warrant for

information associated with accounts

 

of the information described in Attachment A, government-authorized persons will review that
information to locate the items described in Attachment B.

2. I am a Special Agent with the Federal Bureau of Investigation assigned to
FBI Pittsburgh working directly with the Special Counsel?s Of?ce. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national

security investigations relating to foreign intelligence and cybersecurity.

Case Document 29-30 Filed 04/28/20 Page 12 of 60

3. The facts in this af?davit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This af?davit is
intended to Show merely that there is suf?cient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this af?davit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instrumentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C. 1513 (Witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/ or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION

5. This Court has jurisdiction to issue the requested warrant because it is ?a court of
competent jurisdiction? as de?ned by 18 U.S.C. 2711. Id. 2703(a), 
Speci?cally, the Court is ?a district court of the United States (including a magistrate
judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C.

2711(3)(A)(i). The offense conduct included activities in Washington, DC, as detailed below.

Case Document 29-30 Filed 04/28/20 Page 13 of 60

PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger STONE
6. Roger STONE is a self-employed political strategist/consultant and has been
actively involved in US. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then?
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
7. Jerome CORSI is a political commentator who, according to publicly available
information, served as the ?Washington Bureau Chief for Inforwarscom.? According to
publicly-available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

Case Document 29-30 Filed 04/28/20 Page 14 of 60

 

B. Russian Government?Backed Hacking Activity During the 2016 Presidential
Election

9. On January 6, 2017, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,

?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC

assessed the following:

Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the
US presidential election. Russia?s goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.

10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber
activity?with overt efforts by Russian Government agencies, state?funded media, third-party



intermediaries, and paid social media users or ?trolls.

11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence



Case Document 29-30 Filed 04/28/20 Page 15 of 60

services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties.? Further, July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016.? The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted
in the compromise of the personal e-mail accounts of Democratic Party of?cials and political
?gures. By May, the GRU had ex?ltrated large volumes of data from the 

12. With respect to the release of stolen materials, the USIC assessed ?with high
con?dence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

l3. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the cloud-based systems using the cloud provider?s own technology. The individuals

used three new accounts with the same cloud computing service to move the ?snapshots? to

those accounts.

16. On or about September 4, 2016, individuals associated with the GRU stole the

emails from a former White House advisor who was then advising the Clinton Campaign. These

Case Document 29-30 Filed 04/28/20 Page 16 of 60

emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich et (11. (Case No. 

C. Public Interactions with Guccifer 2.0 and WikiLeaks

19?. On June 14, 2016, the forensic ?rm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of ?les and mails, I gave to Wikileaks. They will publish them soon.?
In that post, Guccifer 2.0 also began releasing hacked DNC documents.

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.

21. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article

and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he explains who he is and

Case Document 29-30 Filed 04/28/20 Page 17 of 60

why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC ?les and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given What Julian Assange
has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0?s Twitter account was reinstated.

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJ StoneJ paying you
back.? Guccifer also sent a private message to @RogerJStoneJr stating ?i?m pleased to say 
great man. please tell me if I can help anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,

Case Document 29?30 Filed 04/28/20 Page 18 of 60

resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying ?rms to in?uence U.S.
policy toward Ukraine.

27. On August 21, 2016, using @RogerJ StoneJ R, STONE tweeted: ?Trust me, it will
soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a C-SPAN interview that same
day, STONE reiterated that because of the work of a ??mutual acquaintance? of both his and
the public [could] expect to see much more from the exiled whi'stleblower in the
form of strategically-dumped Clinton email batches.? He added: ?Well, ?rst of all, I think Julian
Assange is a I think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.?

28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.?

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.?

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement which was
part of WikiLeaks? 10-year anniversary celebration STONE told Infowars that his intermediary

described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr

to tweet: ?Payload coming. #Lockthemup.?

Case Document 29-30 Filed 04/28/20 Page 19 of 60

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
The Podesta Emails #HillaryClinton #Podesta #imWithHer? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to August 21,
2016 C-SPAN and Twitter references argued publicly that ?[it is] a reasonable assumption to -
or at least a reasonable conclusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any
in?uence with him or that I have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of

charges I knew about the hacking of Podesta?s email (speculation and conjecture) and the timing

Case Document 29-30 Filed 04/28/20 Page 20 of 60

or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true.?
D. Private Twitter Direct Messages with WikiLeaks and ASSANGE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJ StoneJ sent a private direct message to the Twitter
account @wikileaks.1 The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me? cordially 

36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t go there if you don?t want us to correct you.?

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct\" me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

38. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are

now more free to communicate.?

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,

 

1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJ StoneJ r.

_10_

Case Document 29-30 Filed 04/28/20 Page 21 of 60

the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
?Still nonsense. As a journalist it doesn?t matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped?up sexual assault
charges dropped I don?t know of any crime you need to be pardoned for - best regards. That
same day, @JulianAssange responded: ?Between CIA and they?re doing quite a lot. On the
side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal.?

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

E. Communications with and Others Regarding
Forthcoming Leaks

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for -address,_ On October 17,

2017, Chief Judge Howell issued a search warrant for one of STONES-addresses,

?On or about December 19, 2017, Chief Judge Howell issued a search

warrant for- email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for iCloud account. Information recovered pursuant to those

 

search warrants indicated the following:

-11-

Case Document 29-30 Filed 04/28/20 Page 22 of 60

42. On or about May 15, 2016,-mailed CORSI: ?Here is my ?ight

schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

appears to have forwarded the message to STONE at ?who replied to

CORSI that, ?May meet Manafort -guarantee nothing.?

43. On or about May 18,2016, CORSI emailed STONE at?

with the title, ?Roger Why don't you look this over before I send it believe that

CORSI wrote,

   
 

I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?

44. On July 25, 2016, STONE, using?sent an email to
CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
Foundation, allegedly.?

45. On or about July 31, 2016, STONE, using ?emailed
CORSI with the subject line, ?Call me The body of the email read: -hould see
Assange[.] -should ?nd Bernie [S]anders brother who called Bill a Rapist turn him for
Trump[.] -should fin-or more proof of Bill getting kicked out.?

46. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at

??Word is friend in embassy plans 2 more dumps. One shortly after I?m

back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox

-12-

Case Document 29-30 Filed 04/28/20 Page 23 of 60

will have me on mid?Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016, - an associate of emailed
STONE at The email contained a link to a poll indicating that Clinton

led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal

Julian Assange last night.? -subsequently stated to investigators that, around the

that in 2018-told STONE he would be interviewed by the FBI and would have to

divulge the conversation about meeting AS SANGE. STONE told -he was joking and

had not actually met AS SANGE.2

same time, STONE told him he had gone to London to meet ASSANGE also stated

   

48. Through a search of iCloud account, the FBI has uncovered evidence

suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,

in his email to - to have ?dined? with ASSANGE. For example, an associate of

 

 

Case Document 29-30 Filed 04/28/20 Page 24 of 60

STONE sent a text to STONE at approximately on August 2, asking ?How did ur meeting
go in STONE responded. ?It?s this The following?day, the associate asked,
?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will
call later heading for airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had geo-location
information indicating that it was taken in Los Angeles.

49. On or about August 15, 2016, CORSI emailed STONE at
?Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it?s not over yet. More to come than anyone realizes. Won?t really get started
until after Labor Day. I?m in NYC this week. Jerry.?

50. On or about August 31, 2016, CORSI emailed STONE at
?Did you get the PODESTA writeup.? STONE replied 

51. On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation tied to Ukraine Yanukovych Panama papers reveals Podesta hired by
S[b]erbank, Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, CORSI emailed STONE at

Is NY Post going to use the Pedesta [sic] stuff??

53. On or about September 24, 2016,-mailed CORSI, will have much

more on Turkey. Need a back channel highly sensitive stuf CORSI responded, ?We have

secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about

it again back, ?Awaiting secret ?le. Hope you are well.

-14-

Case Document 29-30 Filed 04/28/20 Page 25 of 60

Can't wait for the debate. Channeling Reagan, I hope!? CORSI responded, ?Keep me posted
about In a subsequent meeting with investigators,- indicated this
conversation concerned possible derogatory information he was trying to obtain from Turkey.

54. On or about October 3, 2016, an associate of STONE emailed STONE at

?and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote

back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in an. Many scores will be settled.? The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s
important.?

55. On or about October 4, 2016, AS SANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.?

57. That same day, BANNON emailed STONE at ?What was

that this STONE replied, ?Fear. Serious security concern. He thinks they are going

-15-

Case Document 29-30 Filed 04/28/20 Page 26 of 60

to kill him and the London police are standing done BANNON wrote back, ?He didn?t
cut deal w/ STONE replied, ?Don't think so BUT his lawyer -is a big
democrat.?

58. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.

59. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.?

60. According to phone records?at approximately
11:27 AM, CORSI placed a call to STONE, which STONE did not answer.

61. At approximately STONE received a phone call from the Washington
Post. The call lasted approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for

approximately seventeen minutes.

 

3 
1d74714-80e5-1 1 e6?875e?2c 1 bfe943 b6 6gstory.html

'16'

Case Document 29-30 Filed 04/28/20 Page 27 of 60

63. At approximately 2: 18PM, CORSI called STONE and the two spoke for
approximately twenty minutes.

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape.

65. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, CORSI emailed STONE using expect

that much of next dump focus, setting stage for Foundation debacle.?
66. At approximately - an author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
forwarded -message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual.

G. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI responded to STONE, ?Ok. I understand.? Approximately twenty
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job

numbers.?

68. On or about Wednesday, October 12, 2016, at approximately STONE,

using? emailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

-17-

Case Document 29-30 Filed 04/28/20 Page 28 of 60

CORSI wrote back at approximately EDT, ?Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice??

69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at both with the subject
line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that
?Podesta is at the heart of a Russian-government money laundering operation that bene?ts
?nancially Podesta personally and the Clintons through the Clinton Foundation.?

70. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed

CORSI back via the -Account, ?Got them and used them.?

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at
Joule ties to RUSSIA MONEY LAUNDERING to
CLINTON STONE responded, ?Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook.? CORSI
wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me
like -skimmed maybe billions off Skolkovo Skolkovo kept their money with

Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -

had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund account, there?s no telling how much money he laundered, or where it ended up.

Nothing in Clinton Foundation audited ?nancials or IRS Form 9903 about received via

-18-

Case Document 29-30 Filed 04/28/20 Page 29 of 60

Russia Metcombank[.] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI
sent STONE an email at -ith the subject, STONE article
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although I
have had some back?channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by-with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation??

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
?On Assange, can you call me now before STONE responded, ?Missed just

landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

Case Document 29-30 Filed 04/28/20 Page 30 of 60

75. On or about October 17, 2016, CORSI emailed STONE at
?with the subject, ?Fwd:
ASSANGE. . .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man ?les that include Hillary.
It?s what they used to call a ?Mexican stand Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.? Based on review of the original email that CORSI forwarded, the
?trusted source? was a self-identi?ed retired librarian who gathers information from public chat

rooms.

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbart.com in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

78. On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.?

-20-

Case Document 29-30 Filed 04/28/20 Page 31 of 60

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

Case Document 29-30 Filed 04/28/20 Page 32 of 60

 

Case Document 29-30 Filed 04/28/20 Page 33 of 60

 

I. Congressional Testimony and Public Statements About His Relationship
with Wikileaks

88. On September 26, 2017, STONE testi?ed before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta?s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. . . .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny. . . .

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary? ?go-between? and ?mutual friend.? All of these monikers are equally

9

true.

-23-

Case Document 29-30 Filed 04/28/20 Page 34 of 60

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.

Those excerpts include the following:

Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange?
MR. STONE: No.

Q: So throughout the many months in which you represented you were either in

communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had con?rmed with the intermediary 

MR. STONE: That 
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions.

90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

J. Messaging to Randy CREDICO about ?Back channel?

91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identi?ed as his ?intermediary? to AS SANGE), messaged STONE, ?My
lawyer wants to see me today.? STONE responded, ?Stonewall it. Plead the ?fth.'Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24-

Case Document 29-30 Filed 04/28/20 Page 35 of 60

back, ?That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what? Nothing
happening in DC the day before Thanksgiving why are busting my chops??

93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them which he himself said in public b4 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuffL] I just followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for 

94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, ?Forensic evidence proves that there is no back Channel. So
now you can relax.?

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? In a public Facebook post, STONE further stated that ?Credico merely 

-25-

Case Document 29-30 Filed 04/28/20 Page 36 of 60

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-mails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could have just told him the truth that you didn?t have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If
you testify you?re a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

?26-

Case Document 29-30 Filed 04/28/20 Page 37 of 60

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks Website email address asking you would do my show[.] That was my
initial contact.?

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy
logs . . . 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get
off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that

-27-

Case Document 29-30 Filed 04/28/20 Page 38 of 60

stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my
lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to take that dog away
from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too.

He was depressed about it. Or was he lying.? The alticle noted that CREDICO stated he did not

have prostate cancer and did not have any such discussion with STONE.

K. The Target Accounts

 

 

5 ?credico-sa s-trum ?adviser-roger-stone-


threatened-dog? 1 3 591 13 70.html
6 

~28-

Case Document 29-30 Filed 04/28/20 Page 39 of 60

 

Case Document 29-30 Filed 04/28/20 Page 40 of 60

 

Case Document 29-30 Filed 04/28/20 Page 41 of 60

 

Case Document 29-30 Filed 04/28/20 Page 42 of 60

 

BACKGROUND CONCERNING GUOGL F.

117. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail (?email?) access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account?s
user or users.

118. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber?s full name, physical address, telephone numbers and other

identi?ers, alternative email addresses, and, for paying subscribers, means and source of payment

-32-

Case Document 29-30 Filed 04/28/20 Page 43 of 60

(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account?s user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.

119. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
e. session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider?s website), and other log ?les that re?ect usage of the
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular 10 gins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.

120. In my training and experience, in some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider?s support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute

evidence of the crimes under investigation because the information can be used to identify the

account?s user or users.

-33-

Case Document 29-30 Filed 04/28/20 Page 44 of 60

121. This application seeks a warrant to search all responsive records and information
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google?s possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.

122. As explained herein, information stored in connection with an email account may
provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This ?user attribution? evidence is analogous to the search for ?indicia of occupancy?
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can Show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime

under investigation. This geographic and timeline information may tend to either inculpate or

34.?

Case Document 29-30 Filed 04/28/20 Page 45 of 60

exculpate the account owner. Additionally, information stored at the user?s account may further
indicate the geographic location of the account user at a particular time g. location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner?s state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner?s motive and intent to
commit a crime (6. g. communications relating to the crime), or consciousness of guilt
g. deleting communications in an effort to conceal them from law enforcement).
FILTER REVIEW PROCEDURES

123. Review of the items described in Attachment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use, if necessary, of a designated ??lter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION
124. Based on the forgoing, I request that the Court issue the proposed search warrant.

125. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not

required for the service or execution of this warrant.

-35_

Case Document 29-30 Filed 04/28/20 Page 46 of 60

REQUEST FOR SEALING
126. I further request that the Court order that all papers in support of this application,
including the af?davit and search warrant, be sealed until ?thher order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these

documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,
Patrick J. Myers

Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this 5 ?ay of October, 2018.



The Honorable Beryl A. Howell
Chief United States District Judge

-36-

Case Document 29-30 Filed 04/28/20 Page 47 of 60

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or

operated by Google, LLC (?Google?), a company headquartered in Mountain View, California:

 

Case Document 29-30 Filed 04/28/20 Page 48 of 60

ATTACHMENT 

1. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,

custody, or control of Google, LLC (?Google?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Google, or have been preserved

pursuant to a request made under 18 U.S.C. 2703 Google is required to disclose the following

information to the government for each account listed in Attachment A:

a.

The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number);

The types of service utilized;

All records or other information stored at any time by an individual using the

account, including address books, contact and buddy lists, calendar data, pictures,

and ?les;

Case Document 29-30 Filed 04/28/20 Page 49 of 60

c. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of

actions taken;

f. All subscriber ?change history? associated with the account;

g. All search history and web history associated with the account;

h. All location and maps information associated with the account;

i. All Google Analytics information associated with the account (including all

properties and UA codes associated with the account, and, for each of these

proprieties and UA codes, all usernames and email accounts associated with them);

j. All Google Developers Console information associated with the account;
k. All Minutemaid information associated with the account;

1. All Android information assOciated with the account;

m. All Google Docs associated with the account;

11. All YouTube information associated with the account;

0. All Google Hangouts information associated with the account;

p. All Google Voice information associated with the account;

q. All Web App Activity associated with the account;

r. All Google Drive information associated with the account;
5. All Google+ information associated with the account;
t. All device information associated with the account, including all instrument or

telephone numbers (including MAC addresses, Electronic Serial Numbers
Mobile Electronic Identity Numbers Mobile Equipment

Identi?er Mobile Identi?cation Numbers Subscriber Identity

Case Document 29-30 Filed 04/28/20 Page 50 of 60

Modules Mobile Subscriber Integrated Services Digital Network Number
International Mobile Subscriber Identi?ers or
International Mobile Equipment Identities and
u. For any accounts linked to the accounts listed in Attachment A, including accounts

linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identi?cation of the account,
to include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number).

II. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030(unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

Case Document 29-30 Filed 04/28/20 Page 51 of 60

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Theodore Malloch, Julian
Assange, Mark Goldman, Mamadou Paye, Andrew Miller, Randy Credico, any
individual associated with the Trump Campaign, any witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

(1. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

6. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or

foreign principals;

Case Document 29-30 Filed 04/28/20 Page 52 of 60

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;

i. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

1. The identity of any non?US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection 

Case Document 29-30 Filed 04/28/20 Page 53 of 60

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-30 Filed 04/28/20 Page 54 of 60

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF Case; 1:18?sc?02994
INFORMATION ASSOCIATED WITH FOUR Assigned To Howell, Beryl A.
ACCOUNTS STORED AT PREMISES Assign. Date 10i5i2018
CONTROLLED BY GOOGLE Description: USA v- SEALED

 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 USC. 27?051?11)

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and af?davit
in support thereof (collectively herein the ?Warrant?) under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. ?2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California, not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further order of the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (DC. Cir. 1980) (citing
Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (DC. Cir. 1991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a
court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

?district court of the United States . . . that has jurisdiction over the offense being investigated.?

Case Document 29-30 Filed 04/28/20 Page 55 of 60

18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, DC. See 18 U.S.C. 3237.

3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. 2705(b). Google provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The
Stored Communications Act 18 U.S.C. 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber information? using a subpoena, Section 2703(d) allows the Government to obtain other
?non?content? information using a court order, and Section allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
noti?cation. In relevant part, Section 2705(b) provides as follows:1

Preclusion of notice to subject of governmental access. A governmental

entity acting under section 2703 . . . may apply to a court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court

deems appropriate, not to notify any other person of the existence of the warrant,

subpoena, or court order. The court shall enter such an order if it determines that

there is reason to believe that noti?cation of the existence of the warrant, subpoena,

or court order will result in?
(1) endangering the life or physical safety of an individual;
(2) ?ight from prosecution;

 

1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.

Case Document 29-30 Filed 04/28/20 Page 56 of 60

(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705(b), the court is required to
issue the non-disclosure order.

In re Application for Order of Nondisclosure Pursuant to 8 US. C. 2705 for Grand Jury
Subpoena 41 F. Supp. 3d 1; 5 (D.D.C. 2014).

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.

FACTS SUPPORTING AND 

6. The Federal Bureau of Investigation is investigating violations of 18 U.S.C.
2 (aiding and abetting); 18 U.S.C. 3 (accessory after the fact); 18 U.S.C. 4 (misprision of a
felony); 18 U.S.C. 371 (conspiracy); 18 U.S.C. 1030 (unauthorized access of a protected
computer); 18 U.S.C. 1343 (wire fraud); 18 U.S.C. 1349 (attempt and conspiracy to commit
wire fraud); and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject Offenses?), in
connection with efforts to compromise the networks of the Democratic National Convention
the Democratic Congressional Campaign Committee and the email accounts

of US. persons, followed by the public release of stolen materials through various outlets.

3

Case Document 29-30 Filed 04/28/20 Page 57 of 60

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or digital evidence relating to their criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

9. There is, therefore, reason to believe that noti?cation of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to ?ee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.

Because of such potential jeopardy to the investigation, there also exists a

Case Document 29-30 Filed 04/28/20 Page 58 of 60

compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287-89.

10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request,
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or
electronic communications for a certain account, notify the subscriber or customer of the existence
of the warrant prior to producing the material sought.

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and af?davit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or
until further order of the Court.

Respectfully submitted,
ROBERT S. 

Special (Lou elf

Dated: l, 

 

 

(202) 616-3812

Case Document 29-30 Filed 04/28/20 Page 59 of 60

FILED

OCT -5 2018
IN THE UNITED STATES DISTRICT COURT
1 nd
FOR THE DISTRICT OF COLUMBIA ?332% ?f?tg?g?rg
IN THE MATTER OF THE SEARCH OF Case: 1:18?sc?02994
INFORMATION ASSOCIATED WITH FOUR Assigned To Howell, Beryl A.
ACCOUNTS STORED AT PREMISES Assign Date 10/5/2018
CONTROLLED BY GOOGLE Description: USA v. SEALED

 



The United States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and af?davit in support thereof (collectively the ?Warrant?),
and to require Google, an electronic communication and/or remote computing services provider
headquartered in Mountain View, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. 2705(b).

The Court ?nds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and af?davit in support thereof, all attachments thereto and other related

materials, the instant motion to seal, and this Order be SEALED until further order of the Court;

and

Case Document 29-30 Filed 04/28/20 Page 60 of 60

IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. ?2705(b), Google and its

employees shall not disclose the existence or content of the Warrant to any other person (except

attorneys for Google for the purpose of receiving legal advice) for a period of one year or until

further order of the Court.

. ?ag/54:.

THE HONO A. HOWELL
CHIEF UNITED STATES DISTRICT JUDGE



Date

Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 1 of 48
AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
District of Columbia
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the p erson by name and address)

VARIOUS ELECTRONIC DEVICES BELONGING TO
ROGER J. STONE, JR.

)
)
)
)
)
)

Case: 1: 19-sw-00057
Assigned To : Chief Judge Howell, Beryl A.
Assign. Date: 2/13/2019
Description : Search and Seizure Warrant

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
District of
Columbia
(identify the person or describe the property to be searched and give its location):

See Attachment A.

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the p erson or describe the prop erty to be seized):
See Attachment B.

YOU ARE COMMANDED to execute this warrant on or before
February 27, 2019
(not to exceed 14 days)
0 at any time in the day or night because good cause has been established.

~ in the daytime 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to
Hon. Beryl A. Howell
(United States Magistrate Judge)

0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U .S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the approp riate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of

Date and time issued:

City and state:

Washington, DC

Hon. Beryl A. Kowell, Ghief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 2 of 48
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:
Executing officer 's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 3 of 48

ATTACHMENT A
Property to be Searched

The following devices provided to the FBI by
Columbia:

currently in the District of

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 4 of 48

ATTACHMENT B
Items to be seized from the Subject Devices

1.

The items to be seized are fruits, evidence, information relating to, contraband, or

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b){l) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a. Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b. Documents reflecting communications between Stone and Jerome Corsi;
c. Documents reflecting communications between Stone and Randy Credico;
d. Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump;
e. Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;
f.

Records and information relating to the e-mail accoun
a

;

g. Records and information relating to the WhatsApp account associated with
telephone number
h. Records and information relating to the Signal account associated with telephone
number

Page 1 of 3

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 5 of 48

1.

Records and information relating to the Wicla account associated with telephone
number

;

j. Any computers, media storage devices, tablets/iPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
reference materials, in whatever form;
l.

Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form;

2.

For any computer or storage medium whose seizure is otherwise authorized by this

warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
entries, configuration files, saved usernames and passwords, documents, browsing
history, user profiles, email, email contacts, "chat," instant messaging logs,
photographs, and correspondence;
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 2 of 3

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 6 of 48

c. evidence of the lack of such malicious software;
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
under investigation and to the computer user;
e. evidence indicating the computer user' s state of mind as it relates to the crime under
investigation;
f.

evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;

g. evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h. evidence of the times the COMPUTER was used;
1.

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.

documentation and manuals that may be necessary to access the COMPUTER or
to conduct a forensic examination of the COMPUTER;

k. records of or information about Internet Protocol addresses used by the
COMPUTER;
l.

records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;

m. contextual information necessary to understand the evidence described in this
attachment.

Page 3 of3

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 7 of 48
AO 106 ( Rev. 04/1 0) Applicat ion for a Search Warrant

;:r_-~

UNITED STATES DISTRICT COURT
for the
District of Columbia

fEB 13 Wt9
r.:eri<, tJ.~ ._ Distnct u uar,r<!'ll!)!Ci

Cnurts t{'(I' m-e District of"Cn! w ~
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

VARIOUS ELECTRONIC DEVICES BELONGING TO
ROGER J. STONE , JR.

)
)
)
)
)
)

Case: 1 :19-sw-00057
Assigned To : Chief Judge Howell, Beryl A .
Assign. Date : 2/13/2019
Description: Search and Seizure Warrant

APPLICATION FOR A SEARCH WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A

located in the

- --

- --

-

-

District of

_ __ __

Columbia
_
;.c...;...;.- '---

---

, there is now concealed (identify the

person or describe the property to be seized) :

See Attachment 8

The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):

~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;

rJ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Offense Description

Code Section
18 U.S.C. § 1505
18 U.S.C. § 1512
18 U.S.C. § 1001

Obstruction of Proceeding
Witness Tampering
False Statements

The application is based on these facts :
See attached Affidavit.
~ Continued on the attached sheet.
0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA:
Faron Zelinsky (ASC)

& ., A~

Applicant's signature

Curtis Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date:

02/13/2019

City and state: Washington, D.C.

Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 8 of 48

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

:;===1== ~ = --~~-=-··

=~===:~~~~~~~~
- ~~~
-

IN THE MATTER OF THE SEARCH OF
VARIOUS ELECTRONIC DEVICES
BELONGING TO ROGER J. STONE, JR.

a,• .•• • ·.a . .• •. · - · ·•

•

.

..

• · ·- - - - ··

-

Case: 1: 19-sw-00057
Assigned To : Chief Judge Howell, Beryl A.
Assign. Date : 2/13/2019

Description: Search and Seizure Warrant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for the

following devices (the "Subject Devices") associated with Roger J. Stone, Jr. ("Roger Stone"),
described below and further in Attachment A, currently located in the District of Columbia:
a.
b.
c.

2.

I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have

been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cybersecurity.
3.

I am currently involved in the investigation into Roger J. Stone, Jr., ("Roger Stone")

and others known and unknown to the government, for the commission of unlawful activities in
the District of Columbia, and elsewhere, including, but not limited to: (i) obstruction of
proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in

Page 1 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 9 of 48

violation of Title 18, United States Code, Section l 001 and (iii) witness tampering, in violation of
Title 18, United States Code l 512(b)(1) (collectively the "Specified Federal Offenses").
4.

On January 24, 2019, a Grand Jury in the District of Columbia indicted Roger Stone

on seven counts: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section
1505 (Count 1); (ii) false statements, in violation of Title 18, United States Code, Section 1001
(Counts 2-6) and; (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(l)
(Count 7). See United States v. Roger Jason Stone, Jr., 19-cr-18-ABJ, Dkt. 1. On January 29,
2019, Roger Stone pied not guilty to the charges before Magistrate Judge Deborah A. Robinson.
5.

I have personally participated in this investigation and am aware of the facts

contained herein based on my own investigation, as well as my review of documents, records, and
information provided to me by other law enforcement officers and technical experts.
6.

This affidavit is intended to show merely that there is sufficient probable cause for

the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I assert that an event took place on a particular date, I am asserting that it took
place on or about the date specified.
7.

For the reasons set forth in this Affidavit, there is probable cause to believe that one

or more of the Specified Federal Offenses have been committed by Roger Stone and others known
and unknown to the government. Further, there is probable cause to believe that each of the Subject
Devices have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in each of the
Subject Devices, as described further in Attachment B.

Page 2 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 10 of 48

PROBABLE CAUSE
A. Background on Relevant Individuals
8.

Roger Stone is a political consultant who has worked for decades in U.S . politics

and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald J. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
9.

Julian Assange is the founder and director of WikiLeaks, which is publicly

described as a non-profit organization that disseminates non-public information and classified
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
London, United Kingdom.
10.

Jerome Corsi is a political commentator who worked with an online media

publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly
with Stone throughout the campaign, including about the release of stolen documents by
WikiLeaks.

12.

Based on the investigation to date, Randy Credico was a radio host who has known

Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent
Selection Committee on Intelligence ("HP SCI") on or about September 26, 2017, Stone described
Credico (without naming him) as an " intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by

Page 3 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 11 of 48

name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that Assange, had
'"[e]mails related to Hillary Clinton which are pending publication." '
13.

Richard Gates is a U.S. citizen who served for years as a political consultant and

lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gates, 1:l 7-cr-201 (D.D.C.).
14.

Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in

or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief
executive officer of the Trump Campaign.

B. Hacking Activity During the 2016 Presidential Election
16.

John Podesta is a U.S. citizen who served for years as a political consultant. During

the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving

1

In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.
Page 4 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 12 of 48

the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation, through which an actor would have gained access to Podesta's email
account, allowing the actor to steal emails and documents from that account.
17.

The Democratic National Committee ("DNC") and Democratic Congressional

Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity
company CrowdStrike to investigate the intrusions and remediate.
18.

On or about June 14, 2016, CrowdStrike issued a public press release announcing

that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
19.

On or about July 13, 2018, a federal grand jury sitting in the District of Columbia

returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the

Page 5 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 13 of 48

DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: l 8-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.

C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
20.

As alleged in the Netyksho indictment, after successfully hacking the DNC and

DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the stolen
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the
transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
21.

On or about July 22, 2016, WikiLeaks released tens of thousands of documents

stolen from the DNC network. These stolen documents included communications by senior DNC
officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
22.

Beginning in or around October 2016, WikiLeaks began to release tens of

thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.

D. Stone's Communications About WikiLeaks During the Campaign
23.

In April 2018 interviews with the Special Counsel's Office, Richard Gates stated

that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by

Page 6 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 14 of 48

WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
WikiLeaks and Stone's prediction of the release .
24.

According to Gates, Manafort directed Gates to contact Stone about any additional

releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel' s Office in or
around October 2018, Gates recalled that at one point during the campaign he was with thencandidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.
25.

Emails recovered through a court-authorized search of Stone's email account
show that shortly after the July 22, 2016 release of stolen DNC emails

by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails .. . they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded

2

A search of
was authorized on or about September 11, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-661 (D.D.C. Sept. 11, 2017). A
second search of
was authorized on or about August 3, 2018 by the U.S.
District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 2703(d) for records connected to
Case No. I: 18-sc-2911 (D.D.C. Sept.
26, 2018). Records provided in response by Microsoft Corporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
Page 7 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 15 of 48

Stone' s email to

who lived in the United Kingdom and who was a

supporter of the Trump Campaign.
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that

"should see Assange."

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
Impact planned to be very damaging." In a law enforcement interview, Corsi stated
that the phrase "friend in embassy" referred to Assange. Corsi added in the same
email, "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
26.

According to recorded public statements recovered by the FBI, starting in early

August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a. According to a public video posted to YouTube, on or about August 8, 2016, Stone
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.

Page 8 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 16 of 48

During the interview, Stone stated that he was "in communication with Assange"
but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communications with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN television interview on or about August 18, 2016, Stone stated that he
had communicated with Assange through an "intermediary, somebody who is a
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
or have influence with Assange because I do not. . . . We have a mutual friend,
somebody we both trust and therefore I am a recipient of pretty good information."
27.

In or around November 2018,

, Stone

produced a series of text messages between Stone and Credico during the 2016 presidential

Page 9 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 17 of 48

campaign. 3 These text messages show that, beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeaks and Assange planned to
do.

Emails recovered through a court-authorized search of Stone's email account
show additional written communications between Stone and Credico

about WikiLeaks in or around September 2016.
a. On or about August 19, 2016, Credi co sent a text message to Stone that read in part,
"I'm going to have Julian Assange on my show next Thursday." On or about
August 21 , 2016, Credi co sent another text message to Stone, writing in part, "I
have Julian Assange on Thursday so I' m completely tied up on that day."
b. On or about August 25, 20 16, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was " in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
am e-mailing u a request to pass on to assange." Credico responded "Ok," and

3

As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.

Page 10 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 18 of 48

added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e. Later on or about September 18, 2016, Stone emailed Credi co an article with
allegations against then-candidate Clinton related to her service as Secretary of
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
article] or confirm this narrative."
f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.
g. On or about September 30, 2016, Credico sent Stone via text message a photograph
of Credico standing outside the Ecuadorian Embassy in London where Assange
was located.
h. On or about October l, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday . . . now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
press had reported that Assange planned to make a public announcement on or
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary
of the founding of WikiLeaks.

Page 11 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 19 of 48

1.

On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
and a link to an article at the website http://heatst.com/politics/october-surprisethwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-tosecurity-concerns. Credico responded to Stone, "head fake."

J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it[']s on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
this line ... Please leave my name out of it."
28.

Emails and text messages recovered by the FBI show that, in or around October

2016, Stone made statements about Assange' s future releases that were similar to prior statements
made by Credico to him. For example:
a. In a court-authorized search of Stone's email account
FBI recovered an email from Stone to

the

sent on or about October 3, 2016,

which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
b. In a court-authorized search of

the FBI also recovered an

email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange -

4

A search of
was authorized on or about October 17, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
was authorized on or about August 3, 2018 by the U.S.
second search of
District Court for the District of Columbia. Case No. 1: 18-sc-2583 (D.D.C. Aug. 3, 2018).

Page 12 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 20 of 48

what' s he got? Hope it's good." Stone responded, " It is. I'd tell Bannon but he
doesn't call me back."
c. On or about October 4, 2016, Assange held a press conference but did not release
any new materials pertaining to the Clinton Campaign. In a court-authorized search
o

, the FBI recovered an email exchange between Stone and

Steve Bannon on or about October 4, 2016 that occurred after the press conference.
In the exchange, Bannon asked, " What was that this morning???", referring to
Assange's press conference. Stone responded, "Fear. Serious security concern. He
thinks they are going to kill him and the London police are standing do[wn].
However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account, 5 the FBI recovered text
messages between Stone an
message

from on or about October 4, 2016. In one text

asked Stone if he had "hear[d] anymore from London." Stone

replied, " Yes - want to talk on a secure line - got Whatsapp." In an interview with
the Special Counsel ' s Office in or around May 2018

confirmed that he and

Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
29.

On or about October 7, 2016, WikiLeaks released the first set of emails stolen from

Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read "well done." Similarly,

5

A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No. l: 18-sc-662 (D.D.C. Mar. 14, 2018). The
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
Page 13 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 21 of 48

during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
Stone said, "I told you this was coming."
E. Stone's Communications with the House Permanent Select Committee on Intelligence

30.

On or about January 25, 2017, HPSCI publicly disclosed that it was investigating

allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone' s prior public
statements about having communications with Assange (particularly those from August 2016)
were of interest to the committee.
31.

In or around May 2017, HP SCI sent a letter requesting that Stone voluntarily appear

before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was
recovered

by the

FBI from

a court-authorized search of Stone' s email account

players02@gmail.com). The letter requested Stone produce:
Any documents, records, electronically stored information
including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's publiclyannounced parameters.
32.

On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and

stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts

6

On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active measures"
directed against the United States in connection with the 2016 election.
Page 14 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 22 of 48

within the investigation's publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone' s email account

.

F. Stone's Testimony Before HPSCI
33.

On or about September 26, 2017, Stone provided HPSCI with an "opening

statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34.

Also on or about September 26, 2017, Stone provided testimony in a closed session

before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Special Counsel' s Office from HPSCI in or around
December 2018. Stone appeared before HP SCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearing, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."

Stone 's Testimony About Documents He Possessed Related to WikiLeaks
35.

During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document

7

On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone' s written opening statement, and various
correspondence from Stone' s counsel to members ofHPSCI.
Page 15 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 23 of 48

request and whether Stone had any documents or written communications that discussed Julian
Assange, Russian interference, or other relevant documents:
Q:

The committee wrote to you on May 9th requesting no later
than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no documents,
records, or electronically stored information regardless of
form responsive to our requests. Was that a false statement?

A:

That is not a false statement. That's what -- I believe that to
be true.

[ ...]

36.

Q:

So you have no emails to anyone concerning the allegations
of hacked documents or your conversations with the
Guccifer 2[.0] or any discussions you have had with third
parties about Julian Assange? You have no emails, no texts,
no documents whatsoever, any kind of that nature?

A:

That is correct. Not to my knowledge. I think we met, again,
the precise criteria of your request, and we complied. Again,
if you have a more specific request, I'm happy to go back and
look. ...

Q:

I just want to ask you under oath -

A:

We did an extensive search consistent with the direction of
my attorneys, and we found nothing that met the criteria that
you asked for.

Q:

I just want to be certain because you are under oath, where
your letter was not under oath, that you have no documents,
no emails, no texts, no tweets that refer to Julian Assange or
Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've written
no documents yourself.

A:

In connection with Russian collusion, consistent with your
exact and precise request, yes.

In fact, and as described above, Stone had sent and received numerous emails and

text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and
Page 16 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 24 of 48

WikiLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
) and his iCloud account show that,

(including

at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017.8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016 that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that

"should

see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to

on or about October 3, 2016

that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
load every week going forward."

Stone's Testimony About His Early August 2016 Statements
37.

During his HPSCI testimony on or about September 26, 2017, Stone was asked to

explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually

8

The warrant for Stone's email account
was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account
was obtained on or about October 17, 2017 and executed
shortly thereafter. The warrant for Stone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
Page 17 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 25 of 48

communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38.

Stone testified that these public references to having a means of contacting

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
39.

In fact, documents recovered during the investigation (including those obtained via

search warrant returns

show that Stone did not begin communicating

with Credico about Assange or WikiLeaks until on or about August 19, 2016 9- approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after his August 12, 2016 statements of being " in communication with
Assange" and "not at liberty to discuss what I have."
40.

When interviewed by the FBI, Credico stated that the first time he ever spoke with

°

Assange was on or about August 25, 2016, when Credico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between him and another

9

As described above, on or about August 19, 2016, Credi co informed Stone by text message that
Credi co intended to interview Assange the following week. On or about August 25, 2016, Credi co
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."

°

1

Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews

Page 18 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 26 of 48

member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
information about himself, apparently as a means of introduction.
41.

The FBI has not identified any communications between Stone and Credico from

August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
42.

In contrast, and as described above, the FBI has identified written communications

prior to August 8, 2016 in which Stone directed Corsi-not Credico--to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WikiLeaks emails .. . they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico--sent an email to Stone in which Corsi
wrote that " [w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other
source for information from WikiLeaks.

Similarly, Stone also never disclosed his written

communications with Corsi to HPSCI when answering HPSCI' s questioning about the August 8,
2016 and August 12, 2016 statements about being in communication with Assange.
Stone 's Testimony About Communications to Assange
43.

During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to

communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."

Page 19 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 27 of 48

44.

In fact, starting on or about September 18, 2016, Stone directed Credi co to pass on

a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages obtained

on or about

September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
u a request to pass on to Assange." On or about the same day, Stone emailed
Credico an article with allegations against then-candidate Clinton related to her
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August IO to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
was obtained through a search of Stone's email account
b. According to text messages obtained

.
on or about

September 19, 2016, Stone texted Credico again, writing " Pass my message . .. to
Assange."

Credico responded, "I did."

An email obtained from the account

shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.

Stone's Testimony About Written Communications with Credico
45.

During his

HPSCI testimony,

Stone was

asked repeatedly about his

communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intermediary telephonically:

Q:

[H]ow did you communicate the intermediary?

A:

Over the phone.
Page 20 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 28 of 48

Q:

And did you have any other means of communicating with
the intermediary?

A:

No.

Q:

No text messages, no - none of the list, right?

A:

No.

Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:

46.

Q:

So you never communicated with your intermediary in
writing in any way?

A:

No.

Q:

Never emailed him or texted him?

A:

He's not an email guy.

Q:

So all your conversations with him were in person or over
the phone.

A:

Correct.

As described above, Stone and Credico (whom Stone identified as his intermediary)

engaged in frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
engaged in dozens of communications by email or text message in which they discussed

WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
47.

Written communications between Stone and Credico continued up until Stone's

HPSCI testimony and afterwards. For example, on or about September 26, 2017- the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages from
his identified intermediary-Stone and Credico exchanged over thirty text messages.
48.

Certain of the electronic messages between Stone and Credico (which Stone denied
Page 21 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 29 of 48

ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or around September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you [] said you have a back-channel way back a month before I had Assange on
my show ... I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together .. . so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this emai l was obtained through
a search of Stone's email accoun

).

Stone 's Testimony About Communications with the Trump Campaign
49.

During his HPSCI testimony, Stone was asked, "[d]id you discuss your

conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:
a. As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials by telephone to inform them about materials possessed
by Assange and the timing of future releases.
b. According to text messages
3, 2016, Stone wrote to

, on or about October
, " Spoke to my friend in London last night. The

payload is still coming."

Page 22 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 30 of 48

c. As described above, on or about October 4, 2016, after receiving information from
Credico about the delay in WikiLeaks's release of stolen materials, Stone emailed
Bannon that Assange had a " [s]erious security concern" but would release "a load
every week going forward."

G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI
50.

According to an email recovered through a court-authorized search of Stone' s email
on or about October 19, 2017, Stone sent Credico an excerpt of

accoun

his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his " intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged
effort to prevent Credico from contradicting Stone's false statements to HPSCI.
51.

In or around November 2017, Credico received a request from HP SCI to testify

voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.

a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, " ' Stonewall it. Plead the fifth . Anything to save the
plan' . .. Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.

Page 23 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 31 of 48

b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
committee lawyer told my lawyer that I will be getting a subpoena."

Stone

responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
c. On or about November 28, 2017, Credico received a subpoena compelling his
testimony before HPSCL Credico informed Stone of the subpoena.
d. According to emails recovered from Stone' s email account
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, "Are you sure you want to make something out of this now? Why
not wait to see what [Credico] does? You may be defending yourself too much raising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
let's hold a day."
e. According to text messages recovered from Stone's iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
II, who falsely claims not to know critical information before a congressional

committee that he does in fact know. On or about December 1, 2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information

Page 24 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 32 of 48

from investigators.
f.

On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool. " Later that day, Credico texted Stone, " You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you' re a fool. Because of tromp I could never get away with a certain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you' re stupid enough to testify." (A copy of these text
messages was recovered through a court-authorized search of Stone's iCloud
account).

52.

On or about December 12, 2017, Credico informed HP SCI that he intended to assert

his Fifth Amendment privilege against self-incrimination if required to appear by subpoena.
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
53.

Following Credico's invocation of his Fifth Amendment privilege not to testify

before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
to prevent Credico from cooperating with the investigations. For example:
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 .. . docs prove that ... You should be honest w fbi . . . there
was no back channel ... be honest." Stone replied approximately two minutes
later, "I'm not talking to the FBI and if your smart you won't either." (A copy of

Page 25 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 33 of 48

these text messages was recovered through a court-authorized search of Stone's
iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. You
are a stoolie. You backstab your friends- run your mouth my lawyers are dying
Rip you to shreds." Stone also said he would "take that dog away from you,"
referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
exchange was recovered through a court-authorized search of Stone's email
accoun

).

c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee . . . you've opened yourself up to
perjury charges like an idiot." Stone responded, " You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact the head of Assange]." (A
copy of this email exchange was recovered through a court-authorized search of
Stone's email accou

). Credico believed Stone knew that

Credico was sensitive to having this friend 's name publicly disclosed.
H. Missing Electronic Communications and Stone's Use of Encrypted Communications

54.

As described above, the government has recovered the content of many of Stone's

electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of

Page 26 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 34 of 48

numerous other relevant electronic communications, the content of which it has not yet been able
to recover.
55.

As described above, during his HPSCI testimony, Stone falsely denied having

emailed or exchanged text messages with his " intermediary" (later identified by Stone as Randy
Credico).

In fact, emails and text messages recovered in this investigation show the two

communicated frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI' s inquiry, but Stone
never disclosed them.
56.

In addition to these emails and text messages in the FBI's possession, the FBI has

reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017, and
they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI

Page 27 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 35 of 48

testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations. As discussed further below, the
government has reason to believe that these messages may be located on the Subject Devices.
57.

Additionally, the FBI has interviewed multiple associates of Stone, who confirmed

that Stone has used encrypted applications to communicate with others. Similarly, records
obtained in this investigation indicate Stone uses multiple applications designed for encrypted
communication, including (a) WhatsApp, 11 (b) Signal, 12 (c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.

11

According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device' s default message
application.
12

According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender' s and the receivers' devices.
13

According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
14

According to open sources, ProtonMail is an end-to-end encrypted email service that uses clientside encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.

Page 28 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 36 of 48

a. According to records from Stone' s iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an
email to

that they "talk on a secure line" and proposed using WhatsApp.

b. According to records from Stone's iCloud account, a copy of the Signal application
was downloaded to an iPhone registered to Stone on or about August 18, 2016.
Additionally, text messages recovered from Stone' s iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact
Julian Assange a link to download the Signal application. 15 Approximately fifteen
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
my number." The attorney responded, "I'll call you."
c. According to records from Stone's iCloud account, a copy of the ProtonMail
application was downloaded to an iPad registered to Stone on or about August 18,
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
was downloaded to an iPhone registered to Stone on or about August 5, 2017.
58.

Based on my training and experience, electronic communications using encrypted

applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,

15

This attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
Page 29 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 37 of 48

including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
communications, such as call logs and contact lists.
59.

The FBI continues to seek evidence of Stone's communications and contacts during

the period of the 2016 U.S. presidential election and through the present. The FBI believes these
communications may contain evidence of additional communications concerning Assange,
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such
communications could constitute additional evidence of Stone's efforts to obstruct HPSCI's
investigation by showing additional contacts and communications about Assange and WikiLeaks
that Stone failed to disclose.

I. The Subject Devices
60.

In or around November 2018, media reports began to publish excerpts of text

messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
of these text messages subsequently were obtained from Stone

). 16

According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements and described further below, your affiant believes the cell phone referenced in the
article to be the iPhone Ss. 17

16

See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/rogerstone-wikileaks-randy-credico-mueller.
a, Stone produced some text messages between Credico and
him; the latest-in-time text message produced by Stone occurred on or about November 14, 2016.
Page 30 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 38 of 48

61.

On or about February 11, 2019, investigators, with the consent of Roger Stone's

attorneys, spoke with

, a certified forensic examiner who stated he had been retained

by Roger Stone's attorneys.

had been authorized by Stone's attorneys to provide the

Subject Devices to the FBI, although in providing the devices, Stone did not consent to their search.
Stillman gave the Agents three devices: the iPhone 5s, the iPhone 7, and the external hard drive.
62.

produced documentation to investigators indicating that the iPhone 5s was

associated with the phone number ending in
The documentation also indicated that

Stone's cellular number as discussed above.
had imaged the iPhone 5s on or about November

10, 2018, several days before the article discussed above where Stone claimed to have released
newly-uncovered messages with Credico. Toll records produced by AT&T pursuant to subpoena
indicate that Stone used an iPhone 5s from at least on or about January 1, 20 15 through on or about
November 14, 2016.

Therefore, it appears that the iPhone 5s was the device Stone was using

through November 14, 2016 to communicate with individuals including Credico and Corsi.
63.

also produced documentation to investigators that the iPhone 7 he

provided to investigators was associated with the same Stone phone number ending in

. As

discussed above, toll records produced by AT&T pursuant to subpoena indicate that Stone used an
iPhone 7 from at least on or about November 14, 2016 through on or about February 25, 2018. As
described above, Stone communicated extensively with Credico during this time. Toll records
also indicate Stone continued to communicate with Corsi during this time period using the x3034
number.

The government believes copies of later-in-time text messages from late 2016 and early 2017 could
be located on another device, such as the iPhone 7, or on backup storage media.
Page 31 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 39 of 48

64.

further told investigators that the external hard drive contained forensic

images of Stone' s computers.

stated that the hard drive contained backups created by a

separate company in September 2017 from Stone' s computers in both Florida and New York.
the backups were created as "clone copies," which are copies of Stone' s

According to
computer systems.

also indicated that the drive contained a separate image

created in March 2018 of Stone' s computer in Florida, as well as backup images of the iPhones
discussed above. As explained further herein, there is reason to believe that these images contain
communications made by Stone with Credico, Corsi, and others made during the relevant time
period, even if such communications had previously been deleted.
COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS
65.

As described herein and in Attachment B, this application seeks permission to

search the Subject Devices. One form in which the records might be found is data stored on a
device 's hard drive. Thus, the warrants applied for would authorize the search of electronic storage
media.
66.

Probable cause. I submit that there is probable cause to believe those records will

be stored on the Subject Devices (the term "computer" below refers to Subject Devices), for at
least the following reasons:
a. Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person "deletes" a file on a

Page 32 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 40 of 48

computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data.
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer' s operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
c. Wholly apart from user-generated files, computer storage media- in particular,
computers' internal hard drives--contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file system
data structures, and virtual memory "swap" or paging files.

Computer users

typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or "cache."
67.

Forensic evidence. As further described in Attachment B, this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how computers
were used, the purpose of their use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence will be on the Subject Devices because:

Page 33 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 41 of 48

a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file) . Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active.

Web browsers, e-mail

programs, and chat programs store configuration information on the storage
medium that can reveal information such as online nicknames and passwords.
Operating systems can record additional information, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. As explained herein, information stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the criminal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent ·
from further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and
movies, transactional information, records of session times and durations, internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for " indicia of occupancy" while executing a
search warrant at a residence. The existence or absence of anti-virus, spyware, and

Page 34 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 42 of 48

malware detection programs may indicate whether the computer was remotely
accessed, thus inculpating or exculpating the computer owner. Further, computer
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains information that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
accessed networks and the internet.

Such information allows investigators to

understand the chronological context of computer or electronic storage media
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media ( e.g., a thumb drive).
The geographic and timeline information described herein may either inculpate or
exculpate the computer user. Last, information stored within a computer may
provide relevant insight into the computer user's state of mind as it relates to the
offense under investigation. For example, information within the computer may
indicate the owner's motive and intent to commit a crime (e.g., internet searches
indicating criminal planning), or consciousness of guilt (e.g., running a "wiping"

Page 35 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 43 of 48

program to destroy evidence on the computer or password protecting/encrypting
such evidence in an effort to conceal it from law enforcement).
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process. While it is possible to specify in advance
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
on a computer is evidence may depend on other information stored on the computer
and the application of knowledge about how a computer behaves. Therefore,
contextual information necessary to understand other evidence also falls within the
scope of the warrant.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular thing
is not present on a storage medium. For example, the presence or absence of
counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.

Page 36 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 44 of 48

FILTER REVIEW PROCEDURES
Review of the items described in Attachment B will be conducted pursuant to established
procedures designed to collect evidence in a manner consistent with professional responsibility
requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
team, in order to address potential privileges.
CONCLUSION

68.

Based on the foregoing, your affiant respectfully requests that this Court issue a

search warrant for the Subject Devices, more particularly described in Attachment A authorizing
the seizure of the items described in Attachment B.

Respectfully submitted,

~ ~ d e, 4 . / ~
Special Agent
Federal Bureau of Investigation

Sworn and subscribed before me on this / J ~ ay of February, 2019.

The Honorable Beryl A. Howell
Chief United States District Judge

Page 37 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 45 of 48

ATIACHMENTA
Property to be Searched
The following devices provided to the FBI by
Columbia:

Page 38 of 41

, currently in the District of

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 46 of 48

ATTACHMENT B
Items to be seized from the Subject Devices
The items to be seized are fruits, evidence, information relating to, contraband, or

1.

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section I 00 I (false statements); and (iii) Title 18,
United States Code 1512(b)(l) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a. Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S . presidential election;
b. Documents reflecting communications between Stone and Jerome Corsi;
c. Documents reflecting communications between Stone and Randy Credico;
d. Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump;
e. Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;
f.

Records and information relating to the e-mail accounts
and p

g. Records and information relating to the WhatsApp account associated with
telephone number

;

Page 39 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 47 of 48

h. Records and information relating to the Signal account associated with telephone
numbe
1.

Records and information relating to the Wickr account associated with telephone
numbe

J.

Any computers, media storage devices, tablets/iPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;

k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
reference materials, in whatever form ;

I.

Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form ;

2.

For all of the devices listed in Attachment A (hereinafter, "COMPUTER"):
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
entries, configuration files, saved usernames and passwords, documents, browsing
history, user profiles, email, email contacts, "chat," instant messaging logs,
photographs, and correspondence;
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 40 of 41

 Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 48 of 48

c. evidence of the lack of such malicious software;
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
under investigation and to the computer user;
e. evidence indicating the computer user's state of mind as it relates to the crime under
investigation;
f.

evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;

g. evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h. evidence of the times the COMPUTER was used;
1.

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.

documentation and manuals that may be necessary to access the COMPUTER or
to conduct a forensic examination of the COMPUTER;

k. records of or information about Internet Protocol addresses used by the
COMPUTER;
l.

records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;

m. contextual information necessary to understand the evidence described in this
attachment.

Page 41 of 41

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 1 of 56

AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of New York
In the Matter of the Search of
(Briefly describe the property to be searched
or identify theperson by name and address)

the Premises Known and Described as

].~MAG847

)
)
)
)
)
)

Case No.

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Southern
District of
New York
(identify the person or describe the property to be searched and give its location):

See Attachment A
The person or property to be searched, described above, is believed to conceal (identify the person or describe the property
to be seized):

See Attachment A
The search and seizure are related to violation(s) of (insert statuto,y citations):

18 U.S.C. §§ 1001, 1505, 1512(b)(1)
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
·
February 6, 2019
YOU ARE COMMANDED to execute this warrant on or before
(not to exceed 14 days)

~ in the daytime 6:00 a.m. to 10 p.m.

0 at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the wmrnnt and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or l ei3-VC tpfcopy.a~d receipt at the
place where the property was taken.
. . : , , · . 1 • '. . . • , · •
1

.

.

.

The officer executing this warrant, or an officer present during the exeeu.tion.o(the warrant, rfmst prepare an
invento;y as required by law and promptly return this warrant and inventory t.ci..· the .Cf~rk ofth~ Cou.rt. _A,1
./'Upon its return, this warrant and inventory sho11ld be filed under seal by the ;Clerk of the Court~'~
...,_/·_::._-_-_-_:-_:-&SM.f Initials

0 I find that immediate notification may have an adverse result listed in 18,HS·'.C. § 2705 (except :for delay
of trial), and authorize the officer executing this warrant to delay notice to the p'ers9ri \\'.hO,: or whose prop(;)rty, will be
searched or seized (check the appropriate box) Ofor
days (not to exceed 30).
· ' '
,
·
·

I

J

Ountil, the facts justifying, the later specific. •dat,e:
Date and time issued:
City and state:

I

\

of, ·,

-------

/ -l-+l//Jo~·
I '-1- - 19~L~·:
0/.~
/LA
~
-_
'--1-"IIJ-'
~- a,1>-J,_ _ _ _
_
___
_
-/

7

New York, NY

-----------

Judge 's signature

Hon. Robert W. Lehrburger
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 2 of 56

AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant
to the Court.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 3 of 56

ATTACHMENT A

I. Premises to be Searched - Subject Premises

The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described as

II. Items to Be Seized
A.

Evidence, Fruits, and Instrumentalities of the Subject Offenses

The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WildLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;

1

 .

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 4 of 56

c. Documents that reflect communications between Roger Stone and Jerome Corsi
that concern the Subject Offenses;
d. Documents reflecting communications between Roger Stone and Randy Credico
that concern the Subject Offenses;
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
f.

Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;

g. Records and information relating to the use, ownership, or control of e-mail
accounts

;

h. Records and information demonstrating who uses, owns, or controls the WhatsApp
account associated with telephone numbe
1.

Records and information demonstrating who uses, owns, or controls the Signal
account associated with telephone number

J.

;

;

Records and information demonstrating who uses, owns, or controls the Wickr
account associated with telephone numbe

;

k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 5 of 56

1.

Computers and media storage devices, including tablets/iPads, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form; and

m. Cellular telephones, smartphones, or personal data assistant devices, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, _diaries, and reference materials, in whatever
form.

B.

Search and Seizure of Electronically Stored Information

The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1.
Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2.
Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3.
Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.

3

 I

P

\.

'I

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 6 of 56

In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
•

surveying various file "directories" and the individual files they contain (analogous to
looldng at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

opening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;

•

scanning storage areas to discover and possibly recover recently deleted files or
.deliberately hidden files;

•

performing key word searches through all electronic storage areas to determine whether
occuITences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and

•

reviewing metadata, system inf01mation, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.

Law enforcement personnel will make reasonable effo1is to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.

4

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 7 of 56
AO 106 (SDNY Rev. 01/17) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of New York
In the Matter of the Search of

)
)
)
)
)
)

(Briefly describe the property to be searched
or identify the person by name and address)

See Attachment A

7

CaseNl 9

APPLICATION FOR A SEARCH AND SEIZURE WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

the Premises Known and Described as
located in the

Southern

--------

District of

New York

, there is now concealed (identify the

------------

person or describe the property to be seized):

See Attached Affidavit and its Attachment A

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~vidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
~roperty designed for use, intended for use, or used in committing a crime;
0 a person to be· arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section(s)

Offense Description(s)

18 U.S.C. §§ 1001, 1505, .False statements, witness tampering, obstruction of proceedings
before departments, agencies, and committees
1512(b)(1)
The application is based on these facts:
See Attached Affidavit and its Attachment A

i'lf Continued on the attached sheet.
0 Delayed notice of

EZ.

days (give exact ending date if more than 30 days:

under I 8 U.S.C. § 3103a, the basis of which is set forth

~ C / } 1 f . 's.,
) '.

,(

) is requested

s/gl1ati~re

/ '\ i 11:' '·

'11 ''}

(

., '$A rylic~ei_
J,
'Robi1?Js0h ~ - - - - - -------,,--.,, )
! ,, .
-\......--.---,
0

Sworn to before me and signed in my presence.
Date:

J~r/;/J/2
I
-------------

Prinzed ,iame
and titleI
'

f

JI!

'

,

I

,

J

'

\

;."'J
• I./;;

I

'

'

'

.

'

I'

.Yi;'i '.-r'~..--·--···,··
..I

,··,

. /'

*'~/\LY<

I..

J

!

\

I

•

I

•

r

,

,

~

/I
·,, '
- - - - - ~ - ~ - ' , , ·~--.-;..,--'+'~

)
·-'------

' .. ' J~dge 's sig,!atuta '
.

City and state: New York, NY

'·

.I

I

I

)

j

'

·,\

'

_______H_o_·n~.·'1-~obert
+yy. 'p&_h.,..,tb_8_r~g_er_ _~ - - Prihted,11'nne al,dtitle

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 8 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF NEW YORK

----------------------------------------------------------------,
''
In the Matter of the Application of the United
States Of America for a Search and Seizure
Warrant for the Premises Known and Described
a

TO BE FILED UNDER SEAL

Agent Affidavit in Support of
Application for Search and Seizure
Warrant

-----------J'

SOUTHERN DISTRICT OF NEW YORK:
Mickey J. Robinson, being duly sworn, deposes says:

I.

Introduction
A.

Affiant

1.

I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have

been since September 2012. I successfully completed New Agent Training at Quantico, Virginia,
where I received extensive instruction on criminal investigations.
2.

I make this affidavit in support of an application pursuant to Rule 41 of the Federal

Rules of Criminal Procedure for a warrant to search the premises specified below (the "Subject
Premises") for, and to seize, the items and informatiQn described in Attachment A. This affidavit
is based upon my personal knowledge; my review of documents and other evidence; my
conversations with other law enforcement personnel; and my training, experience and advice
received concerning the use of computers in criminal activity and the forensic analysis of
electronically stored information ("ESI"). Because this affidavit is being submitted for the limited
purpose of establishing probable cause, it does not include all the facts that I have learned during
the course of my investigation. Where the contents of documents and the actions, statements, and
conversations of others are reported herein, they are reported in substance and in part, except where
otherwise indicated.

1

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 9 of 56

B.

The Subject Premises

3.

The Subject Premises are particularly described as

C.

The Subject Offenses

4.

For the reasons detailed below, I believe that there is probable cause to believe that

the Subject Premises contain evidence, fmits, and instrumentalities of violations of (i) Title 18,
United States Code, Section 1505 (obstruction of proceedings before departments, agencies, and
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code, Section l 512(b)(1) (witness tampering); (collectively the "Subject Offenses").

II.

Probable Cause
A.

Probable Cause Regarding Commission of the Subject Offenses

5.

I have personally participated in this investigation and am aware of the facts

contained herein based on my own investigation, as well as my review of documents, records, and
information provided to me by other law enforcement officers and technical experts.
6.

This affidavit is intended to show merely that there is sufficient probable cause for

the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I asse1i that an event took place on a particular date, I am asserting that it took
place on or about the date specified.

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 10 of 56

7.

For the reasons set forth in this Affidavit, there is probable cause to believe that one

or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., ("Roger Stone")
and others known and unknown to the government. Further, there is probable cause to believe the
Subject Premises have been used to facilitate the commission of one or more of the Subject
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises.
Background on Relevant Individuals
8.

Based on publicly available information and information obtained m the

investigation, I know the following:
a. Roger Stone is a political consultant who has worked for decades in U.S. politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential
campaign of Donald J. Trump ("Trump Campaign") until in or around August
2015, and subsequently maintained regular contact with and publicly supported the
Trump Campaign through the 2016 election.
b. Julian Assange is the founder and director of 'YikiLeaks, which is publicly
described as a non-profit organization that disseminates non-public information and
classified media provided by anonymized sources. WikiLeaks has posted numerous
documents stolen from the U.S. government. At all relevant times, Assange was
located at the Ecuadorian Embassy in London, United Kingdom.
c. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi
spoke regularly with Stone throughout the campaign, including about the release of
stolen documents by WikiLeaks.

3

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 11 of 56

e. ,Randy Credico was a radio host who has lmown Stone for more than a decade. In
testimony before U.S. House of Representatives Permanent Select Committee on
Intelligence ("HPSCI") on or about September 26, 2017, Stone described Credico
(without naming him) as an "intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr.
Stone" that Assange, had "' [e] mails related to Hillary Clinton which are pending
publication.'"
f.

Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November
2016, Gates served as the deputy campaign chairman of the Trump Campaign. On
February 23, 2018, Gates pled guilty to one count of conspiracy against the United
States and one count of making false statements to federal law enforcement officers.

United States v. Gates, l: 17-cr-201 (D.D.C.).
g. Stephen K. Bannon is a U.S. citizen who serves as a political consultant. Beginning
in or around August 2016 and through the 2016 U.S. presidential election, Bannon
served as the chief executive officer of the Trump Campaign.

4

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 12 of 56

Hacking Activity During the 2016 Presidential Election
9.

John Podesta is a U.S. citizen who served for years as a political consultant. During

the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation through which an actor would have gained access to Podesta' s email
account allowing the actor to steal emails and documents from that account.
10.

The Democratic National Committee ("DNC") and Democratic Congressional

Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity ·
company CrowdStrike to investigate the intrusions and remediate.

1

In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known ot trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicldng a malicious link or URL.
5

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 13 of 56

11.

On or about June 14, 2016, CrowdStrike issued a public press release announcing

that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bJoth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
12.

On or about July 13, 2018, a federal grand jury sitting in the District of Columbia

returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, l:18-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
13.

As alleged in the Netyksho indictment, after successfully hacking the DNC and

DCCC networks, as well as Podesta' s email account, GRU officers transmitted some of the stolen
documents to WikiLeaks.

GRU officers communicated with WikiLeaks members about the

transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
14.

On or about July 22, 2016, WildLeaks released tens of thousands of documents

stolen from the DNC network. These stolen documents included communications by senior DNC

6

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 14 of 56

officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
15.

Beginning in or around October 2016, WikiLeaks began to release tens of

thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from. John Podesta, releasing a total of over 50,000 stolen
documents.
Stone's Communications About WikiLeaks During the Campaign
f

16.

In April 2018 interviews with the Special Counsel's Office, Gates stated that

starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
WildLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed
WikiLeaks and Stone's prediction of the release.
17.

According to Gates, Manafort directed Gates to contact Stone about any additional

releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel's Office in or
around October 2018, Gates recalled that at one point during the campaign he was with thencandidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.

7

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 15 of 56

18.

Emails recovered through a court-authorized search of Stone's email account
2

show that shortly after the July 22, 2016 releas~ of stolen DNC emails

by WikiLeak:s, Stone coffesponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a. On or about July 25, 20~6, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to

who lived in the United Kingdom and was a supporter of

the Trump Campaign.
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that

"should see Assange."

c. On or about August 2, 2016, Corsi emailed Stone and wrote that he was cuffently
in Europe and planned to retum in mid-August. Corsi stated, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging." In a law enforcement interview, Corsi stated that
the phrase "friend in embassy" refeffed to Assange. Corsi added in the same email,
"Time to let more than Podesta to be exposed as in bed w enemy if they are not

2

A search of
was authorized on or about September 11, 2017 by the U.S.
District Cour
umbia. Case No. 1:l 7-mj-661 (D.D.C. Sept. 11, 2017). A
second search o
was authorized on or about August 3, 2018 by the U.S.
District Court fo
a. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 27 03 (d) for records connected to
Case No. 1:18-sc-2911 (D .D. C. Sept.
26, 2018). Records provided in r
rporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
8

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 16 of 56

ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
19.

According to recorded public statements recovered by the FBI, starting in early

August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a. According to a public video posted to YouTube, on or about August 8, 2016, Stone
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
During the interview, Stone stated that he was "in communication with Assange"
but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communication with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN teleyision interview on or about August 18, 2016, Stone stated that he

9

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 17 of 56

had communicated with Assange through an "intermediary, somebody who is a
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
or have influence with Assange because I do not. . . . We have a mutual friend,
somebody we both trust and therefore I am a recipient of pretty good information."
20.

In or around November 2018

, Stone

produced a series of text messages between Stone and Credico during the 2016 presidential
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeak~ and Assange planned to
do.

Emails recovered through a court-authorized search of Stone's email account
show additional written communications between Stone and Credico

about WikiLeaks in or around September 2016.
a. On or about August 19, 2016, Credico sent a text message to Stone that read in part,
"I'm going to have Julian Assange on my show next Thursday." On or about
August 21, 2016, Credico sent another text message to Stone, writing in part, "I
have Julian Assange on Thursday so I'm completely tied up on that day."

3

As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
10

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 18 of 56

b. On or about August 25, 2016, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Julian Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
am e-mailing u a request to pass on to assange." Credico responded "Ok," and
added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e. Later on or about September 18, 2016, Stone emailed Credico an article with
allegations against then-candidate Clinton related to her service as Secretary of
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
article] or confinn this narrative."
f.

On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.

11

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 19 of 56

g. On or about September 30, 2016, Credico sent Stone via text message a photograph
of Credico standing outside the Ecuadorian Embassy in London where Assange
was located.
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
press had reported that Assange planned to make a public announcement on or
about Tuesday, October 4, 2016, which was rep01ied to be the 10-year anniversary
of the founding ofWikiLeaks.
1.

On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
and a link to an article at the website http://heatst.com/politics/october-surprisethwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-tosecurity-concerns. Credico responded to Stone, "head fake."

J.

On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it['Js on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
this line ... Please leave my name out of it."

21.

Emails and text messages recovered by the FBI show that, in or around October

2016, Stone made statements about Assange's future releases, including statements that were
similar to statement that Credico made to him. For example:

12

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 20 of 56

a. In a court-authorized search of Stone's email accoun

the

sent on or about October 3, 2016,

FBI recovered an email from Stone t

which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
b. In a comi-authorized search o

, the FBI also recovered an

email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Steve Bannon.

In the exchange, the reporter asked,

"Assange - what's he got? Hope it's good." Stone responded, "It is. I'd tell
Bannon but he doesn't call me back."
c. On or about October 4, 2016, Assange held a press conference but did not release
any new materials pertaining to the Clinton Campaign. In a court-authorized search
o

the FBI recovered an email exchange between Stone and

Bannon on or about October 4, 2016 that occurred after the press conference. In
the exchange, Bannon asked, "What was that this morning???," referring to
Assange's press conference. Stone responded, "Fear. Serious security concern. He
thinks they are going to kill him and the London police are standing do[wn].
However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account, 5 the FBI recovered text
messages between Stone and

from on or about October 4, 2016. In one text

4

A search of
was authorized on or about October 17, 2017 by the U.S.
District Court
umbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
was authorized on or about August 3, 2018 by the U.S.
second search of
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018).
5

A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Comi for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). · The
13

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 21 of 56

message,

asked Stone if he had "hear[d] anymore from London." Stone

replied, "Yes -want to talk on a secure line- got Whatsapp." In an interview with
the Special Counsel's Office in or around May 2018,

confirmed that he and

Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
22.

On or about October 7, 2016, WikiLeaks released the first set of emails stolen from

Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read, "well done." Similarly,
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
Stone said, "I told you this was coming."
Stone's Communications with the House Permanent Select Committee on Intelligence
23.

On or about January 25, 2017, HPSCI publicly disclosed that it was investigating

allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HP SCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (paiiicularly those from August 2016)
were of interest to the committee.

records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
6

On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.
14

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 22 of 56

24.

In or around May 2017, HP SCI ~ent a letter requesting that Stone voluntarily appear

before the committee and produce relevant documents to HP SCI (a copy of the HPSCI letter was
recovered by the FBI from a court-authorized search of Stone's email account
). The letter requested Stone produce:
Any documents, records, electronically stored information
including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's publiclyannounced parameters.
25.

On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and .

stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone's email accoun

).

Stone's Testimony Before HPSCI
26.

On or about September 26, 2017, Stone provided HPSCI with an "opening

statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is

7

On or about December 14, 2018, the U.S. Depaiiment of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Depaiiment of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members ofHPSCI.
15

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 23 of 56

responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
27.

Also on or about September 26, 2017, Stone provided testimony in a closed session

before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Department of Justice from HPSCI in or around
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearin~, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
Stone's Testimony About Documents He Possessed Related to WikiLeaks
28.

During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document

request and whether Stone had any documents or written communications that discussed Julian
Assange, Russian interference,_ or other relevant documents:

Q:

The committee wrote to you on May 9th requesting no later
than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no documents,
records, or electronically stored information regardless of
form responsive to our requests. Was that a false statement?

A:

That is not a false statement. That's what -- I believe that to
be true.

[...]
Q:

So you have no emails to anyone concerning the allegations
of hacked documents or your conversations with the
Guccifer 2[.0J or any discussions you have had with third
parties about Julian Assange? You have no emails, no texts,
no documents whatsoever, any kind of that nature?

16

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 24 of 56

29.

A:

That is correct. Not· to my knowledge. I think we met, again,
the precise criteria of your request, and we complied. Again,
if you have a more specific request, I'm happy to go back and
look. ...

Q:

I just want to ask you under oath -

A:

We did an extensive search consistent with the direction of
my attorneys, and we found nothing that met the criteria that
you asked for.

Q:

I just want to be certain because you are under oath, where
your letter was not under oath, that you have no documents,
no emails, no texts, no tweets that refer to Julian Assange or
Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've written
no documents yourself.

A:

In connection with Russian collusion, consistent with your
exact and precise request, yes.

In fact, and as described above, Stone had sent and received numerous emails and

text messages during the 2016 campaign in which he discussed WildLeaks, Assange, and
WildLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
(including

) and his iCloud account show that,

at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017. 8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016, that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WildLeaks emails . . . they deal with

8

The warrant for Stone's email account
was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to acourtorderissued pursuant to 18 U.S.C. § 2703(d) confrrmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account
was obtained on or about October 17, 2017 and executed
shortly thereaf
tone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
17

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 25 of 56

Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that

"should

see Assange"; (c) Corsi' s email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to

on or about October 3, 2016

that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
load every week going forward."
Stone's TestimonyAbout His Early August 2016 Statements
30.

During his HPSCI testimony on or about September 26, 2017, Stone was asked to

explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at libe1iy to discuss what I have."
31.

Stone testified that these public references to having a means of contacting

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentlem:an who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
32.

In fact, documents recovered during the investigation

18

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 26 of 56

a) show that Stone did not begin communicating
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9-approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after to his August 12, 2016 statements of being "in communication
with Assange" and "not at liberty to discuss what I have."
33.

When interviewed by the FBI, Credico stated that the first time he ever spoke with

°

Assange was on or about August 25, 2016, when ~redico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between lie and another
member of WildLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
info1mation about himself, apparently as a means of introduction.
34.

The FBI has not identified any communications between Stone and Credico from

August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
35.

In contrast, and as described above, the FBI has identified written communications

prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WildLeaks emails ... they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico-sent an email to Stone in which Corsi

9

As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."

°

1

Credico was first interviewed by the FBI in or around August 2018. He has subsequently
paiiicipated in multiple voluntary interviews.

19

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 27 of 56

wrote that "[w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other
source for information from WikiLeaks. Stone also.never disclosed his written communications
with Corsi to HPSCI when answering HPSCI's questioning about the August 8, 2016_ and August
12, 2016 statements about being in communication with Assange.
Stone 's Testimony About Communications to Assange

36.

During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to

communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
37.

In fact, starting on or.about September 18, 2016, Stone directed Credico to pass on

a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages

, on or about

September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
u a request to pass on to Assange." On or about the same day, Stone emailed
Credico an article with allegations against then-candidate Clinton related to her
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
was obtained through a search of Stone's email account

20

).

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 28 of 56

b. According to text messages

, on or about

September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Assange." Credico responded, "I did." An email obtained from the account
shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.
Stone's Testimony About Written Communications with Credico

38.

During his HPSCI testimony, Stone was asked repeatedly about· his

communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intermediary telephonically:
Q:

[H]ow did you communicate the intermediary?

A:

Over the phone.

Q:

And did you have any other means of communicating with
the intermediary?

A:

No.

Q:

No text messages, no-none of the list, right?

A:

No.

Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
Q:

So you never communicated with your intermediary in
writing in any way?

A:

No.

Q:

Never emailed him or texted him?

A:

He's not an email guy.

21

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 29 of 56

39.

Q:

So all your conversations with him were in person or over
the phone.

A:

Correct.

As described above, Stone and Credico (who Stone identified as his intermediary)

engaged in :frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
engaged in dozens of communications by email or text message in which they discussed
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
40.

Written communications between Stone and Credico continued up until Stone's

HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HP SCI and denied having ever sent or received emails or text messages :from
his identified intermediary, Stone and Credico exchanged over thirty text messages.
41.

Certain of the electronic messages between Stone and Credico (which Stone denied

ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or a!ound September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HP SCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you[] said you have a back-channel way back a month before I had Assange on
my show . . . I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together ... so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this email was obtained through.
a search of Stone's email account

.

22

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 30 of 56

Stone 's Testimony About Communications with the Trump Campaign
42.

During his HPSCI testimony, Stone was asked, "[d]id you discuss your

conversations with the inteimediary with anyone involved in the Trump campaign?"

Stone

answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:
a. As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials to infmm them about materials possessed by Assange
and the timing of future releases.
b.

, on or about October
3, 2016, Stone wrote to

, "Spoke to my friend in London last night. The

payload is still coming."
c.

As described above, on or about October 4, 2016, after receiving information from
Credi co about the delay in WikiLeaks' s release of stolen materials, Stone emailed
Bannon that Assange had a "[sJerious security concern" but would release "a load
every week going forward."

Stone's Attempts to Influence Credico RegardingHPSCI and the FBI
4 3.
account

According to an email recovered through a court-authorized search of Stone's email
on or about October 19, 2017, Stone sent Credico an excerpt of

his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HP SCI, but Stone did not do so. Stone then engaged in a prolonged
effort to prevent Credico from contradicting Stone's false statements to HPSCI.

23

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 31 of 56

44.

In or around November 2017, Credico received a request from HPSCI to testify

voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.

a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, "' Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
committee lawyer told my lawyer that I will be getting a subpoena."

Stone

responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
c. On or about November 28, 2017, ,Credico received a subpoena compelling his
testimony before HPSCI. Credico informed Stone of the subpoena.
d. According to emails recovered from Stone's email accoun
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, ''Are you sure you want to make something out of this now? Why

24

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 32 of 56

not wait to see what [Credico] does? You may be defending yourself too muchraising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
let's hold a day."
e. According to text messages recovered from Stone's iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
11, who falsely claims not to lmow critical information before a congressional

committee that he does in fact lmow. On or about December 1, 2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information
from investigators.
f.

On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you're a fool. Because of tromp I could never get away with a ce1iain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you're stupid enough to testify." (A copy of these text
messages was recovered through a court-authorized search of Stone's iCloud
account).

45.

On or about December 12, 2017, Credico informed HPS CI that he intended to assert

his Fifth Amendment privilege against self-incrimination if required to appear by subpoena.

25

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 33 of 56

According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
46.

Following Credico's invocation of his Fifth Amendment privilege not to testify

before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made statements intended to prevent
Credico from cooperating with the investigations. For example:
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi . . .
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
copy of these text messages was recovered through a court-authorized search of
I

Stone's iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip you
to shreds." Stone also said he would "take that dog away from you," referring to
Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready.
Let's get it on. Prepare to die [expletive]." (A copy ofthis email exchange was
recovered through a court-authorized search of Stone's email account
).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
pe1jury charges like an idiot." Stone responded, "You are so full of [expletive].

26

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 34 of 56

You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact Assange]." (A copy of this
email exchange was recovered through a court-authorized search of Stone's email
accoun

). Credico believed Stone knew that Credico was

sensitive to having this friend's name publicly disclosed.
Missing Electronic Communications and Stone's Use of Encrypted Communications
47.

As described above, the government has recovered the content of many of Stone's

electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
numerous other relevant electronic communications that it has not yet been able to recover the
content.
48.

As described above, during his HPSCI testimony, Stone falsely denied having

emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico).

In fact, emails and text messages recovered in this investigation show the two

communicated :frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone
never disclosed them.
49.

In addition to these emails and text messages in the FBI's possession, the FBI has

reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017 and

27

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 35 of 56

they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
;

for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations.
50.

Additionally, the FBI has interviewed multiple associates of Stone, who confirmed

that Stone has used encrypted applications to communicate with others.

Similarly, records

obtained in this investigation indicate Stone uses multiple applications designed for encrypted

28

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 36 of 56

communic~tion, including (a) WhatsApp, 11 (b) Signal, 12 ( c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
a. According to records from Stone's iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an
email to

that they "talk on a secure line" and proposed using WhatsApp.

b. According to records from Stone's iCloud account, a copy of the Signal application
was downloaded to an iPhone registered to Stone on or about August 18, 2016.
Additionally, text messages recovered from Stone's iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact

11

According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default message
application.
12

According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender's and the receivers' devices.
13

According to open sources, Wicla is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmi_tted through the network.
14

According to open sources, ProtonMail is an end-to-end encrypted email service that uses clientside encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
29

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 37 of 56

Julian Assange a link to download the Signal application. 15 Approximately fifteen
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
my number." The attorney responded, "I'll call you."
c. According to records from Stone's iCloud account, a copy of the ProtonMail
application was downloaded to an iPad registered to Stone on or about August 18,
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
was downloaded to an iPhone registered to Stone on or about August 5, 2017.
51.

Based on my training and experience, electronic communications using encrypted

applications such as WhatsApp, Signal, ProtonMail, and Wicla are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
communications, such as call logs and contact lists.
52.

The FBI continues to seek evidence of Stone's communications and contacts dming

the period of the 2016 U.S. presidential election and through the present. The FBI believes these
communications may contain evidence of additional communications concerning Assange,
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign.

15

Such

This attorney was a close friend of Credico' s and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
·30

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 38 of 56

communications could constitute additional evidence of Stone's efforts to obstruct HPSCI's
investigation by showing additional contacts and communications about Assange and WikiLeaks
that Stone failed to disclose.
Other Relevant Communications
53.
conducted.

On May 8, 2018, a law enforcement interview o

was

was an employee of Stone's from approximately June 2016 through

approximately December 2016 and resided in Stone's previous New York apartment for a period
of time.

provided information technology support for Stone, but was not f01mally trained to

do so.

was aware that Stone communicated with Trump during the 2016 presidential

campaign, and afterward, both in person and by telephone.
meeting at Trump Tower between Trump and Stone during the time
Sterne carried a "file booklet" with him. Stone tol
no one should touch it.
54.

provided information about c\.
worked for him, to which

the file booklet was important and that

also said Stone maintained the file booklet in his closet.

On December 3, 2018, law enforcement conducted an interview of an individual

("Person 1") who previously had a professional relationship with a reporter who provided Person

1 with info1mation about Stone. The reporter relayed to Person 1 that in or around January and
February 2016, Stone and Trump were in constant communication and that Stone kept
contemporaneous notes of the conversations. Stone's purpose in keeping notes was to later provide
a "post mortem of what went wrong."

31

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 39 of 56

B.

Probable Cause Justifying Search of the Subject Premises

55.

Your affiant is aware through the investigation that Stone maintains the Subject

Premises as his secondary residence. 16 Associates of Stone's have confirmed that Stone maintains
the Subject Premises as his residence when he visits New York, New York. 17
56.

Billing records provided by Charter Com.munications
determined that the subscriber of services at the Subject Premises i

In a law enforcement interview,

stated he worked as Stone's assistant. The interview of

in addition to a review of public source records, determined
Your affiant believes

lives in Florida.

established the Charter Com.munications account at the Subject

Premises on behalf of Stone.

58.

Stone participated in an on camera interview that was aired on or about November

2018 at the Subject Prem.ises 18 . Your affiant observed an Apple MacBook Pro computer and an
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the
apartment building that houses the Subject Premises.

16

Stone's primary residence is

17

Public real estate listing indicates the Subject Premises has been listed since December 5, 2018
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing
stated it was not available for viewing until February 1, 2019 because it was still occupied by the
tenant.
18
https://www.washingtonpost.com./p~litics/2018/11/08/roger-stone-has-rule-deny-everythinghe-does/?utm. term=.5ab41ac5df22
32

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 40 of 56

59.

A review of records produced by Uber Technologies, Inc.,
determined that on or about December 2018, the user of the account associated with

Stone's telephone number and email address used Uber services at addresses at or close to the
Subject Premises. Your affiant is aware that users of Uber's services do not always use their
precise address when arranging for transportation, and believes the addresses close to the Subject
Premises are consistent with an individual whose destination is the Subject Premises.
60.

Based on law enforcement interviews, your affiant is aware that Stone has used and

uses cellular telephones, desktop, and laptop computers to conduct electronic communications.
Stone also configures his computers to create regulars backups of his computers and maintains one
of these devices at the Subject Premises, which preserves documents and communications.
61.

In or around May 2018, the FBI interviewed an individual ("Person 2") who

provided information technology services to Stone. According to Person 2, Stone maintains at
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
computer at one point in time.

Person 2 revealed billing receipts

and invoices issued to Nydia Bertran-Stone for information technology ("IT") services dated
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for
IT services in connection with three different Apple computers. Specifically, the billing receipts
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name
"Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number D25TC077GQ17) configured
with the name "Stone-Roger-iMac-NYC"; and (3) an Apple MacBookPro 10 (serial number
C02KL05EFFT4) configured with the name "Stone-Nydia-MBPR."

According to publicly

available information, the iMac is one of Apple's desktop models (i.e., a computer designed to be
stationary).

The naming convention of the computer "Stone-Roger-iMac-NYC" therefore

33

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 41 of 56

suggests it is a stationary computer used by Stone and located at the Subject Premises. 19 According
to the billing records, Person 2 was requested to perfo1m remote support services on or about
March 21, 2018 on the computer named "Stone-Roger-iMac-NYC."
62.

In the aforementioned Washington Post interview of Stone, at least two electronic

devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop
computer.
63.

Person 2 also told law enforcement that Stone used the Apple Time Machine

("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences. According to publicly available information,
Time Machine is the built-in backup feature of Apple computers and can create copies of files on
a computer, including applications, music, photos, email, documents, and system files. A Time
Machine backup allows users to restore files from a specific point in time if the original files are
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time
Machine, a user connects an external storage device to the computer and selects that external
storage device as the backup disk. 20
64.

Records produced by AT&T

show that, since

2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone
number (ending in

According to AT&T, as of January 1, 2015 through approximately

November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s

19

According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
20

When the external is plugged in, 'the Time Machine will automatically make hourly backups for
the past 24 hours, daily backups for the past month, and weekly backups for all previous months.
The oldest backups are deleted when the external storage device selected as the backup disk is full.
The external device can be as small as a USB thumb drive.
34

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 42 of 56

("iPhone 5s") (IMSI 310410657061814). On or about November 14, 2016, Stone's cellular
telephone number was transferred to an Apple iPhone model 7 ("iPhone T') (IMSI
310410930460769).

On or about September 28, 2018, Stone's cellular telephone number was

transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814).
65.

Records produced by Uber Technologies, Inc.,

show that the account associated with Stone's telephone number and email address has the Uber
~pplic_~ti(?ll on multiple d~vic~s~ including a_device ide1!-tified as iPha.nel 1/, UDID - 668EDC?629BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier
"iPhonell,2" con-elates to an Apple iPhone model XS. Additionally, the subpoena returns
identified

a

device

identified

as

iPhone9,4,

UDID

-

716JCF59-6Fl0-41C8-984B-

DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 correlates
to an Apple iPhone model iPhone 7 Plus.

35

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 43 of 56

67.

Statements attributed to Stone in recent media articles also indicate that Stone

retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media repo1is began to publish excerpts of text
messages between Stone and Randy Credico that occuned during the 2016 U.S. election (copies
o_f these tex_t 11?-~s.s~ges su~sequ~11tly ~~re obtained from Sto!_l~

23

).

According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements, your affiant believes the cellular telephone referenced in the article to be the
iPhone 5s documented in the aforementioned AT&T records (which records indicate he stopped
using on or about November 14, 2016).24 Further, your affiant believes Stone maintains other
devices he is no longer actively using.

C.

Probable Cause Justifying Search of ESI

68.

I submit that if a computer or storage medium is found on the Subject Premises,

there is probable cause to believe those records will be stored on that computer or storage medium,
for at least the following reasons:

See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/rogerstone-wildleaks-randy-credico-mueller.
23

Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occuned on or about November 14,
201 6. The government believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.

24

36

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 44 of 56

a. Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person "deletes" a file on a
computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data.
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer's operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
c. Wholly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file system
data structures, and viliual memory "swap" or paging files.

Computer users

typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or "cache."

37

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 45 of 56

69.

As further described in Attachment A, this application seeks permission to locate

not only computer files that might serve as direct evidence of the crimes described on the warrant,
but also for forensic electronic evidence that establishes how computers were used, the purpose of
their use, who used them, and when. There is probable cause to believe that this forensic electronic
evidence will be on any storage medium in the Subject Premises because:
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or. of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active.

Web browsers, e-mail

programs, and chat programs store configuration information on the storage
medium that can reveal inf01mation such as online nicknames and passwords.
Operating systems can record additional info1mation, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. As explained herein, info1mation stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the crilninal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent
from further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and

38

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 46 of 56

movies, transactional information, records of session times and durations, internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a
search wanant at a residence. The existence or absence of anti-virus, spyware, and
malware detection programs may indicate whether the computer was remotely
accessed, thus inculpating or exculpating the computer owner. Further, computer
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains infmmation that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
accessed networks and the internet.

Such information allows investigators to

understand the chronological context of computer or electronic storage media
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media (e.g., a digital camera
or cellular phone with an incorporated camera).

39

The geographic and timeline

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 47 of 56

information described herein may either inculpate or exculpate the computer user.
Last, information stored within a computer may provide relevant insight into the
computer user's state of mind as it relates to the offense under investigation. For
example, information within the computer may indicate the owner's motive and
intent to commit a crime (e.g., internet searches indicating criminal planning), or
consciousness of guilt (e.g., running a "wiping" program to destroy evidence on the
computer or password protecting/encrypting such evidence in an effort to conceal
it from law enforcement).
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process. While it is possible to specify in advance
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
on a computer is evidence may depend on other inf01mation stored on the computer
and the application of knowledge about how a computer behaves. Therefore,
contextual information necessary to understand other evidence also falls within the
scope of the warrant.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a paiiicular thing·
is not present on a storage medium. For example, the presence or absence of

40

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 48 of 56

counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.

III.

Procedures for Searching ESI
A.

Execution of Warrant for ESI

70.

Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search

for and seize property "may authorize the seizure of electronic storage media or the seizure or
copying of electronically stored information ... for later review." Consistent with Rule 41, this
application requests authorization to seize any computer devices and storage media and transport
them to an appropriate law enforcement facility for review. This is typically necessary for a number
of reasons:
•

First, the volume of data on computer devices and storage media is often impractical
for law enforcement personnel to review in its entirety at the search location.

•

Second, because computer data is particularly vulnerable to inadvertent or intentional
modification or destruction, computer devices are ideally examined in a controlled
environment, such as a law enforcement laboratory, where trained personnel, using
specialized software, can make a forensic copy of the storage media that can be
subsequently reviewed in a manner that does not change the underlying data.

•

Third, there are so many types of computer hardware and software in use today that it
can be impossible to bring to the search site all of the necessary technical manuals and
specialized personnel and equipment potentially required to safely access the
underlying computer data.

•

Fourth, many factors can complicate and prolong recovery of data from a computer
device, including the increasingly common use of passwords, encryption, or other
features.or configurations designed to protect or conceal data on the computer, which
often take considerable time and resources for forensic personnel to detect and resolve.

71.

In most cases, a thorough search of a premises for information that might be stored

on storage media often requires the seizure of the physical storage media and later off-site review
consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a
41

 (

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 49 of 56

complete electronic picture of the computer's data, including all hidden sectors and deleted files.
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data
recorded on the storage media, and to prevent the loss of the data either from accidental or
intentional destruction. This is true because of the following:
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing evidence
of how a computer has been used, what it has been used for, and who has used it
requires considerable time, and taking that much time on premises could be
unreasonable. As explained above, because the warrant calls for forensic electronic
evidence, it is exceedingly likely that it will be necessary to thoroughly examine
storage media to obtain evidence. Storage media can store a large volume of
information. Reviewing that information for things described in the warrant can
take weeks or months, depending on the volume of data stored, and would be
impractical and invasive to attempt on-site.
b. Technical requirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application software, and
configurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its examination with the proper tools and lmowledge.

42

 ,

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 50 of 56

c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing with
specialized forensic tools.
72.

Because multiple people share the Subject Premises as a residence, it is possible

that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as well.
· B.

73.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation

of forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) will review the ESI contained therein for information responsive to the
warrant.
74.

In conducting this review, law enforcement personnel may use various techniques

to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such
techniques may include, for example:
•

surveying directories or folders and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

conducting a file-by-file review by "opening" or reading the first few "pages" of such
files in order to determine their precise contents (analogous to performing a cursory
examination of each document in a file cabinet to detennine its relevance);

•

"scanning" storage areas to discover and possibly recover recently deleted data or
deliberately hidden files; and

43

 I

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 51 of 56

•

performing electronic keyword searches through all electronic storage areas to
determine the existence and location of data potentially related to the subject matter of
the investigation25 ; and

•

reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, wl).en, and by whom the computer was used.

75.

Law enforcement personnel will make reasonable efforts to restrict their search to

data falling within the cate~ories of evidence specified in the warrant.

Depending on the

circumstances, however, law enforcement personnel may need to conduct a complete review of all
the ESI from seized devices or storage media to evaluate its contents and to locate all data
responsive to the warrant.
76.

Review of the items described in Attachment A will be conducted pursuant to

established procedures designed to collect evidence in a manner consistent with professional
responsibility requirements concerning the maintenance of attorney-client and ot.p.er operative
privileges. The procedures include use of a designated "filter team," separate and apart from the
investigative team, in order to address potential privileges.

C.

Return of ESI

77.

If the Government determines that the electronic devices are no longer necessary

to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request.
Computer data that is encrypted or unreadable will not be returned unless law enforcement
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of

25

Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover,
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword
search because the information does not contain the keywords being searched.

44

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 52 of 56

the ·criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the
Subject Offenses.

IV.

Conclusion and Ancillary Provisions
78.

Based on the foregoing, I respectfully request the court to issue a warrant to seize

the items and information specified in Attachment A to this affidavit and to the Search and Seizure
Warrant.
79.

In light of the confidential nature of the continuing investigation, I respectfully

request that this affidavit and all papers submitted herewith be maintained under seal until the
Court orders otherwise. Sealing is necessary because items and information to be seized are
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and
related documents may have a negative impact on this continuing investigation and may jeopardize
its effectiveness.

Respectfully submitted,

Special Agent
Federal Bureau of Investigation
I

i)

Subscribed and sworn to before

\

I

\

,

,.1/

me q1\ tbis~Y'fl.:day,;f faJ?-uary, 2019.
)

)

I

,.
\

1' , ' ~

'

iYU_;f~·
'

'

I

J

1.'

,, . /

/ ' - -..............
• . . . ; . _ , . . . . ._ _ __
\II

- ' - - - -

THE HONORABI.:E, ;R.OBERT W. LEHRBURGER
!

'••I •

•

United States Magistrate Judge

45

 I

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 53 of 56

ATTACHMENT A

I. Premises to be Searched - Subject Premises
The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described a

II. Items to Be Seized
A.

Evidence, Fruits, and Instrumentalities of the Subject Offenses

The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;

1

 /

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 54 of 56

c. Documents that reflect communications between Roger Stone and Jerome Corsi
that concern the Subject Offenses;
d. Documents reflecting communications between Roger Stone and Randy Credico
that concern the Subject Offenses;
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
, Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;

f.

Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;

g. Records and information relating to the use, ownership, or control of e-mail
accounts

;

h. Records and information demonstrating who uses, owns, or controls the WhatsApp
account associated with telephone numbe
i.

Records and information demonstrating who uses, owns, or controls the Signal
account associated with telephone numbe

J.

;

;

Records and information demonstrating who uses, owns, or controls the Wickr
account associated with telephone numbe

;

k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 55 of 56

1.

Computers and media storage devices, including tablets/iPads, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form; and

m. Cellular telephones, smartphones, or personal data assistant devices, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form.

B.

Search and Seizure of Electronically Stored Information

The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones·,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1.
Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2.
Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3.
Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.

C.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.

3

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 56 of 56

In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
•

surveying various file "directories" and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

op-ening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;
·

•

scanning storage areas to discover and possibly recover recently deleted files or
deliberately hidden files;

•

performing key word searches through all electronic storage areas to determine whether
occunences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and

•

reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.

Law enforcement personnel will make reasonable efforts to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.

4

 ...

,

.- .

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 1 of 53

AO 93 (Rev 12/09) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the 

Southern District of Florida 

In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)

, Fort Lauderdale, Florida
described in Attachment "A")

(further

)
)
) Case No.
)
)
)

19-6033-SNOW

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Southern
District of
Florida
(identify the person or describe the property to be searched and give its location):
Fort Lauderdale, Florida

(further described in Allachmenl nAn)

The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized):

See Attachment "8."
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.

YOU ARE COMMANDED to execute this warrant on or before

F~ . l ~f1
(nottJ exceed f 4 days)

~ in the daytime 6:00 a.m. to 10 p.m.

o

at any time in the day or night as I find reasonable cause has been
established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken .
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)

o I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay
of trial), and authorize the officer executing this warran~ to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for
days (not to exceed 30).
J,.SS
Date and time issued:

City and state:

j,jf}.yl fCj

Fort Lauderdale, Florida

0 until, the facts justifying, the later specific date of

1~· d.6
Ph

~.JJ ~

~

Judge's signatllre

Lurana S . Snow, United States Magistrate Judge
Printed name and title

 . .


Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 2 of 53

ATTACHMENT A
The address of the

, Fort Lauderdale, Florida

Two photographs of the exterior of the Subject Premises are attached below.

Page 1 of1

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 3 of 53
.'

ATTACHMENT B 

Property to be seized from the Subject Premises 

1.

The items to be seized are fruits, evidence, information relating to, contraband, or

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a.   Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b.   Documents reflecting communications between Stone and Jerome Corsi;
c.   Documents reflecting communications between Stone and Randy Credico;
d.   Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,

,

Paul Manafort, Richard Gates, and Donald J. Trump;
e.   Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau ofInvestigation;

f.   Records and information relating to the e-mail accounts
and
g.   Records and information relating to the WhatsApp account associated with
telephone number

;

h.   Records and information relating to the Signal account associated with telephone
number

;

Page 1 of3

 . .   ...
,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 4 of 53

1.  

Records and infonnation relating to the Wic1er account associated with telephone
number

;

J.   Any computers, media storage devices, tablets/iPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k.   Records of personal and business activities relating to the operation and
ownership of the computer systems, such as telephone records, notes, notebooks,
diaries, and reference materials, in whatever fonn;

1.   Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever fonn;
2.

For any computer or storage medium whose seizure is otherwise authorized by

this warrant, and any computer or storage medium that contains or in which is stored records or
infonnation that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a.   evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
registry entries, configuration files, saved usernames and passwords, documents,
browsing history, user profiles, email, email contacts, "chat," instant messaging
logs, photographs, and correspondence;
b.   evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 2 of3

 ..

. . 

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 5 of 53

c.   evidence of the lack of such malicious software;
d.   evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
to crime under investigation and to the computer user;
e.   evidence indicating the computer user's state of mind as it relates to the crime
under investigation;

f.   evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;
g.   evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h.   evidence of the times the COMPUTER was used;
1.  

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.   documentation and manuals that may be necessary to access the COMPUTER or
to conduct a forensic examination of the COMPUTER;
k.   records of or information about Internet Protocol addresses used by the
COMPUTER;

l.   records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;
m.   contextual information necessary to understand the evidence described in this
attachment.

Page 3 of3

 ·

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 6 of 53
"

AO 93 (Rev. 12/ 09) Search and Seizure Warrant (Page 2)

Return
Case No.:

Date and time warrant executed:

Copy ofwarrant and inventory left with:

19-6033-SNOW

InventOlY made in the presence of:
Inventory ofthe property taken and name ofany person(s) seized:

Certification

I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designated judge.

Date:
Executing officer 's signature

Printed name and title

 ...

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 7 of 53

AD 106 (R ev 04 / 10) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of Florida
In the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)
.

, Fort Lauderdale, Florida
Attachment nAn)

(further described in

)
)
)
)

)

)


Case No. 19-6033-SNOW

APPLICATlON FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 

penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

property to be searched and give its location): 

Fort Lauderdale, Florida

(further described in Attachment nAn)

Southern
District of
Florida
, there is now concealed
located in the --------------- -----------------------

(identify the 


person or describe the property to be seized): 


See Attachment "B."
The basis for the search under Fed . R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed ;

f'i property designed for use, intended for use, or used in committing a crime;
o

a person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:
Code Section  
18U.S.C.1505  
18 U.S.C. 1001  
18 U.S.C. 1512(b)(1)

Offense Description

Obstruction of Proceeding
False Statements
Witness Tampering

The application is based on these facts :
see attached affidavit.

Ii Continued on the attached sheet.
o  Delayed notice of

days (give exact ending date if more than 30 days :
under 18 U.S.c. § 3103a, the basis of which is set forth on the attached sheet.

) is requested

&, ~p:fL ,;;::!:'~
Curtis A. Heide, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
Date

I ji9-'1}/j  

~.~.A. ~
Judge 's signature

City and state: Fort Lauderdale, Florida  

Lurana S. Snow, United States Magistrate Judge
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 8 of 53

ATTACHMENT A
The address of the Subject Premises is

Fort Lauderdale, Florida

Two photographs of the exterior of the Subject Premises are attached below.

Page 1 of 1

 t

'>t'

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 9 of 53

ATTACHMENT B 

Property to be seized from the Subject Premises 

1.

The items to be seized are fruits, evidence, information relating to, contraband, or

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a.   Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b.   Documents reflecting communications between Stone and Jerome Corsi;
c.   Documents reflecting communications between Stone and Randy Credico;
d.   Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,

,

Paul Manafort, Richard Gates, and Donald J. Trump;
e.   Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;

f.   Records and information relating to the
and

e~mail

accounts

;

g.   Records and information relating to the WhatsApp account associated with
telephone number

;

h.   Records and information relating to the Signal account associated with telephone
number

;

Page 1 of3

 f

..

I

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 10 of 53

1.  

Records and information relating to the Wickr account associated with telephone
number

;

J.   Any computers, media storage devices, tablets/iPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k.   Records of personal and business activities relating to the operation and
ownership of the computer systems, such as telephone records, notes, notebooks,
diaries, and reference materials, in whatever form;

1.   Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form;
2.

For any computer or storage medium whose seizure is otherwise authorized by

this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a.   evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this wan'ant were created, edited, or deleted, such as logs,
registry entries, configuration files, saved usernames and passwords, documents,
browsing history, user profiles, email, email contacts, "chat," instant messaging
logs, photographs, and correspondence;
b.   evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 2 of3

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 11 of 53

c.   evidence of the lack of such malicious software;
d.   evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
to crime under investigation and to the computer user;
e.   evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
f.   evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;
g.   evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h.   evidence of the times the COMPUTER was used;
I.  

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.   documentation and manuals that may be necessary to access the COMPUTER or

to conduct a forensic examination of the COMPUTER;
k.   records of or information about Internet Protocol addresses used by the
COMPUTER;

1.   records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;
m.   contextual information necessary to understand the evidence described in this
attachment.

Page 3 of3

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 12 of 53

AFFIDAVIT IN SUPPORT OF 

AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for the

premises known and described as

Fort Lauderdale, Florida,

described in

the following paragraphs and further in Attachment A.
2.

I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have

been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cybersecurity.
3.

I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger

Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(1 ) (collectively the "Specified Federal
Offenses") .
4.

I have personally participated in this investigation and am aware of the facts

contained herein based on my own investigation, as well as my review of documents, records,
and information provided to me by other law enforcement officers and technical experts.
5.

This affidavit is intended to show merely that there is sufficient probable cause

for the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance

Page 1 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 13 of 53

and part. Where I assert that an event took place on a particular date, I am asserting it took place
on or about the date specified.
6.

I make this affidavit

premises located at

In

support of an application for a warrant to search the

, Fort Lauderdale, FL (the "Subject Premises," as is more

particularly described in Attachment A), in connection with the Specified Federal Offenses, for
the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and
instrumentalities of the Specified Federal Offenses.
7.

For the reasons set forth in this Affidavit, there is probable cause to believe that

one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.
PROBABLE CAUSE

A. Background on Relevant Individuals
8.

Roger Stone is a political consultant who has worked for decades in U.S. politics

and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
9.

Julian Assange is the founder and director of WikiLeaks, which is publicly

described as a non-profit organization that disseminates non-pUblic information and classified

Page 2 of42

 ,.

,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 14 of 53

media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
London, United Kingdom.
10.

Jerome Corsi is a political commentator who worked with an online media

publication during the 2016 U.S. presidential campaign.

As set forth below, Corsi spoke

regularly with Stone throughout the campaign, including about the release of stolen documents
by WikiLeaks.

12.

Based on the investigation to date, Randy Credico was a radio host who has

known Stone for more than a decade. In testimony before the U.S. House of Representatives
Permanent Selection Committee on Intelligence (" HPSCI") on or about September 26, 2017,
Stone described Credico (without naming him) as an "intermediary," "go-between," and "mutual
friend" to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that
Assange, had '" [e ]mails related to Hillary Clinton which are pending publication. '"
13 .

Richard Gates is a U.S. citizen who served for years as a political consultant and

lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gales, 1: 17-cr-20 1 (D .D.C.).

Page 3 of42

 •


Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 15 of 53

14.

Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in

or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the
chief executive officer of the Trump Campaign.

B. Hacking Activity During the 2016 Presidential Election

16.

John Podesta is a U.S. citizen who served for years as a political consultant.

During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the
Hillary Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016,
Podesta received a spearphishingl email designed to appear as a security notification (a partial
copy of the email was recovered by the FBI from a subsequent release of stolen emails,
described below). During an interview with the FBI in or around May 2018, Podesta indicated
that after receiving the email, his assistant (who also had access to the account) clicked on a link
within the email and entered the account password when prompted (believing this prompt to be
part of a security protocol). Based on my training and experience, this activity appears to have
been a successful spearphishing operation through which an actor would have gained access to
Podesta's email account allowing the actor to steal emails and documents from that account.
17.

The Democratic National Committee ("DNC") and Democratic Congressional

Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal

I In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.

Page 4 of 42

 ,

<

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 16 of 53

elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election.

According to DNC and DCCC individuals interviewed by

the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
the cybersecurity company CrowdS trike to investigate the intrusions and remediate.
IS.

On or about June 14,2016, CrowdStrike issued a public press release announcing

that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bloth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
19.

On or about July 13, 20 IS, a federal grand jury sitting in the District of Columbia

returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of Jolm Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: IS-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
military intelligence agency.

C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
20.

As alleged in the Netyksho indictment, after successfully hacking the DNC and

DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the

Page 5 of 42

 f.

.

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 17 of 53

stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks."

CGRU officers separately used these personas to release some of the stolen

documents).
21.

On or about July 22, 2016, WikiLeaks released tens of thousands of documents

stolen from the DNC network.

These stolen documents included communications by senior

DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
22.

Beginning in or around October 2016, WikiLeaks began to release tens of

thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
D. Stone's Communications About WikiLeaks During the Campaign
23.

In April 2018 interviews with the Special Counsel's Office, Gates stated that

starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
WikiLeaks and Stone's prediction of the release.
24.

According to Gates, Manafort directed Gates to contact Stone about any

additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's

Page 6 of42

 .,

~

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 18 of 53

Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
25.

Emails recovered through a court-authorized search of Stone's email account
show that shortly after the July 22, 2016 release of stolen DNC emails

by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a.   On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to

, who lived in the United Kingdom and was a supporter

of the Trump Campaign.
b.   On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that

" should see Assange."

c.   On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word

A search of
was authorized on or about September 11, 2017 by the
U.s. District Court for the District of Columbia. Case No.1 :17-mj-661 (D.D.C. Sept. 11,2017).
A second search of
was authorized on or about August 3, 2018 by the
U.S. District Court for the District of Columbia. Case No.1: 18-sc-2582 (D.D.C . Aug. 3,2018).
On or about September 26, 2018, the government obtained and executed an order pursuant to 18
U.S .c. § 2703(d) for records connected to
. Case No.1 : 18-sc-2911
(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that
the account was still active and that the relevant emails described in this affidavit were not
deleted from the account.
2

Page 7 of 42

 •

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 19 of 53

is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
Impact planned to be very damaging." In a law enforcement interview, Corsi
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke ­
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
26.

According to recorded public statements recovered by the FBI, starting in early

August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a.   According to a public video posted to YouTube, on or about August 8, 2016,
Stone attended a public event in Broward County, Florida.

During the event,

Stone stated, "I actually have communicated with Assange.

I believe the next

tranche of his documents pertain to the Clinton Foundation, but there's no telling
what the October surprise may be."
b.   According to a public video posted to YouTube, on or about August 12, 2016,
Stone was interviewed for a video segment on the show Info Wars, hosted by Alex
Jones. During the interview, Stone stated that he was "in communication with
Assange" but was "not at liberty to discuss what I have."
c.   According to a public video posted to YouTube, on or about August 16, 2016,
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-channel communication with WikiLeaks

Page 8 of 42

 .,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 20 of 53

and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
that they had a "mutual acquaintance who is a fine gentleman."
d.   According to a video posted to the public website of the TV station C-SPAN,
during a C-SP AN television interview on or about August 18, 2016, Stone stated
that he had communicated with Assange through an "intermediary, somebody
who is a mutual friend ."
e.   In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You ' ve been in touch indirectly with
Assange.

Can you give us any kind of insight? Is there an October surprise

happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
a mutual friend , somebody we both trust and therefore I am a recipient of pretty
good information."
27.

In or around November 2018,

, Stone

produced a series of text messages between Stone and Credico during the 2016 presidential
campaign. 3

These text messages show that beginning on or about August 19, 2016, Stone

exchanged written communications with Credico about what WikiLeaks and Assange planned to
do.

Emails recovered through a court-authorized search of Stone' s email account

As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.

3

Page 9 of 42

 '. 


Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 21 of 53

show additional written communications between Stone and Credico
about WikiLeaks in or around September 2016,
a.   On or about August 19, 2016, Credico sent a text message to Stone that read in
part, "I'm going to have Julian Assange on my show next Thursday." On or
about August 21, 2016, Credico sent another text message to Stone, writing in
part, "I have Julian Assange on Thursday so I'm completely tied up on that day."
b.   On or about August 25, 2016, Assange was a guest on Credico's radio show for
the first time. On or about August 26,2016, Credico sent a text message to Stone
that stated, "Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in
cahoots."
c.   On or about August 27,2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in
charge" of the project.

In a text message sent later that day, Credico added,

"Julian Assange has kryptonite on Hillary."
d.   On or about September 18, 2016, Stone sent a text message to Credico that said,
"I am e-mailing u a request to pass on to assange." Credico responded "Ok," and
added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e.   Later on or about September 18, 2016, Stone emailed Credico an article with
allegations against then-candidate Clinton related to her service as Secretary of
State.

Stone stated, "Please ask Assange for any State or HRC e-mail from

Page 10 of 42

 "j

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 22 of 53

August 10 to August 30 -- particularly on August 20, 2011 that mention
subject of the article] or

"

this

f.   On or about September 19, 2016,

responded, "1 did."

"
20,2016, 


forwarded

my

texted Credico

request to a close

or about 

who was an attorney

with the ability to contact

Stone on the

forwarded email.
g. On or about

30, 201

Credico sent Stone via text

photograph of Credico standing outside the

a

Embassy

In

London

where Assange was located.

h.   On or
messages

October 1, 2016, which was a

text

stated, "big news Wednesday ... now pretend u don't know me ...

" In the

will die this

had reported that Assange planned to
October 4,

about
anniversary of the
1.  

Credico sent

On or about October 2,

preceding these

the

a public announcement on or

16, which was reported to be the 1

of WikiLeaks.
16, Stone emailed Credico, with the subject line

and a link to an article at the website http://heatst.com/politics/october­
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement­
due-to-security-concerns.

responded to Stone, "head fake."

J.   On or about Monday, October

2016,

wrote Credico and

ac""""u,

"Did

Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded,

II

42 


think

on

 , I

",

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 23 of 53

tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
28.

Emails and text messages recovered by the FBI show that, in or around October

2016, Stone made statements about Assange's future releases that were similar to prior
statements Credico made to him. For example:
a.   In a court-authorized search of Stone's email account
FBI recovered an email from Stone to

the

sent on or about October 3, 2016,

which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
b.   In a court-authorized search of

, the FBI also recovered an

email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange ­
what's he got? Hope it's good." Stone responded, "It is. I'd tell Bannon but he
doesn't call me back."
c.   On or about October 4, 2016, Assange held a press conference but did not release
any new materials pertaining to the Clinton Campaign.
search of

In a court-authorized

, the FBI recovered an email exchange between

Stone and Steve Bannon on or about October 4, 2016 that occurred after the press
conference.

In the exchange, Bannon asked, "What was that this morning???,"

referring to Assange's press conference. Stone responded, "Fear. Serious security
A search of
was authorized on or about October 17, 2017 by the U.S.
District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A
was authorized on or about August 3, 2018 by the U.S.
second search of
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3,2018).

4

Page 12 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 24 of 53

concern. He thinks they are going to kill him and the London police are standing
do[wn]. However - a load every week going forward."
d.   In a court-authorized search of Stone's iCloud account,S the FBI recovered text
messages between Stone and
text message,

from on or about October 4, 2016. In one

asked Stone if he had "hear[d] anymore from London."

Stone replied, "Yes - want to talk on a secure line - got Whatsapp."

In an

interview with the Special Counsel's Office in or around May 2018,
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had
more material to release, and that the material was related to senior people
associated with Clinton.
29.

On or about October 7, 2016, WikiLeaks released the first set of emails stolen

from Podesta. According to text messages recovered from Stone's iCloud account, shortly after
the release, an associate of Bannon sent a text message to Stone that read, "well done."
Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016
WikiLeaks release, Stone said, "I told you this was coming."
E.   Stone's Communications with
Intelligence

30.

the House Permanent Select Committee on

On or about January 25, 2017, HPSCI publicly disclosed that it was investigating

allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about

S A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No.1: 18-sc-662 (D.D.C. Mar. 14, 2018). The
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would

6

Page 13 of 42

 .,

..

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 25 of 53

March 20, 2017, multiple HPSCI committee members indicated that Stone's pnor public
statements about having communications with Assange (particularly those from August 2016)
were of interest to the committee.
31.

In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily

appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account
). The letter requested Stone produce:
Any documents, records, electronically stored information
including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's
publicly-announced parameters.
32.

On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and

stated, "Mr. Stone has no documents, records, or electronically stored information, regardless of
form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation'S publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone's email accountp

).

F. Stone's Testimony Before HPSCI
33.

On or about September 26, 2017, Stone provided HPSCI with an "opening

statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone

investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection wi ththe 2016 election.
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Page 14 of 42

 , I

"

,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 26 of 53

stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34.

Also on or about September 26, 2017, Stone provided testimony

session before HPSCI, at the U.S. Capitol in Washington, D.C.

In

a closed

Stone's testimony was

transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI
in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the
record that he would tell the truth. At the beginning of the hearing, Stone was admonished that
"it is unlawful to deliberately provide false information to Members of Congress or staff' and
that "providing false information to this committee or concealing material information from this
committee is a crime punishable by law."

Stone's Testimony About Documents He Possessed Related to WikiLeaks
35.

During his HPSCI testimony, Stone was asked about HPSCI's May 2017

document request and whether Stone had any documents or written communications that
discussed Julian Assange, Russian interference, or other relevant documents:
Q:  

The committee wrote to you on May 9th requesting no later
than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no
documents, records, or electronically stored information
regardless of form responsive to our requests. Was that a
false statement?

A:  

That is not a false statement. That's what -- I believe that
to be true.

Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 27 of 53

, i

[... ]
Q:  

So you
no
to anyone
the
hacked documents or your conversations with the
Guccifer 2[.0] or any discussions you have
with third
about Julian
You
no emails.no
no documents whatsoever, any kind of that nature?

A:

That is correct. Not to my knowledge. I think we met,
again, the precise criteria of your request, and we complied.
if you have a more specific
I'm happy to
back and look ....

Q:  

I just want to ask you under oath-

A:  

We did an
my attorneys,
that you asked for.

Q:  

I just want to be
because you are under oath, where
your letter was not under
that you have no
no
no texts, no tweets that
to Julian
or Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've
written no documents yourself.

with
direction of
criteria
nothing that met

In connection with Russian collusion, consistent with your
exact and precise request,
36.  

In fact,

as described

sent and

text messages during the 2016 campaign

he

In

and

WikiLeaks, Assange, and
of

possession of 11"',,,,,,,,, emails. Court-authorized
(including

numerous

email accounts

) and his iCloud account show

that, at the time of his testimony, Stone was still in
at the

he

vv,",,,,,-,,,

on or about September

8

many

these
2017. 8

and text
These written

warrant for Stone's email account
was obtained on or about
September 11, 17 and executed shortly
Records provided in or around September
18 in response to a court order issued pursuant to 18
§ 2703(d) confinned that the
account was
and
emails
question were not
from
account. The warrant
Page 16

42

 "

.

,

.

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 28 of 53

communications included (a) Stone's email to Corsi on or about July 25, 2016, that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ...
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
Malloch "should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part: "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to

on or

about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
WikiLeaks would release "a load every week going forward."

Stone's Testimony About His Early August 2016 Statements
37.

During his HPSCI testimony on or about September 26, 2017, Stone was asked to

explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38.

Stone testified that these public references to having a means of contacting

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
for Stone's email account
was obtained on or about October 17,2017 and
executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text
messages described above) was obtained on or about March 14, 2018 and executed shortly
thereafter.
Page 17 of42

 , I

.,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 29 of 53

consistent with Credico. (On or about October I

2017, Stone caused a letter to be

to

HPSCI that identified Credico by name as the "gentleman who confirmed for Mr.

that

to Hillary Clinton which are pending publication. ''').

had '" [e] mails
39.

In fact, documents recovered during the investigation (including those obtained

via search warrant returns

show that Stone did not

communicating with Credico about .~~.~u ..,~ or WikiLeaks until on or about August 19, 2016 9
approximately

Stone first claimed on or about August 8, 2016 to "actually have

days

communicated with
communication

40.

6 statements of

a week after his
Assange" and "not at liberty to discuss what I

"

When interviewed by the FBI, Credico stated that the

with Assange was on or about

2016, when

another member

WikiLeaks from on or about August 25,

technical

for the

that day.

time he ever spoke

interviewed

also provided the FBI with partially redacted emails that

During

"in

10

Credico

were between he
which the two discuss the
Credico

biographical information about himself, apparently as a means
41.

The FBI

2016 in which Stone
interviewed by the

Credico

not identified
to contact

Credico claimed he was never

or WikiLeaks.

When

Stone in August

16 to

contact WikiLeaks.
9

described
on or about August 19,
Credico intended to interview Assange the
the first time,
Credico interviewed Julian
"Assange has kryptonite on Hillary."

Stone by text message that
or about August 25, 2016,
on or about
1

10 Credico was first interviewed by
in or around August
participated in multiple voluntary interviews.

18 of 42

18. He has subsequently

 '.

,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 30 of 53

42.

In

and

communications prior to

as

described

8, 2016

above,

which Stone

Assange. On or about July
Ecuadorian

In

the

identified

Corsi-not Credico--to contact

Stone wrote to Corsi,

London

the

to Assange

WikiLeaks

with
co--sem an

Foundation, allegedly." Similarly, on or about August 2, 2016,
email to

wrote that "[w lord is friend in embassy plans 2 more dumps,"

in which

including one in October.

communications

statement on or about August
at no time did

2016 claiming to

identify

days before

first public

in communication with

However,

to HPSCI as another individual Stone contacted to serve as a

"go-between," "intermediary," or other source for information
Stone also never disclosed
HPSCI's

written

WikiLeaks.

written communications with Corsi to

about the August

Similarly,

when answering

2016 and August 12, 2016 statements about

communication with

43.

During his HPSCI testimony, Stone was asked, "Did you ask [the intennediaryJ to

communicate anything
"Did you

did not." Stone was then asked,

Stone

to

on your own behalf?" Stone responded,

[the intermediary] to do

did

not."
44.
on a

In fact,
to

.~~,~.. ,.,~

18, 201

on or about
for documents that

Stone directed Credico to

believed would be

a. According to text

to

Clinton

, on or about

September 18, 2016, Stone sent a text

Page 19 of 42

v"''''''''~v to Credico

said, "I am e-

 " 

.

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 31 of 53

mailing u a request to pass on to Assange." On or about the same day, Stone
emailed Credico an article with allegations against then-candidate Clinton related
to her service as Secretary of State. Stone added, "Please ask Assange for any
State or HRC e-mail from August 10 to August 30 - particularly on August 20,
2011 that mention [the subject of the article] or confinn this narrative." (A copy
of this email was obtained through a search of Stone's email account
).
b.   According to text messages

, on or about

September 19,2016, Stone texted Credico again, writing "Pass my message ... to
Assange."

Credico responded, "I did."

An email obtained from the account

shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.

Stone's Testimonv About Written Communications with Credico

45.

During

his

HPSCI

testimony,

Stone

was

asked

repeatedly

about

his

communications with the person he identified as his intennediary. Stone stated that he had never
communicated with his intennediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intennediary telephonically:
Q:  

[H]ow did you communicate the intennediary?

A:  

Over the phone.

Q:  

And did you have any other means of communicating with
the intennediary?

A:  

No.

Q:  

No text messages, no - none of the list, right?

Page 20 of 42

 '.

. 
 Case 1:19-mc-00029-CRC

A:

Document 29-33 Filed 04/28/20 Page 32 of 53

No.

Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:

46.

Q:  

So you never communicated with your intermediary
writing in any way?

A:  

No.

Q:  

Never emailed him or texted him?

A:  

He's not an email guy.

Q:  

So all your conversations with him were in person or over
the phone.

A:  

Correct.

In

As described above, Stone and Credico (whom Stone identified as his

intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19,2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.
47.

Written communications between Stone and Credico continued up until Stone's

HPSCI testimony and afterwards.

For example, on or about September 26, 2017-the day that

Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary, Stone and Credico exchanged over thirty text messages.
48.

Certain of the electronic messages between Stone and Credico (which Stone

denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
Page 21 of 42

 '.   .

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 33 of 53

January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
email was obtained through a search of Stone's email account

).

Stone's Testimony About Communications with the Trump Campaign
49.

During his HPSCI testimony, Stone was asked, "[d]id you discuss your

conversations with the intermediary with anyone involved in the Trump campaign?"

Stone

answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:
a.   As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials to inform them about materials possessed by Assange
and the timing of future releases.
b.   According to text messages
October 3,2016, Stone wrote to

, on or about
"Spoke to my friend in London last night.

The payload is still coming."
c.   As described above, on or about October 4, 2016, after receiving information
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
release "a load every week going forward."

Page 22 of 42

 ,,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 34 of 53

G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI

50.

According to an email recovered through a court-authorized search of Stone's

email accountp

. on or about October 19, 2017, Stone sent Credico an

excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
51.

In or around November 2017, Credico received a request from HPSCI to testify

voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.

a.   On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
b.   On or about November 21, 2017, Credico texted Stone, "I was told that the house
committee lawyer told my lawyer that I will be getting a subpoena."

Stone

responded, "That was the point at which your lawyers should have told them you

Page 23 of 42

 ,

.

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 35 of 53

would assert your 5th Amendment rights if compelled to appear." (A copy of
these text messages was recovered through a court-authorized search of Stone's
iCloud account).
c. On or about November 28, 2017, Credico received a subpoena compelling his
testimony before HPSCI. Credico informed Stone of the subpoena.
d. According

to

emails

recovered

from

Stone's

email

account

, on or about November 30, 2017, Stone asked Corsi to
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."
e. According to text messages recovered from Stone' s iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part

II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1,2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information
from investigators.

f

On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You

Page 24 of 42

 , ,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 36 of 53

need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain

[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
52.

On or about December 12, 2017, Credico informed HPSCI that he intended to

assert his Fifth Amendment privilege against self-incrimination if required to appear by
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
53.

Following Credico's invocation of his Fifth Amendment privilege not to testify

before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
to prevent Credico from cooperating with the investigations. For example:
a.   On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[ r] sept 7 ... docs prove that ... You should be honest w fbi ...
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
copy of these text messages was recovered through a court-authorized search of
Stone's iCloud account).
b.   On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip

Page 25 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 37 of 53

you to shreds."

Stone also said he would "take that dog away from you,"

referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
exchange was recovered through a court-authorized search of Stone's email
account

).

c.   On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact Assange]."

(A copy of

this email exchange was recovered through a court-authorized search of Stone's
email accountp

). Credico believed Stone knew that Credico

was sensitive to having this friend's name publicly disclosed.
H. Missing Electronic Communications and Stone's Use of Encrypted Communications

54.

As described above, the government has recovered the content of many of Stone's

electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election).

However, the government is aware of the

existence of numerous other relevant electronic communications, the content of which it has not
yet been able to recover.
55.

As described above, during his HPSCI testimony, Stone falsely denied having

emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico).

In fact, emails and text messages recovered in this investigation show the two

Page 26 of 42

 "

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 38 of 53

communicated frequently by email and text messages; court-authorized searches of Stone's
email and iCloud accounts confirm that Stone still had those communications at the time he
testified in or around September 2017.

In numerous communications, Stone and Credico

discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
intermediary to Assange. These communications appear relevant and responsive to HPSCI's
inquiry, but Stone never disclosed them.
56.

In addition to these emails and text messages in the FBI's possession, the FBI has

reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
corruptly persuade Credico not to cooperate with pending investigations.
57.

Additionally, the FBI has interviewed multiple associates of Stone, who

confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses mUltiple applications designed for

Page 27 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 39 of 53

encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)
ProtonMail.

14

To date, the FBI has not obtained any of Stone's communications conducted

through these applications.
a. According to records from Stone's iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5,2016. As described above, on or about October 4,2016, Stone suggested in an
email to

that they "talk on a secure line" and proposed using

WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal
application was downloaded to an iPhone registered to Stone on or about August
18, 2016. Additionally, text messages recovered from Stone's iCloud account
II According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default
message application.

12 According to open sources, Signal is an encrypted communications application allowing the
user to send one-to-one and group messages, which can include files, voice notes, images and
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile
numbers as identifiers, and uses end-to-end encryption to secure all communications to other
Signal users. Signal also allows users to set timers to messages, after which the messages will be
deleted from both the sender's and the receivers' devices.
13 According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.

According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.
14

Page 28 of42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 40 of 53

revealed that on or about November 15, 2016, Stone sent an attorney with the
ability to contact Julian Assange a link to download the Signal application. ls
Approximately fifteen minutes

sending the link, Stone texted the attorney,

"I'm on signal just dial my number."

attorney responded, "I'll call you."

Stone's iCloud account, a

c.   According to records

of the ProtonMail

application was downloaded to an iPad registered to Stone on or about August 18,
2016.
d. According to

from

iCloud account, a copy

the Wickr

application was downloaded to an iPhone registered to Stone on or about August
5,

58.

17.
electronic communications

Based on my training and

encrypted

applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
device used to

communications.

and receive

the

applications can be obtained by law enforcement by
data extraction device (such as Cellebrite).
including text
Wickr,

that have not

Communications from those
manually or

a

of the physical device can reveal messages,

and messages exchanged over WhatsApp, Signal, ProtonMail, and
backed

to cloud accounts (such as an iCloud account).

Additionally, review of the device and the downloaded application can reveal other evidence
encrypted communications, such as call logs and contact lists.
continues to seek evidence of Stone's communications and contacts
during

period of the 2016 U.S. presidential election

15

through

The

attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September
2016 to
Stone's request to
emails connected to the
against then-candidate Clinton
to  
of
Page 29 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 41 of 53

believes

communications may contain evidence of additional communications concerning
WikiLeaks, and the

of stolen documents damaging to the Clinton

Such communications could constitute additional evidence
HPSCI's

Stone's

by showing additional contacts and

to obstruct 

about

and 


that Stone failed to
I. Other Relevant

60.

On or about May 8, 2018, a law enforcement interview

was conducted.
through approximately

a

approximately June 2016

resided in Stone's previous

2016

.lJ"-"v'-'H

Stone's

so.

was aware that Stone communicated

presidential campaign, and afterward, both in person
information about a
worked for

Tower

at

to which

UI..,'VVI..,,,,,

the 2016

by telephone.

provided

Trump

Stone

it.

time
told

the file

maintained

said

file

closet.

61.

or about

individual ("Person
provided

Trump

carried a "file booklet" with him.

booklet was important and that no one should
booklet in

York apartment for

provided information technology support for Stone but was not formally

of time.

trained to

was an employee

IJ""'<'A~

2018, law

who

conducted an interview

relationship with a reporter who

had a

2 with information about Stone.

reporter

around January and February 2016, Stone and Trump were
Stone
later provide a

notes of

"

300f42

to Person 2 that in or

constant communication

conversations. Stone's

mortem of what went

an

m

that

notes was to

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 42 of 53

J. The Subject Premises
62.

Your affiant is aware through the investigation that Stone maintains the Subject

Premises as his primary residence. 16 During physical surveillance of the Subject Premises on or
about January 14, 2019, the FBI observed Stone at the residence.
63.

Records produced by Comcast on August 23, 2018

show that the subscriber of high-speed internet service and digital voice services at the
Subject Premises was Nydia Stone. According to public reporting and law enforcement
interviews, Nydia Stone is the spouse of Stone.
64.

According to emails obtained through a court-authorized search of Stone's email

account

, Stone sent an email on or about January 2, 2018 requesting the

recipient "update your files with my new address"; Stone identified the Subject Premises as his
new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the
Subject Premises as his shipping address.

K. Computer Devices at the Subject Residence
65.
and

uses

Based on law enforcement interviews, your affiant is aware that Stone has used
cellular

telephones,

desktop,

and

laptop

computers

to

conduct electronic

communications. Stone also configures his computers to create regulars backups of his
computers and maintains one of these devices at the Subject Premises, which preserves
documents and communications.

Stone also maintains a residence at
York.

New York, New

16

Page 31 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 43 of 53

66.

In or around May 2018, the FBI interviewed an individual ("Person 2") who

provided infonnation technology services to Stone. According to Person 2, Stone maintains at
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
computer at one point in time.

Person 2 revealed billing

receipts and invoices issued to Nydia Bertran-Stone for infonnation technology ("IT") services
dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was
billed for IT services in connection with three different Apple computers.

Specifically, the

billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQ 17)
configured with the name "Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number
D25TC077GQ 17) configured with the name "Stone-Roger-iMac-NYC";

and (3) an Apple

MacBookPro 10 (serial number C02KL05EFFT4) configured with the name "Stone-NydiaMBPR."

According to publicly available infonnation, the iMac is one of Apple's desktop

models (i.e., a computer designed to be stationary). The naming convention of the computer
"Stone-Roger-iMac-FL" therefore suggests it is a stationary computer used by Stone and located
at the Subject Premises. I7 According to the billing records, the computer was serviced on or
about May 26,2018.
67.

Person 2 also told law enforcement that Stone used the Apple Time Machine

("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences.

According to publicly available

information, Time Machine is the built-in backup feature of Apple computers and can create
copies of files on a computer, including applications, music, photos, email, documents, and
system files. A Time Machine backup allows users to restore files from a specific point in time
17 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.

Page 32 of42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 44 of 53

if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create
backups with Time Machine, a user connects an external storage device to the computer and
selects that external storage device as the backup disk.18
68.

Records produced by AT&T

show that,

since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
telephone number (ending in

). According to AT&T, between approximately January 1,

2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
310410930460769). On or about September 28, 2018, Stone's cellular telephone number was
transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814).
69.

Records produced by Uber Teclmologies, Inc.,

show that the account associated with Stone's telephone number and email address has the Uber
application on multiple devices, including a device identified as iPhonell ,2, UDID - 668EDC66­
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier
"iPhone 11,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
identified

a

device

DE0840 1EOA 74.

identified

as

iPhone9,4,

UDID

7161 CF59-6Fl 0-41 C8-984B­

Publicly available information indicates that the identifier iPhone9,4

correlates to an Apple iPhone model iPhone 7 Plus.
70.

Records obtained from a court-authorized pen register/trap & trace ("PRTT")

monitoring of Stone's personal cellular telephone number

19 shows recent activity

18 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 33 of42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 45 of 53

indicating Stone continues to use the number and its associated device.

For example, these

records show that between January 1, 2019 and January 10, 2019, telephone number

was

used to make or receive over 150 telephone calls and send or receive over 750 text messages.
Likewise, a court-authorized PRTT of Stone's WhatsApp account (which is registered to Stone's
telephone number

20 showed the WhatsApp account was used to send or receive

approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about
January 1,2019 and January 10,2019.
71.

Statements attributed to Stone in recent media articles also indicate that Stone

retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media reports began to publish excerpts of text
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
of these text messages subsequently were obtained from Stone

21

According to these news articles, Stone released these messages to the media outlets, which
Stone claimed were extracted by his lawyers from "a cell phone he stopped using in 2016."
Based on these statements, your affiant believes the cellular telephone referenced in the article to
be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he

19 Installation and use of PRTT devices for
was authorized by the U.S. District Court for
the District of Columbia on or about November 28, 2018. Case No.1: 18-pr-l72 (D.D.C. Nov.
28,2018).
20 Installation and use of PRTT devices for Stone's WhatsApp account was authorized by the
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No.1: 18­
pr-250 (D.D.C. Dec. 11,2018).
See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel,"
Daily
Caller,
Nov.
14,
2018,
available
at
https:lldailycaller.coml20 18/11 I 14/roger-stone-wikileaks-randy-credico-mueller.

21

Page 34 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 46 of 53

stopped using on or about November 14, 2016)?2 Further, your affiant believes Stone maintains
other devices he is no longer actively using.
COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS
72.

As described above and in Attachment B, this application seeks permission to

search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule
41 (e )(2)(B).

73.

Probable cause. I submit that if a computer or storage medium is found on the

Subject Premises, there is probable cause to believe those records will be stored on that computer
or storage medium, for at least the following reasons:
a.   Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet.
Electronic files downloaded to a storage medium can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.

Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occurred on or about November 14,
2016. The govenunent believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.
22

Page 35 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 47 of 53

b.   Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
a "swap" or "recovery" file.
c.   Wholly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file
system data structures, and virtual memory "swap" or paging files.

Computer

users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d.   Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache."

74.

Forensic evidence. As further described in Attaclunent B, this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Subject Premises because:

Page 36 of 42

 .


,

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 48 of 53

a.   Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
e-mail programs, and chat programs store configuration information on the
storage mediwn that can reveal information such as online nicknames and
passwords.

Operating systems can record additional information, such as the

attaclunent of peripherals, the attachment of USB flash storage devices or other
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
b.   As explained herein, information stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
innocent from further suspicion.

In my training and experience, information

stored within a computer or storage media (e.g., registry information,
communications, images and movies, transactional information, records of
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
computer or storage media. This "user attribution" evidence is analogous to the

Page 37 of 42

 I

\

•

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 49 of 53

search for "indicia of occupancy" while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and mal ware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
For example, as described herein, computers typically contains information that
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
and the internet.

Such information allows investigators to understand the

chronological context of computer or electronic storage media access, use, and
events relating to the crime under investigation. Additionally, some information
stored within a computer or electronic storage media may provide crucial
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data.

Such file data

typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
digital camera or cellular phone with an incorporated camera). The geographic
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under

Page 38 of 42

 .

r'

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 50 of 53

investigation. For example, infonnation within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
criminal plaIll1ing), or consciousness of guilt (e.g., ruIll1ing a "wiping" program to
destroy evidence on the computer or password protecting/encrypting such
evidence in an effort to conceal it from law enforcement).
c.   A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
d.   The process of identifying the exact files, blocks, registry entries, logs, or other
fonns of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process.

While it is possible to specify in

advance the records to be sought, computer evidence is not always data that can
be merely reviewed by a review team and passed along to investigators. Whether
data stored on a computer is evidence may depend on other infonnation stored on
the computer and the application of knowledge about how a computer behaves.
Therefore, contextual infonnation necessary to understand other evidence also
falls within the scope of the warrant.
e.   Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
of counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.

Page 39 of42

 •

•

r

,

I'

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 51 of 53

75.

Necessity ofseizing or copying entire computers or storage media. In most cases,

a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media.

Generally speaking, imaging is the taking of a complete

electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
destruction. This is true because of the following:
a.   The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site.

Analyzing

evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
examine storage media to obtain evidence.

Storage media can store a large

volume of information. Reviewing that information for things described in the
warrant can take weeks or months, depending on the volume of data stored, and
would be impractical and invasive to attempt on-site.
b.   Technical requirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application software, and
configurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware

Page 40 of 42

 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 52 of 53

and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its examination with the proper tools and knowledge.
c.   Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing
with specialized forensic tools.

76.

Nature of examination.

Based on the foregoing, and consistent with Rule

41 (e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
order to determine whether it is evidence described by the warrant.
77.

Because multiple people share the Subject Premises as a residence, it is possible

that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as
well.

FILTER REVIEW PROCEDURES
Review of the items described in Attachment B will be conducted pursuant to established
procedures designed to collect evidence in a manner consistent with professional responsibility

Page 41 of 42

 ..

..

Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 53 of 53

requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
team, in order to address potential privileges.
SEALING ORDER REQUESTED
78.

It is further respectfully requested that this Court issue an Order sealing, until

further order of this Court, all papers submitted in support of this application, including the
application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary
because items and information to be seized are relevant to an ongoing investigation, and
premature disclosure of the contents of this affidavit and related documents may have a negative
impact on this continuing investigation and may jeopardize its effectiveness.
CONCLUSION
79.

Based on the foregoing, your affiant respectfully requests that this Court issue a

search warrant for the Subject Premises, more particularly described in Attachment A,
authorizing the seizure of the items described in Attachment B.
Respectfl  By submitted,

v/I~ ')

.

~~

Curtis A. Heide
pecial Agent
Federal Bureau of Investigation
Sworn to and subscribed before me on this

1~~A-J_~~~_

~

;Zy day of January, 2019.

J. ~

UNITED STATES MAGISTRATE JUDGE

Page 42 of 42

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 1 of 57
AO 93 (Rev. 12/09) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the 

Southern District of Florida 

In the Matter of the Search of

)

)


(Briefly describe the property to be searched
or identifY the person by name and address)

) Case No.

19-6034-SNOW


)
)
)

Oakland Park, Florida
(further described in Attachment "A")

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Southern
District of
Florida
(identifY the person or describe the property to be searched and give its location):
Oakland Park, Florida

(further described in Attachment "A")

The person or property to be searched, described above, is believed to conceal

(identifY the person or describe the

property to be seized):

See Attachment "8"
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
YOU ARE COMMANDED to execute this warrant on or before 

(not to exceed 14 days) 


~ in the daytime 6:00 a.m. to 10 p.m.

o

at any time in the day or night as I find reasonable cause has been 

established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)

o I find that immediate notification may have an adverse result listed in 18 U.S.c. § 2705 (except for delay
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for
days (not to exceed 30).
o until, the facts justifying, the later specific date of
Date and time issued:
City and state:

Fort Lauderdale, Florida

I : :;).6
Lurana S. Snow, United States Magistrate
Printed name and title

Jud~

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 2 of 57

ATTACHMENT A
Oakland Park, Florida 33334.
The Subject Premises is a commercial space with a glass front door and glass windows covered
with a black fabric; a green awning bearing the letters "JVR" is above the door. A photograph of
the exterior of the Subject Premises is attached below.

Page 1 of1

 -

.,

Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 3 of 57

ATTACHMENT B 

Property to be seized from the Subject Premises 

I.

The items to be seized are fruits, evidence, information relating to, contraband, or

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code l512(b)(I) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a.   Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b.   Documents reflecting communications between Stone and Jerome Corsi;
c.   Documents reflecting communications between Stone and Randy Credico;
d.   Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,

,

Paul Manafort, Richard Gates, and Donald J. Trump;
e.   Documents related to or discussing the U.S . House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;

f.   Records and information relating to the e-mail accounts
and

;

g.   Records and information relating to the WhatsApp account associated with
telephone number

;

h.   Records and information relating to the Signal account associated with telephone
number

;

Page 1 of3

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 4 of 57

1.

Records and infonnation relating to the Wickr account associated with telephone
number

;

J.   Any computers, media storage devices, tablets/iPads, cellular telephones,

smruiphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k.   Records of personal and business activities relating to the operation and
ownership of the computer systems, such as telephone records, notes, notebooks,
diaries, and reference materials, in whatever fonn;

I.   Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever fonn;
2.

For any computer or storage medium whose seizure is otherwise authorized by

this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a.   evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
registry entries, configuration files, saved usernames and passwords, documents,
browsing history, user profiles, email, email contacts, "chat," instant messaging
logs, photographs, and correspondence;
b.   evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 2 of3

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 5 of 57

c.   evidence of the lack of such malicious software;
d.   evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
to crime under investigation and to the computer user;
e.   evidence indicating the computer user's state of mind as it relates to the crime
under investigation;

f.   evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;
g.   evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h.   evidence of the times the COMPUTER was used;
1.  

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.   documentation and manuals that may be necessary to access the COMPUTER or

to conduct a forensic examination of the COMPUTER;
k.   records of or information about Internet Protocol addresses used by the
COMPUTER;
I.   records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookrnarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;
m.   contextual information necessary to understand the evidence described in this
attachment.

Page 3 of3

 , .

.

Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 6 of 57

AO 93 (ReI'. /2/09) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy ofwarrant and inventory left with:

19-6034-SNOW

Inventory made in the presence of:
Inventory ofthe property taken and name ofany person(s) seized:

Certification

I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designatedjudge.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 7 of 57
AO 106 (Rev 04110) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of Florida
Jn the Matter of the Search of
(Briefly describe the property to be searched
or identify the person by name and address)
Oakland Park. Florida
in Attachment "A")

(further described

)
)
)
)

)

)


Case No. 19-6034-SNOW

APPLICATION FOR A SEARCH WARRANT
J, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that J have reason to bel ieve that on the following person or property (identify the person or describe the
property to be searched and give its location):
Oakland Park. Florida

Southern

located in the

(further described in Attachment "A")

District of

person or describe the property /0 be seized):

Florida

, there is now concealed

------------------------

(identify the

See Attachment "B"
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 

~ evidence of a crime; 

~ contraband, fruits of crime, or other items illegally possessed; 


~ property designed for use, intended for use, or used in committing a crime;
o a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section  
18 U.S.C. 1505
18U.S.C.1001
18 U.S.C. 1512(b)(1)

Offense Description

Obstruction of Proceeding 

False Statements 

Witness Tampering 


The application is based on these facts:
See attached Affidavit.

ri C  ontinued on the attached sheet.
o  Delayed notice of _

_ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.c. § 31 03a, the basis of which is set forth on the a ached sheet.

Curtis A. Heide, Special Agent, FBI
Printed name and ti/le

Sworn to before me and signed in my presence.
Date

rt it1
'-I

City and state: Fort Lauderdale, Florida  

Lurana S. Snow, United States Magistrate Judge
Printed name and /itle

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 8 of 57

ATTACHMENT A
Oakland Park, Florida

Page 1 of1

.

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 9 of 57

ATTACHMENT B 

Property to be seized from the Subject Premises 


1.

The items to be seized are fruits, evidence, information relating to, contraband, or

instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a.   Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b.   Documents reflecting communications between Stone and Jerome Corsi;
c.   Documents reflecting communications between Stone and Randy Credico;
d.   Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump;
e.   Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;

f.   Records and information relating to the e-mail accounts
and
g.   Records and information relating to the WhatsApp account associated with
telephone number

;

h.   Records and information relating to the Signal account associated with telephone
number

;

Page 1 of3

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 10 of 57

I.

Records and information relating to the Wickr account associated with telephone
number

;

J.   Any computers, media storage devices, tabletsliPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k.   Records of personal and business activities relating to the operation and
ownership of the computer systems, such as telephone records, notes, notebooks,
diaries, and reference materials, in whatever form;

1.   Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form;
2.

For any computer or storage medium whose seizure is otherwise authorized by

this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a.   evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
registry entries, configuration files, saved usernames and passwords, documents,
browsing history, user profiles, email, email contacts, "chat," instant messaging
logs, photographs, and correspondence;
b.   evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;

Page 2 of3

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 11 of 57

c.   evidence of the lack of such malicious software;
d.   evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
to crime under investigation and to the computer user;
e.   evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
f.   evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;
g.   evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h.   evidence of the times the COMPUTER was used;
I.  

passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

J.   documentation and manuals that may be necessary to access the COMPUTER or
to conduct a forensic examination of the COMPUTER;
k.   records of or information about Internet Protocol addresses used by the
COMPUTER;
I.   records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;
m.   contextual information necessary to understand the evidence described in this
attachment.

Page 3 of3

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 12 of 57

AFFIDAVIT IN SUPPORT OF 

AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
fNTRODUCTION AND AGENT BACKGROUND
1.

I make this affidavit in support of an application for a search warrant for the

premises known and described as

Oakland Park, Florida

described

in the following paragraphs and further in Attachment A.
2.

I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have

been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cy bersecuri ty.
3.

I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger

Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(l) (collectively the "Specified Federal
Offenses").
4.

I have personally participated in this investigation and am aware of the facts

contained herein based on my own investigation, as well as my review of documents, records,
and information provided to me by other law enforcement officers and technical experts.
5.

This affidavit is intended to show merely that there is sufficient probable cause

for the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance

Page 1 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 13 of 57

and part. Where I assert that an event took place on a particular date, I am asserting that it took
place on or about the date specified.
6.

I make this affidavit in support of an application for a warrant to search the

premises located at

, Oakland Park, Florida

(the "Subject Premises,"

as is more particularly described in Attachment A), in connection with the Specified Federal
Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband,
fruits, and instrumentalities of the Specified Federal Offenses.
7.

For the reasons set forth in this Affidavit, there is probable cause to believe that

one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.

PROBABLE CAUSE
A. Background on Relevant Individuals

8.

Roger Stone is a political consultant who has worked for decades in U.S . politics

and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.

Page 2 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 14 of 57

9.

Julian

is the founder and director of WikiLeaks, which is publicly

as a non-profit organization that disseminates non-public
provided by

sources.

government. At

and classified

posted numerous

relevant times,

was located at the

Embassy in

London, United Kingdom.
10.

is a political commentator who worked with an online media

Jerome

publication during

2016

presidential

As set forth

with Stone throughout the campaign, including about the

Corsi spoke
stolen documents

by WikiLeaks.

Based on

investigation to

Randy Credico was a radio host who has

known Stone for more than a decade. In testimony before the U.S.
Selection
Credico

on Intelligence

Representatives
26, 201

on or about

naming him) as an "intennediary,"

" and "mutual

to Assange. In a follow-up letter to HPSCI dated October 13, 201
name and  
.~_ ....,...,_,

had '" [e]mails

13.

Richard

along with Paul

was the

who confirmed for

identified
Stone" that

to Hillary Clinton which are pending publication.'"
citizen  

as a political

From in or around June 2016 until November

as the deputy campaign chainnan of the Trump Campaign. On February

Page 3 of 46

and
16, Gates
2018, Gates

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 15 of 57

guilty to one count

conspiracy against

statements to federal law

officers.

14.

Steve

the 2016

chief executive officer

16.

States v. Gates, 1: 1

presidential election,

served for years as a political consultant.
served as the

presidential campaign,

campaign ("Clinton Campaign").

Hillary Clinton
C',",,,.<>rr,h

email

that

receiving

within the email
a security

in or around May

his assistant (who

andpMl.pr~.r1

(a partial

a subsequent

an interview with

account
Based on my

which an actor would
emails and documents

spearphishing
context refers to
to be from a
or trusted sender in
in a desired manner, typically by clicking a
4

Podesta indicated

prompt to be
this

Podesta's email account, allowing the actor to

stolen emails,

had access to the account) clicked on a link
when prompted

been a successful spearphishing operation,

chairman of the

On or about March 24, 2016,

to appear as a

copy of the email was recovered by the
described below).

served as the

Election

is a U.S. citizen

John

t'O(leS'ra received a

1 (D.D.C.).

Campaign.

During the 2016

the 2016

making false

is a U.S. citizen who serves as a political consultant. Beginning in

or around August

B. Hacking

States and one count

46

aotJears to
gained access to
that account.

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 16 of 57

17.

The Democratic National Committee ("DNC") and Democratic Congressional

Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election.

According to DNC and DCCC individuals interviewed by

the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
the cybersecurity company CrowdStrike to investigate the intrusions and remediate.
IS.

On or about June 14, 2016, CrowdStrike issued a public press release announcing

that the DNC's computer network had been compromised. In the public statement, CrowdS trike
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
19.

On or about July 13, 201S, a federal grand jury sitting in the District of Columbia

returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, I: lS-cr-21S
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
military intelligence agency.

Page 5 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 17 of 57

C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
20.

As alleged in the Netyksho indictment, after successfully hacking the DNC and

DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks."

(GRU officers separately used these personas to release some of the stolen

documents).
21.

On or about July 22, 2016, WikiLeaks released tens of thousands of documents

stolen from the DNC network.

These stolen documents included communications by senior

DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
22.

Beginning in or around October 2016, WikiLeaks began to release tens of

thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
D. Stone's Communications About WikiLeaks During the Campaign

23.

In April 2018 interviews with the Special Counsel's Office, Richard Gates stated

that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then­
candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC
emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they
discussed WikiLeaks and Stone's prediction of the release.

Page 6 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 18 of 57

24.

According to Gates, Manafort directed Gates to contact Stone about any

additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's
Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
25.

Emails recovered through a court-authorized search of Stone's email account
show that shortly after the July 22, 2016 release of stolen DNC emails

by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to

, who lived in the United Kingdom and who was a

supporter of the Trump Campaign.

A search of
was authorized on or about September II, 2017 by the
U.S. District Court for the District of Columbia. Case No.1 :17-mj-661 CD.D.C. Sept. 11,2017).
A second search of
was authorized on or about August 3, 2018 by the
U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 CD.D.C. Aug. 3, 2018).
On or about September 26, 2018, the government obtained and executed an order pursuant to 18
U.S.c. § 2703Cd) for records connected to
. Case No. 1:18-sc-2911
CD.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that
the account was still active and that the relevant emails described in this affidavit were not
deleted from the account.

2

Page 7 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 19 of 57

b.   On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that

"should see Assange."

c.   On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
Impact planned to be very damaging." In a law enforcement interview, Corsi
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke ­
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
26.

According to recorded public statements recovered by the FBI, starting in early

August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a.   According to a public video posted to YouTube, on or about August 8, 2016,
Stone attended a public event in Broward County, Florida. During the event,
Stone stated, "I actually have communicated with Assange. I believe the next
tranche of his documents pertain to the Clinton Foundation, but there's no telling
what the October surprise may be."
b.   According to a public video posted to YouTube, on or about August 12, 2016,
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex

Page 8 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 20 of 57

Jones. During the interview, Stone stated that he was "in communication with
Assange" but was "not at liberty to discuss what I have."
c.   According to a public video posted to YouTube, on or about August 16, 2016,
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-chatmel communications with WikiLeaks
and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
that they had a "mutual acquaintance who is a fine gentleman."
d.   According to a video posted to the public website of the TV station C-SPAN,
during a C-SP AN television interview on or about August 18, 2016, Stone stated
that he had communicated with Assange through an "intermediary, somebody
who is a mutual friend."
e.   In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with
Assange.

Can you give us any kind of insight? Is there an October surprise

happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
a mutual friend, somebody we both trust and therefore I am a recipient of pretty
good information."
27.

In or around November 2018,

, Stone

produced a series of text messages between Stone and Credico during the 2016 presidential

Page 9 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 21 of 57

campaign. 3

text  

on or about

19,

WikiLeaks
do.

6, Stone
planned to

recovered through a court-authorized search of Stone's email account
show

about WikiLeaks in or around

a.  

or about

written communications between

and Credico

2016.
Credico sent a text message to

part, "I'm going to have Julian
about August 21,
part, "I have Julian
b.   On or about

that read in

on my show next Thursday." On or

16, Credico sent

writing in

text message to

on Thursday so

completely

on that day."

2016, Assange was a

on

radio show for

the first time. On or about August 26, 2016, Credico sent a text
that stated,

'UU~.",",_

talk[ed] about you

Assange said, to which Credico responded,
about how

is trying to

" Stone replied and asked what
we were

didn't say

it look like you and he are in

cahoots."
c.   On or about August
are working on a
of the

that said, "We

2016, Credico sent text messages to
Assange

was "in

" and that he

In a text

sent later that

Credico added,

"Julian Assange has kryptonite on Hillary."
d.   On or about
"I am e-mailing u a

18, 2016, Stone sent a text message to
to pass on to

" Credico

As
below, Stone had previously released some
these text
the media, who had written about
and published them in part.

3

10

46

"''''''''''F>''''''

that said,
"Ok," and

to members of

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 22 of 57

added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e.   Later on or about September 18, 2016, Stone emailed Credico an article with
allegations against then-candidate Clinton related to her service as Secretary of
State.

Stone stated, "Please ask Assange for any State or HRC e-mail from

August 10 to August 30 -- particularly on August 20, 2011 that mention [the
subject of the article] or confirm this narrative."

f.   On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September
20, 2016, Credico forwarded the request to a close friend who was an attorney
with the ability to contact the Assange. Credico blind-copied Stone on the
forwarded email.
g.   On or about September 30, 2016, Credico sent Stone via text message a
photograph of Credico standing outside the Ecuadorian Embassy in London
where Assange was located.
h.   On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
press had reported that Assange planned to make a public announcement on or
about Tuesday, October 4, 2016, which was reported to be the lO-year
anniversary of the founding of WikiLeaks.

Page 11 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 23 of 57

1.

On or about October 2, 2016, Stone emailed Credico, with the subject line
"WTF?" and a link to an article at the website http://heatst.com/politics/october­
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement­
due-to-security-concerns. Credico responded to Stone, "head fake."

J.   On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it[']s on for
tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
28.

Emails and text messages recovered by the FBI show that, in or around October

2016, Stone made statements about Assange's future releases that were similar to prior
statements made by Credico to him. For example:
a.   In a court-authorized search of Stone's email accountp
FBI recovered an email from Stone to

the

sent on or about October 3, 2016,

which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
b.   In a court-authorized search of

, the FBI also recovered an

email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange ­

4 A search of
was authorized on or about October 17, 2017 by the U.S.
District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A
was authorized on or about August 3, 2018 by the U.S.
second search of
District Court for the District of Columbia. Case No.1: 18-sc-2583 (D.D.C. Aug. 3,2018).
Page 12 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 24 of 57

what's he got?

it's good,"

responded,

I'd tell Bannon but he

doesn't call me back."
c. On or about

4,2016,

held a

conference but

new materials pertaining to the Clinton Campaign.
search

, the FBI
and Steve

JJUl'HV

an email

Bannon

.~~~...~_

responded,

are going to

do[wn]. However - a load

Serious security

London police are standing
forward."

week

recovered text

d. In a court-authorized search of Stone's iCloud account,S the

on or about October 4, 201

and
text

confirmed that

Whatsapp." In an

- want to talk on a secure line
Counsel's

interview with the
and Stone

more material to

In one

if he had "hear[d] anymore from London."

asked
replied,

press

"What was that this morning???"

s press conference.

concern. He thinks

In a court-authorized

on or about October 4,2016 that occurred

In
referring to

not release

in or around May 2018,

and that

and

told him WikiLeaks had

material was related to

people

associated with Clinton.
29.

or about

7, 201

WikiLeaks 1..""""";)""\..1 the first set

Podesta. According to text messages recovered
the

r"'''ArC1<'

the

an associate

Bannon sent a text message to

stolen

Stone's iCloud account, shortly after
that read

done." Similarly,

iCloud account was authorized on or about March 14, 2018 by the U.S.
District
Columbia. Case
1: 18-sc-662
Mar. 1
18). The
for Stone's iCloud account contained some, but not all, of Stone's communications
period.
Page 13

46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 25 of 57

during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
Stone said, "I told you this was coming."

E.   Stone's Communications with the House Permanent Select Committee on
Intelligence
30.

On or about January 25, 2017, HPSCI publicly disclosed that it was investigating

allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (particularly those from August 2016)
were of interest to the committee.
31.

In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily

appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account
). The letter requested Stone produce:
Any documents, records, electronically stored information
including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's
publicly-announced parameters.
32.

On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and

stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any
6 On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.

Page 14 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 26 of 57

facts within the investigation's publicly-arulOunced parameters."

(A copy of the letter was

recovered from a court-authorized search of Stone's email account

).

F. Stone's Testimony Before HPSCI
33.

On or about September 26, 2017, Stone provided HPSCI with an "opening

statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34.

Also on or about September 26, 2017, Stone provided testimony in a closed

session before HPSCI, at the U.S. Capitol in Washington, D.C.

Stone's testimony was

transcribed, and a copy of the transcript was obtained by the Special Counsel ' s Office from
HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for
the record that he would tell the truth. At the beginning of the hearing, Stone was admonished
that "it is unlawful to deliberately provide false information to Members of Congress or staff'
and that "providing false information to this committee or concealing material information from
this committee is a crime punishable by law."

Stone's Testimony About Documents He Possessed Related to WikiLeaks
35.

During his HPSCI testimony, Stone was asked about HPSCI's May 2017

document request and whether Stone had any documents or written communications that
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 27 of 57

discussed Julian Assange, Russian interference, or other relevant documents:
Q:  

The committee wrote to you on May 9th requesting no later
than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no
documents, records, or electronically stored information
regardless of form responsive to our requests. Was that a
false statement?

A:  

That is not a false statement. That's what -- I believe that
to be true.

[ ... ]

36.  

Q:  

So you have no emails to anyone concerning the allegations
of hacked documents or your conversations with the
Guccifer 2[.0] or any discussions you have had with third
parties about Julian Assange? You have no emails, no texts,
no documents whatsoever, any kind of that nature?

A:  

That is correct. Not to my knowledge. I think we met,
again, the precise criteria of your request, and we complied.
Again, if you have a more specific request, I'm happy to go
back and look ....

Q:  

I just want to ask you under oath-

A:  

We did an extensive search consistent with the direction of
my attorneys, and we found nothing that met the criteria
that you asked for.

Q:  

I just want to be certain because you are under oath, where
your letter was not under oath, that you have no documents,
no emails, no texts, no tweets that refer to Julian Assange
or Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've
written no documents yourself.

A:  

In connection with Russian collusion, consistent with your
exact and precise request, yes.

In fact, and as described above, Stone had sent and received numerous emails and

text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and

Page 16 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 28 of 57

WikiLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
and his iCloud account show
that, at the time of his testimony, Stone was still in possession of many of these emails and text
messages at the time he testified on or about September 22, 2017. 8

These written

communications included (a) Stone's email to Corsi on or about July 25, 2016 that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails . ..
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
"should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part, "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to

on or

about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
WikiLeaks would release "a load every week going forward."

Stone's Testimony About His Early August 2016 Statements
37.

During his HPSCI testimony on or about September 26,2017, Stone was asked to

explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
The warrant for Stone's email account
was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the
account was active and the emails in question were not deleted from the account. The warrant
for Stone's email account
was obtained on or about October 17,2017 and
executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text
messages described above) was obtained on or about March 14, 2018 and executed shortly
thereafter.
8

Page 17 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 29 of 57

communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38.

Stone testified that these public references to having a means of contacting

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13,2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had '" [e]mails related to Hillary Clinton which are pending pUblication. "').
39.

In fact, documents recovered during the investigation (including those obtained
) show that Stone did not begin

via search warrant returns

communicating with Credico about Assange or WikiLeaks until on or about August 19,2016 9­
approximately eleven days after Stone first claimed on or about August 8, 2016 to "actually have
communicated with Assange" and a week after his August 12, 2016 statements of being "in
communication with Assange" and "not at liberty to discuss what I have."
40.

When interviewed by the FBI, Credico stated that the first time he ever spoke

with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico
also provided the FBI with partially redacted emails that he claimed were between he and
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the
As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016,
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico
texted Stone that "Assange has kryptonite on Hillary."

9

Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews.
10

Page 18 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 30 of 57

technical logistics for the interview later that day.

During the exchange, Credico offered

biographical information about himself, apparently as a means of introduction.
41.

The FBI has not identified any communications between Stone and Credico from

August 2016 in which Stone directs Credico to contact Assange or WikiLeaks.

When

interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to
contact WikiLeaks.
42.

In

contrast,

and

as

described

above,

the

FBI

has

identified

written

communications prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [aJt
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly." Similarly, on or about August 2, 2016, Corsi-not Credico-sent an
email to Stone in which Corsi wrote that "[w Jord is friend in embassy plans 2 more dumps,"
including one in October.

These communications occurred days before Stone's first public

statement on or about August 8, 2016 claiming to be in communication with Assange. However,
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a
"go-between," "intermediary," or other source for information from WikiLeaks.

Similarly,

Stone also never disclosed his written communications with Corsi to HPSCI when answering
HPSCI's questioning about the August 8, 2016 and August 12, 2016 statements about being in
communication with Assange.

Stone's Testimony About Communications to Assange
43.

During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary J to

communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,

Page 19 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 31 of 57

"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
44.

In fact, starting on or about September 18, 2016, Stone directed Credico to pass

on a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a.   According to text messages

, on or about

September 18, 2016, Stone sent a text message to Credico that said, "I am e­
mailing u a request to pass on to Assange." On or about the same day, Stone
emailed Credico an article with allegations against then-candidate Clinton related
to her service as Secretary of State. Stone added, "Please ask Assange for any
State or HRC e-mail from August 10 to August 30 - particularly on August 20,
2011 that mention [the subject of the article] or confirm this narrative." (A copy
of this email was obtained through a search of Stone's email account
).
b.   According to text messages

, on or about

September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Assange."

Credico responded, "I did."

An email obtained from the account

shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.

Stone's Testimony About Written Communications with Credico
45.

During

his

HPSCI

testimony,

Stone

was

asked

repeatedly

about

his

communications with the person he identified as his intermediary. Stone stated that he had never

Page 20 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 32 of 57

communicated with his intermediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intermediary telephonically:
Q:  

[H]ow did you communicate the intermediary?

A:  

Over the phone.

Q:  

And did you have any other means of communicating with
the intermediary?

A:  

No.

Q:  

No text messages, no - none of the list, right?

A:

No.

Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:

46.  

Q:  

So you never communicated with your intermediary
writing in any way?

A:  

No.

Q:  

Never emailed him or texted him?

A:  

He's not an email guy.

Q:  

So all your conversations with him were in person or over
the phone.

A:  

Correct.

In

As described above, Stone and Credico (whom Stone identified as his

intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.

Page 21 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 33 of 57

47.

Written communications between Stone and Credico continued up until Stone's

HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary-Stone and Credico exchanged over thirty text messages.
48.

Certain of the electronic messages between Stone and Credico (which Stone

denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
email was obtained through a search of Stone's email account

).

Stone's Testimonv About Communications with the Trump Campaign
49.

During his HPSCI testimony, Stone was asked, "[d]id you discuss your

conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:

Page 22 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 34 of 57

a. As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials by telephone to inform them about materials possessed
by Assange and the timing of future releases.
b.   According to text messages
October 3, 2016, Stone wrote to

, on or about
, "Spoke to my friend in London last night.

The payload is still coming."
c.   As described above, on or about October 4, 2016, after receiving information
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
release "a load every week going forward."

G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI
50.

According to an email recovered through a court-authorized search of Stone's

email accountp

. on or about October 19, 2017, Stone sent Credico an

excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
51.

In or around November 2017, Credico received a request from HPSCI to testify

voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.

Page 23 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 35 of 57

a.   On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' .. . Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCl's request for a voluntary
interview.
b.   On or about November 21, 2017, Credico texted Stone, "1 was told that the house
committee lawyer told my lawyer that I will be getting a subpoena."

Stone

responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of
these text messages was recovered through a court-authorized search of Stone's
iCloud account).
c.   On or about November 28, 2017, Credico received a subpoena compelling his
testimony before HPSCI. Credico informed Stone of the subpoena.
d.   According

to

emails

recovered

from

Stone's

email

account

, on or about November 30, 2017, Stone asked Corsi to
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."

Page 24 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 36 of 57

e. According to text messages recovered from Stone's iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part

II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1, 2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information
from investigators.

f.   On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You
need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain

[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
52.

On or about December 12, 2017, Credico informed HPSCI that he intended to

assert his Fifth Amendment privilege against self-incrimination if required to appear by
sUbpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
53.

Following Credico's invocation of his Fifth Amendment privilege not to testify

before HPSCI, Stone and Credico continued to have discussions about the various investigations

Page 25 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 37 of 57

into Russian interference in the 2016 election and what infonnation Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
to prevent Credico from cooperating with the investigations. For example:
a.   On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi ...
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
copy of these text messages was recovered through a court-authorized search of
Stone's iCloud account).
b.   On or about April 9,2018, Stone wrote in an email to Credico, "You are a rat.
You are a stoolie. You backstab your friends-run your mouth my lawyers are
dying Rip you to shreds." Stone also said he would "take that dog away from
you," referring to Credico's dog.

On or about the same day, Stone wrote to

Credico, "I am so ready. Let's get it on. Prepare to die [expletive]." (A copy of
this email exchange was recovered through a court-authorized search of Stone's
email account

).

c.   On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact the head of Assange]."
(A copy of this email exchange was recovered through a court-authorized search
of Stone's email account

). Credico believed Stone knew

Page 26 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 38 of 57

that Credico was sensitive to having this friend's name publicly disclosed.

H. Missing Electronic Communications and Stone's Use of Encrypted Communications
54.

As described above, the government has recovered the content of many of Stone's

electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election).

However, the government is aware of the

existence of numerous other relevant electronic communications, the content of which it has not
yet been able to recover.
55.

As described above, during his HPSCI testimony, Stone falsely denied having

emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico).

In fact, emails and text messages recovered in this investigation show the two

communicated frequently by email and text messages; court-authorized searches of Stone's
email and iCloud accounts confirm that Stone still had those communications at the time he
testified in or around September 2017.

In numerous communications, Stone and Credico

discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
intermediary to Assange. These communications appear relevant and responsive to HPSCI's
inquiry, but Stone never disclosed them.
56.

In addition to these emails and text messages in the FBI's possession, the FBI has

reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or

Page 27 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 39 of 57

reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
corruptly persuade Credico not to cooperate with pending investigations.
57.

Additionally, the FBI has interviewed mUltiple associates of Stone, who

confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses multiple applications designed for
encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)

II According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default
message application.
12 According to open sources, Signal is an encrypted communications application allowing the
user to send one-to-one and group messages, which can include files, voice notes, images and
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile
numbers as identifiers, and uses end-to-end encryption to secure all communications to other
Signal users. Signal also allows users to set timers to messages, after which the messages will be
deleted from both the sender's and the receivers' devices.

According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
13

Page 28 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 40 of 57

ProtonMail.

14

To date, the FBI has not obtained any of Stone's communications conducted

through these applications.
a.   According to records from Stone's iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5,2016. As described above, on or about October 4,2016, Stone suggested in an
email to

that they "talk on a secure line" and proposed using

WhatsApp.
b.   According to records from Stone's iCloud account, a copy of the Signal
application was downloaded to an iPhone registered to Stone on or about August
18,2016. Additionally, text messages recovered from Stone's iCloud account
revealed that on or about November 15, 2016, Stone sent an attorney with the
ability to contact Julian Assange a link to download the Signal application. IS
Approximately fifteen minutes after sending the link, Stone texted the attorney,
"I'm on signal just dial my number." The attorney responded, "I'll call you."
c.   According to records from Stone's iCloud account, a copy of the ProtonMail
application was downloaded to an iPad registered to Stone on or about August 18,
2016.

14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.

This attorney was a close friend of Credico's and was the same friend Credico em ailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
IS

Page 29 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 41 of 57

d. According to records from Stone's iCloud account, a copy of the Wickr
application was downloaded to an iPhone

to Stone on or about August

201
58.

Based on

training

electronic

applications such as WhatsApp,

using encrypted

ProtonMail, and Wickr are sometimes maintained on the

used to send and receive

communications.

Communications from

applications can be obtained by law enforcement by searching the device either manually or via a
data extraction device (such as Cellebrite).
including text messages
Wickr,

messages,

up to cloud accounts (such as an iCloud account).

of the

downloaded application can reveal

to seek

The

evidence

logs and contact lists.

encrypted communications, such as

communications and contacts

1...,.""1",, of

during the period of the 2016 U.S. presidential

and through the

The

communications may contain evidence of additional communications concerning

believes
"",,,,11""''-',

physical device can

messages exchanged over WhatsApp, Signal, ProtonMail,

that have not been

Additionally,

of

of

WikiLeaks, and the

documents damaging to the Clinton Campaign.

Such communications could constitute additional evidence of Stone's
HPSCI's investigation

showing additional contacts and communications

to obstruct
and

WikiLeaks that Stone failed to disclose.

I. Other Relevant Records
60.

On or about May 8, 2018, a law

was conducted.

interview of

was an employee of Stone's from approximately June 2016

through approximately December

16 and resided

30 


Stone's

New York apartment for

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 42 of 57

a period of time.
trained to do so.

provided infonnation technology support for Stone but was not fonnally
was aware that Stone communicated with Trump during the 2016

presidential campaign, and afterward, both in person and by telephone.

provided

infonnation about a meeting at Trump Tower between Trump and Stone during the time
worked for him, to which Stone carried a "file booklet" with him.
booklet was important and that no one should touch it.

Stone told

the file

also said Stone maintained the file

booklet in his closet.
61.

On or about December 3,2018, law enforcement conducted an interview of an

individual ("Person 2") who previously had a professional relationship with a reporter who
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or
around January and February 2016, Stone and Trump were in constant communication and that
Stone kept contemporaneous notes of the conversations. Stone's purpose in keeping notes was to
later provide a "post mortem of what went wrong."

J. The Subject Premises
62.

Your affiant is aware through the investigation that Stone maintains the Subject

Premises as his personal office and has done so since at least the 2016 Campaign. Public
reporting indicates that Stone occupied SUbject Premises as his office during the 2016
Campaign. 16 An April 17,2017 news article also described Stone's "personal office" at a
location matching the description of the Subject Premises. 17

16 See Roger Stone.' Inside The World Of A Political Hitman, CBS Miami, April 17, 2016,
available at https:llmiami.cbslocal.comJ20 16/04117lroger-stone-inside-the-world-of-a-political­
hitmanl ("CBS4's Jim DeFede has known Stone for years and visited him recently at his office in
a nondescript building in an industrial section of Oakland Park that houses his collection of
Nixon memorabilia.").

17 See Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,
Washington Post, April 19, 2017, available at https:llwww.washingtonpost.comJlifestyle/style/

Page 31 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 43 of 57

to

63.

iCloud

recovered

above),

court-authorized search

on or about

31, 2014

lease for your signature,"
(The recovered

contained no further content).

sent another individual

address of

Subject

On or about November 27, 2017, Stone

address of the Subject Premises while arranging a meeting.

64.

text

Premises as

with the

show that

has repeatedly identified the

office.

a.   On or
"to

March 30, 201

Stone directed another individual to send a reporter
, Stone ..",<,,,,,,,,,,1'1,:.1'1

office." When the other individual asked

" which corresponds to the address of the

in "Oakland
Premises.

with an individual who

b.   On or about April 8,2017, Stone exchanged

" a freelance photographer

as

identified

Washington

In the exchange, the photographer wrote he "would like to photograph you
morning ... April 11 if that is convenient." Stone responded,

first thing

"Yes - let me figure out
your

" The photographer then wrote that "[t]he

that would

a good location

which is

me."

replied,

ofthe Subject Premises.

roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth ("The
and broadcast studio calls for locating a "door
next part of the directions to his personal
marked
' " which
helpful,
the crucial
that there is no
"A" at the new
next to a
supplies
There is,
discreetly
shorts,
a blacked-out door with no markings, and the man who emerges
behind it,
loafers with no socks, a
loosened tie and an untucked
dress shirt, is unmistakably
").
Page

46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 44 of 57

In

text

from Stone's

Premises as a "warehouse."

or about July 25,

"Warehouse has very high

cable if u want to use '

refers to the Subject

15,

wrote another individual,
office. '"

November 10,2017, Stone wrote an individual, "U don't need an
our warehouse avail
66.

On or about

speed [inter] net at

"

On or about May 18, 2018, investigators interviewed an individual ("Person 1")

described himself as

m

summer

1 stated that

as of May 2018, he worked at

hours a week for Stone. Communications recovered

from Stone's account

communicated with

Campaign and afterwards through May

18. Those communications included matters related to

the 2016 Campaign and
67.

Person 1 told

home in Florida or at
that Stone
68.

During

2019, the FBI observed
individuals believed to host a
button-down shirt and tie)

duration of the

media presence.
that as of May 2018, he
Fort Lauderdale (the

out of Stone's
....p ..,"£'on

1 further

in the Subject
on or about January 17,

of the Subject
enter the Subject Premises.

Stone was accompanied by two

The following photographs
Subject Premises was taken on

33 of 46

(wearing a light

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 45 of 57

K. Computer Devices at the Subject Premises
69.
and

uses

Based on law enforcement interviews, your affiant is aware that Stone has used
cellular telephones,

desktop,

and

laptop

computers

to

conduct electronic

communications. Stone also configures his computers to create regulars backups.
70.

As described above, in text messages recovered from Stone's iCloud account,

Stone indicated the Subject Premises has high-speed internet service (referred to as having "very
high speed cable" and "high speed net").
71.

As described above, on or about April 8, 2017, Stone and a photographer hired by

the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order

Page 34 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 46 of 57

for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post
published a lengthy article about Stone that featured the following two photographs 18:

"Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,"
Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.comllifestyle/style/
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worthl2017/
041l81l518184e-236f-lle7-b503-9d616bd5a305 _story.html?utm_term=. 7576648d5cel.
18

Page 35 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 47 of 57

Both photographs were credited to the photographer with the first name "

," and the

caption of the latter photograph read in part, "Stone in his memorabilia-overrun office." The
photographs depict, among other things, multiple computer accessories, including a monitor,
microphone, and printer.
72.

In addition, messages recovered from the court-authorized search of Stone's

iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from
his office, further indicating he likely has a computer present there. 19 For example, on or about
December 13, 2017, Stone coordinated an upcoming interview with another individual by text
message. Stone confirmed the interview, writing that he would participate via "Skype from our
Florida studio with green screen."
73.

In or around May 2018, as discussed above, the FBI interviewed Person 1, who

worked for Stone.

Person 1 told the FBI that Stone maintained a computer at the Subject

Premises.
74.

In or around May 2018, the FBI interviewed an individual (Person 2) who

provided information technology services to Stone. Person 2 stated that Stone used the Apple
Time Machine ("Time Machine") application to facilitate backups of his computers. According
to publicly available information, Time Machine is the built-in backup feature of Apple
computers and can create copies of files on a computer, including applications, music, photos,
email,documents, and system files. A Time Machine backup allows users to restore files from a
specific point in time if the original files are ever deleted, or if the hard drive is erased or

According to publicly available information, Skype is a telecommunications application
software that specializes in providing video chat and voice calls between computers, tablets,
mobile devices, and similar devices via the internet.
19

Page 36 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 48 of 57

replaced. In order to create backups with Time Machine, a user connects an external storage
device to the computer and selects that external storage device as the backup disk,zo
75.

show that,

Records produced by AT&T

since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
telephone number (ending in

. According to AT&T, between approximately January 1,

2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
On or about September 28, 2018, Stone's cellular telephone number was

310410930460769).

transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814).
76.

Records produced by Uber Technologies, Inc.,

show that the account associated with Stone's telephone number and email address has the Uber
application on multiple devices, including a device identified as iPhone11,2, UDID - 668EDC66­
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier
"iPhonel1,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
identified

a

device

DE08401 EDA 74.

identified

as

iPhone9,4,

UDID

-

7161 CF59-6Fl 0-41 C8-984B­

Publicly available information indicates that the identifier iPhone9,4

correlates to an Apple iPhone model iPhone 7 Plus.
77.

Records obtained from a court-authorized pen register/trap & trace ("PRTT")

monitoring of Stone's personal cellular telephone number

21 shows recent activity

20 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 37 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 49 of 57

indicating Stone continues to use the number and its associated device.
records show that between January 1,

19

to make or receive over 150
Likewise, a court-authorized
number

2

13 WhatsApp

For

January 10, 2019, telephone number
calls and send or receive over

was

text

WhatsApp account (which is
WhatsApp account was
two WhatsApp voice calls

to
or
on or

January 1,2019 and January 10,2019.
78.

Statements attributed to

in recent media articles also indicate that

retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November
messages between Stone and Randy

18, media reports began to publish excerpts
that occurred during the 2016 U.S.

messages to the

According to these news

"a cell phone he stopped using in

were

23

to

AT &T records (which records indicate

21 Installation and use of PRTT
District of Columbia on or about
2018).
Installation and use of PRTT devices
District Court for the District
(D.D.C. Dec. 11,2018).

16."

the cellular telephone referenced in

the iPhone 5s documented

22

23

from Stone

text messages subsequently were

on these statements, your

text

was authorized by the U.S. District Court
18. Case No.1: 18-pr-l

WhatsApp account was authorized
on or about December 11, 2018.

e.g., "Bombshell

Stone's Claims About
Backchannel,"
Daily
14,
2018,
available
https:lldailycaller.coml20 18/11 114/roger-stone-wikileaks-randy-credico-mueller.
38 


at

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 50 of 57

stopped using on or about November 14, 2016).24 Further, your affiant believes Stone maintains
other devices he is no longer actively using.
COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS
79.

As described above and in Attachment B, this application seeks permission to

search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule

41 (e)(2)(B).
80.

Probable cause. I submit that if a computer or storage medium is found on the

Subject Premises, there is probable cause to believe those records will be stored on that computer
or storage medium, for at least the following reasons:
a.   Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet.
Electronic files downloaded to a storage mediwn can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.

24

, Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occurred on or about November 14,
2016. The government believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.
Page 39 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 51 of 57

b.   Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
a "swap" or "recovery" file.
c.   Wholly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file
system data structures, and virtual memory "swap" or paging files. Computer
users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d.   Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache."

81.

Forensic evidence. As further described in Attaclunent B, this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Subject Premises because:

Page 40 of46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 52 of 57

a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
e-mail programs, and chat programs store configuration information on the
storage medium that can reveal information such as online nicknames and
passwords.

Operating systems can record additional information, such as the

attachment of peripherals, the attachment of USB flash storage devices or other
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
b.   As explained herein, information stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
innocent from further suspicion.

In my training and experience, information

stored within a computer or storage media (e.g., registry information,
communications, images and movies, transactional information, records of
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
computer or storage media. This "user attribution" evidence is analogous to the

Page 41 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 53 of 57

search for "indicia of occupancy" while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and malware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
For example, as described herein, computers typically contains information that
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
and the internet.

Such information allows investigators to understand the

chronological context of computer or electronic storage media access, use, and
events relating to the crime under investigation. Additionally, some information
stored within a computer or electronic storage media may provide crucial
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data.

Such file data

typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
digital camera or cellular phone with an incorporated camera). The geographic
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under

Page 42 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 54 of 57

investigation. For example, information within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
criminal planning), or consciousness of guilt (e.g., running a "wiping" program to
destroy evidence on the computer or password protecting/encrypting such
evidence in an effort to conceal it from law enforcement).
c.   A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
d.   The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process.

While it is possible to specify in

advance the records to be sought, computer evidence is not always data that can
be merely reviewed by a review team and passed along to investigators. Whether
data stored on a computer is evidence may depend on other information stored on
the computer and the application of knowledge about how a computer behaves.
Therefore, contextual information necessary to understand other evidence also
falls within the scope of the warrant.
e.   Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
of counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.

Page 43 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 55 of 57

82.

Necessity ofseizing or copying entire computers or storage media. In most cases,

a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media.

Generally speaking, imaging is the taking of a complete

electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
destruction. This is true because of the following:
a.   The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site.

Analyzing

evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
examine storage media to obtain evidence.

Storage media can store a large

volume of information. Reviewing that information for things described in the
warrant can take weeks or months, depending on the volume of data stored, and
would be impractical and invasive to attempt on-site.
b.   Technical requirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application software, and
configurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware

Page 44 of 46

 9 

Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 56 of 57

I'

and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its examination with the proper tools and knowledge.
c.   Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing
with specialized forensic tools.

83.

Nature of examination.

Based on the foregoing, and consistent with Rule

41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
order to determine whether it is evidence described by the warrant.
84.

Because multiple people share the Subject Premises as a residence, it is possible

that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as
well.

Page 45 of 46

 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 57 of 57

FILTER REVIEW PROCEDURES 

85.

Review of the items described in Attachment B will be conducted pursuant to

established procedures designed to collect evidence in a manner consistent with professional
responsibility requirements concerning the maintenance of attorney-client and other operative
privileges. The procedures include use of a designated "filter team," separate and apart from the
investigative team, in order to address potential privileges.
CONCLUSION
86.

Based on the foregoing, your affiant respectfully requests that this Court issue a

search warrant for the Subject Premises, more particularly described in Attachment A,
authorizing the seizure of the items described in Attachment B.
Respectfully submitted,

. A. Heide
Special Agent
Federal Bureau of Investigation

Sworn and subscribed before me on thisJ.-Y day of January, 2019.

)f~J, ~
L.4tfRANA S. SNOW
UNITED STATES MAGISTRATE JUDGE

Page 46 of46