Case Document 29-8 Filed 04/28/20 Page 1 of 23 A0 106 (Rev. 04/10) Application fora Search Warrant UNITED STATES DISTRICT COURT for the District of Massachusetts 111 the Matter of the Search of (Brie?y describe the property to be searched or idenn? The person by name and address) CaseNo. W466 The Person of? APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (idenn?! the person or describe the property 1?0 be searched and give its location): See Attachment A located in the District of Massachusetts there is now concealed (idenrijj) [he person or describe the property to be seizer?: See Attachment B. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): Erevidence of a crime; Efcontraband, fluits of crime, or other items illegally possessed; at property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section Offense Description 18 U.S.C. 2, 3, 4, 371, Aiding Abetting Accessory after the Fact Misprison of a Felony 1030, 1343 and 1349 Conspiracy 371); Computer Fraud 1030); Wire Fraud 1343); Attempt and Conspiracy to Commit Wire Fraud 1349). The application is based on these facts: See attached Affidavit. Ef Continued on the attached sheet. CI Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 310321, the basis of which is set forth on the attached sheet. 44%; Applicant ?5 Signature ?Curtis-Hgide', Special Agent, FBI Printed name and rifle Sworn to before me and signed in my presence. Lamont: City and state: Boston, Massachusetts United States Magistratetjudge Marianne B. Bowler Printed name and rifle Date: 03/27/2018 . iw . "Judge .3 Case Document 29-8 Filed 04/28/20 Page 2 of 23 A0 106 (Rev. 04/10) Application fora Search Warrant UNITED STATES DISTRICT COURT for the District of Massachusetts In the Matter of the Search of (Brie?y describe the property to be searched or irlein?i?) f/Ie person by name and address) APPLICATION FOR A SEARCH WARRANT CaseNo. [56? I, a federal law enforcement officer or an attorney for the govemment, request a search warrant and state under penalty of peljuiy that I have reason to believe that on the followmg person or property (Idenn?: rhe person or describe the property to be searched and give its location): See Attachment A located in the District of Massachusetts there is now concealed (identi?) the person or describe the property to be seized): See Attachment B. The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): Erevidence of a crime; Elf contraband, fruits of crime, or other items illegally possessed; Mproperty designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a Violation of: Code Section O?ense ipi?ion 18 U.S.C. 2, 3, 4, 371, Aiding Abetting Accessory after the Fact Misprison of a Felony 1030, 1343 and 1349 Conspiracy 371); Computer Fraud 1030); Wire Fraud 1343); Attempt and Conspiracy to Commit Wire Fraud 1349). The application is based on these facts: See attached Affidavit. i2], Continued on the attached sheet. Cl Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which is set forth on the ttached sheet. mm A7, ZAA Applicant ?9 signature Cums i-ieide,- SpeCIal Agent FBI (J ?raj-J. PI infed name and title Sworn to before me and signed in my presence. Date: 03/27/2018 City and state: Boston, Massachusetts United States Jud . Marianne B. Bowler PI I'm?ea? name and rifle Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 3 of 23 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS IN THE MATTER OF THE SEARCH OF THE PERSON OF Case No. J 'if-/V()-ol l'1c). -A-t_B~ Filed Under Seal IN THE MATTER OF THE SEARCH OF THE BAGGAGE OF Case No. I 1J - fVl:S"" _ ~ 11 '!> _ Mt3B, Filed Under Seal AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR SEARCH WARRANTS I, Curtis Heide, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for search and seizure warrants under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of (the Target Person) (described further in that warrant's Attachment A), and any baggage associated with him (described further in that warrant's Attachment A), and the seizure of the electronic devices and media described in Attachment B (the Target Devices). I anticipate this search will be executed after International Airport at approximately lands at Logan This warrant is for the seizure of the devices only; the Government will seek a warrant to search any seized devices at a later point in time. 2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of investigation for 11 years. In the course of my duties, I have been responsible for investigating federal crimes and national security matters involving both counterintelligence and issues related to cybersecurity. Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 4 of 23 3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my lrnowledge about this matter. 4. Based on my training and experience and the facts as set forth in this affidavit, there is probable cause to believe that ROGER STONE, JEROME CORSI and others have committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud) (the "Subject Offenses"). JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because, as described further below, it is anticipated that and his baggage will be located in the District of Massachusetts on SUMMARY 6. As set forth below, (the Target Person) was in contact with Roger STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have obtained advance lrnowledge of the release by WikiLeaks of illegally hacked emails for the benefit of the presidential campaign of Donald J. Trump (the "Campaign"). In July 2016, STONE instructed CORSI to have WikiLeaks, and talk with Julian AS SANGE, the founder of served as CORSI's conduit to ASSANGE to discuss hacked information. 2 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 5 of 23 7. More specifically, on or about July 25, 2016, STONE emailed CORSI to "Get to Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July 31, 2016, STONE instructed CORSI to have time, "see ASSANGE." At the lived in London, where Assange was located at the Ecuadorian Embassy. On or about August 2, 2016, CORSI told STONE that the "word is friend in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned to be very damaging .... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." Information disclosures subsequently occurred on or about the times CORSI predicted. 8. On or about August 10, 2016, began emailing CORSI multiple news articles regarding AS SANGE and alleged Russian involvement in the election. November 13, 2016, On or about emailed STONE to congratulate him on "tak[ing] the country back," and stating, "You deserve a lot of credit and working with you and Jeri Corsi, who is with me now in London has been a great joy." On or about January 7, 2017, emailed STONE and CORSI to joke about John Podesta going "phishing." As stated below, I know from my training and experience that the term "phishing" is used to refer to the practice of sending emails purporting to be from a reputable party in order to trick individuals to reveal to the sender personal information, including passwords. PROBABLE CAUSE TO BELIEVE THAT A FEDERAL CRIME WAS COMMITTED A. Background on Relevant Individuals i. Roger STONE 9. Roger STONE is a self-employed political strategist/consultant and has been actively involved in U.S. politics for decades. STONE worked on the Campaign until August 2015. Although STONE had no official relationship with the Campaign thereafter, STONE 3 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 6 of 23 maintained his support for Trump and continued to make media appearances in support of the Campaign. As described further below, STONE also maintained contact with individuals employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick GATES. ii. Jerome CORSI 10. Jerome CORSI is a political commentator who, according to publicly-available information, serves as the "Washington Bureau Chief for Infowars.com." According to publiclyavailable sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of books regarding Democratic presidential candidates. As described further below, CORSI was in contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of hacked information by WikiLeaks, and appears to have obtained information regarding upcoming disclosures which he relayed to STONE. 4 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 7 of 23 B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed Hacking Activity during the 2016 Presidential Election 12. On October 7, 2016, the U.S. Department of Homeland Security and Office of the Director of National Intelligence released a joint statement of an intelligence assessment of Russian activities and intentions during the 2016 presidential election. 1 In the report, the USIC assessed the following: 13. "The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process. Such activity is not new to Moscow-the Russians have used similar tactics and techniques across Europe and Eurasia, for example, to influence public opinion there. We believe, based on the scope and sensitivity of these efforts, that only Russia's senior-most officials could have authorized these activities." 14. On January 6, 2017, the USIC released a declassified version of an intelligence assessment of Russian activities and intentions during the 2016 presidential election entitled, 1 "Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on Election Security," Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-departmenthomeland-security-and-office-director-national. 5 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 8 of 23 "Assessing Russian Activities and Intentions in Recent US Elections."2 In the report, the USIC assessed the following: 15. "[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the US presidential election. Russia's goals were to undermine public faith in the US democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed a clear preference for President-elect Trump." 16. In its assessment, the USIC also described, at a high level, some of the techniques that the Russian government employed during its interference. The USIC summarized the efforts as a "Russian messaging strategy that blends covert intelligence operations-such as cyber activity-with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or 'trolls."' 17. With respect to hacking activity, the USIC assessed: "Russia's intelligence services conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties." In addition, "In July 2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and maintained that access until at least June 2016." The USIC further assessed that cyber operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) "resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC." 2 "Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at https://www.dni.gov/files/documents/ICA_ 2017_ 0 l .pdf. 6 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 9 of 23 18. With respect to the release of stolen materials, the USIC assessed "with high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets." 19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his likely Russian identity throughout the election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. C. Roger STONE's Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 20. Roger STONE is a self-employed political strategist/consultant and has been actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was fired in August 2015. Although STONE had no official relationship with the Campaign thereafter, STONE maintained his support for Trump and continued to make media appearances in support of Trump's presidential campaign. 21. As discussed further below, STONE made a number of public references to WikiLeaks and its release ofDNC-related emails. STONE has also stated that he was in contact via Twitter with Guccifer 2.0. 22. On June 14, 2016, news reports indicated that the computer systems of the DNC had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June 21, 2016 release of hacked documents. 23. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from the DNC. 7 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 10 of 23 24. On August 5, 2016, Roger STONE published an article on Breitbart.com entitled, "Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." STONE wrote: "It doesn't seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 2.0." STONE embedded publicly available Tweets from Guccifer 2.0 in the article and wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why he did the hack of the DNC." STONE also stated: "Guccifer 2.0 made a fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for themselves how the Democrats had rigged the game." 25. On August 8, 2016, STONE addressed the Southwest Broward Republican Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October surprise, what would be your forecast on that given what Julian Assange has intimated he's going to do?" STONE responded: "Well, it could be a number of things. I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation but there's no telling what the October surprise may be." A few days later, STONE clarified that while he was not personally in touch with Assange, he had a close friend who served as an intermediary. 26. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJSTONEJr thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone numbers and email addresses from the files of the Democratic Congressional Campaign Committee (DCCC). 8 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 11 of 23 27. On August 13, 2016, STONE posted a tweet using@RogerJSTONEJr calling Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's Twitter account was reinstated. 28. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJSTONEJr paying you back." Guccifer also sent a private message to @RogerJSTONEJr stating "i'm pleased to say u r great man. please tell me ifl can help u anyhow. it would be a great pleasure to me." 29. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate, resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S. policy toward Ukraine. 30. On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange], the public [could] expect to see much more from the exiled whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes." 31. On September 16, 2016, STONE said in a radio interview with Boston Herald Radio that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon. And that of course will answer the question of exactly what was erased on that email server." 9 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 12 of 23 32. On Saturday, October 1, 2016, using@RogerJSTONEJr, STONE Tweeted, "Wednesday@HillaryClinton is done. #WikiLeaks." 33. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez tweeted regarding an announcement Julian Assange had scheduled for the next day from the balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement which was part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his intermediary described this release as the "mother load." On Tuesday, October 4, 2016, STONE used @RogerJSTONEJr to tweet: "Payload coming. #Lockthemup." 34. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post published an article containing a recorded conversation from a 2005 Access Hollywood shoot in which Mr. Trump had made a series oflewd remarks. 35. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link to approximately 2,050 emails that had been hacked from John Podesta's personal email account. 36. WikiLeaks continued to release John Podesta's hacked emails throughout October 10-21, 2016. On October 12, 2016, John Podesta-referring back to STONE's August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails] and the Trump campaign had advanced warning about what Assange was going to do. I think there's at least a reasonable belief that [Assange] may have passed this information on to [STONE]." Commenting to the Miami Herald, STONE responded: "I have never met or spoken with Assange, we have a mutual friend who's traveled to London several times, and everything I know is through that channel of communications. I'm not implying I have any influence with 10 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 13 of 23 him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were deleted. I hear that through my emissary." 37. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing from an email address associated with WikiLeaks, denied that there was any backchannel communication during the Campaign between STONE and WikiLeaks. The same article quoted STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the limited things I did predict (Oct disclosures) all came true." D. Roger STONE's Private Twitter Direct Messages with WikiLeaks and Julian Assange. 38. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account @RogerJSTONEJr. 39. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account @wikileaks. This account is the official Twitter account ofWikiLeaks and has been described as such by numerous news reports. The message read: "Since I was all over national TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking me- cordially R." 11 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 14 of 23 40. Less than an hour later, @wikileaks responded by direct message: "We appreciate that. However, the false claims of association are being used by the democrats to undermine the impact of our publications. Don't go there if you don't want us to correct you/' 41. On October 16, 2016, @RogerJSTONEJr sent a direct message to @wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like a sieve. You need to figure out who your friends are." 42. On November 9, 2016, one day after the presidential election, @wikileaks sent a direct message to @RogerJSTONEJr containing a single word: "Happy?" @wikileaks immediately followed up with another message less than a minute later: "We are now more free to communicate." 43. In addition, @RogerJSTONEJr also exchanged direct messages with Julian Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJSTONEJr directly messaged @JulianAssange, an address associated with Julian Assange in numerous public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from the government and the courts ruled it was legal to do so and refused to issue an order restraining the paper from publishing additional articles. If the US government moves on you I will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down Trump trying to squeeze us into a deal." 12 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 15 of 23 44. On Saturday, June 10, 2017, @RogerJSTONEJr sent a direct message to @wikileaks, reading: "I am doing everything possible to address the issues at the highest level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this forum as experience demonstrates it is monitored. Best regards R." E. Roger STONE's Emails with Jerome CORSI and and WikiLeaks 45. about Assange On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for STONE's address On or about October 17, 2017 Chief Judge Howell issued a warrant for STONE's address, On or about December 12, 2017, Chief Judge Howell issued a warrant for Gmail address, Emails recovered pursuant to that search warrant indicated the following: 46. On or about May 23, 2016, emailed STONE with the subject, "Trump Campaign," to offer his assistance to the Campaign. wrote that he was "on to the notorious Oxford case already!" He also stated that he was "available, literally, as needed, to contribute in ways the campaign sees fit. I'd like to go to Cleveland and pitch in, raise money and work for you. Can you use me?" Cleveland, Ohio was the location of the 2016 Republican National Convention, held July 18-21, 2016. 47. On or about June 4, 2016, STONE emailed telling him to "Plan on going to Cleveland. Will need your help. Can handle credentials." 48. On or about June 20, 2016, emailed STONE and MANFORT, asking to "know immediately how I can help" the Campaign. also wrote that his "research on Rhodes House" was nearing completion. Rhodes House is the headquarters of the Rhodes 13 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 16 of 23 Trust, which provides scholarships to Oxford University, and the "Rhodes House" research appears to be a reference to STONE' s previous tweet on or about October 13, 2015 that, "In 1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old ." a month later, as discussed below. The STONE mentioned Wellstone again to "Rhodes House" research seems to be the same as the "notorious Oxford case" referenced by above. 49. On or about July 7, 2016, emailed STONE that he had "my tickets to Cleveland[.] [D]o you have my credential pack?" 50. On or about July 25, 2016, (approximately three days after WikiLeaks began releasing emails hacked from the DNC), , a commentator who had publicly accused the Clinton Foundation of fraud, emailed STONE with the subject line, "You need to get to Assange." The body of the message read: "At Ecuadorian Embassy in London and get the pending wikileaks emails ... they deal with Foundation, allegedly." 51. According to approximately ninety minutes later STONE called CORSI and they spoke for 26 minutes. 52. Less than two hours after the phone call to CORSI, STONE emailed CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with Foundation, allegedly." It appears that STONE cut and pasted the email from Ortel to CORSI. 53. On or abou~ July 27, 2016, then-candidate Donald Trump stated in a press conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton] emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if that happens. That will be next." 14 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 17 of 23 54. On or about July 28, 2016, Roger STONE called Richard GATES (then the deputy-chair of the Campaign). They spoke for approximately twelve minutes. 55. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the Campaign) called STONE. They spoke for approximately one hour and seven minutes. The Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven minutes is the longest call (by almost a half-hour) that took place between STONE and MANAFORT in this time period. 56. On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call me MON." The body of the email read: " should see Assange[.] should find Bernie sanders brother who called Bill a Rapist- turn him for Trump[.] should find or more proof of Bill getting kicked out." 57. On or about August 2, 2016, CORSI emailed STONE: "With family, 25th wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle." Based on my training, experience, and review of materials in this case, it appears that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in 2016. On or about August 12, 2016, Guccifer publicly released information hacked from the DCCC (the date CORSI identified as when he would "return home."). 15 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 18 of 23 58. On or about August 10, 2016, emailed CORSI an article titled, "Assange Warns of 'Triangle of Terror'- Clinton, Pentagon & Google." 59. On or about August 13, 2016, emailed CORSI a news article titled, "Assange Implies Murdered DNC Staffer Was WikiLeaks' Source." 60. On or about August 16, 2016, emailed CORSI an email with the subject line, "Vladimir Putin Has Already Won Our Election." The body of email contained two words: the word "VENONA" and the word "Observer." According to publicly available information, the "Venona Project" was a top-secret U.S. intelligence effort to gather and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13, 2016, the Observer had published an article titled, "Vladimir Putin Has Already Won Our Election" (the subject of the email). The subtitle of the article stated: "It's time to face facts: Kremlin spies and hackers are undermining American politics." The article further discussed how, "WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined DNC emails that were stolen by Russian intelligence." The article also stated that the "Kremlin is weaponizing stolen information for political effect." 61. On or about August 30, 2016, emailed Steve Bannon, who had become chief executive of the Campaign when MANAFORT left the Campaign on or about August 19, 2016, with STONE and CORSI cc'd. wrote offering his assistance and stating he had been "labouring non stop for the Trump campaign- even tho[u]gh I am all the way over here in Oxford.... I have been in constant touch with the campaign, Roger Stone and Jeri Corsi." 62. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 16 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 19 of 23 63. On or about November 13, 2016, emailed STONE. wrote, "Well, we did it and now have an opportunity of a lifetime to take the country back. God is good and we are well placed to steer things well. You deserve a lot of credit and working with you and Jeri Corsi, who is with me now in London has been a great joy." 64. On or about January 7, 2017, an individual named STONE, CORSI, and emailed with the subject line, "in case you need his mail. ........ " Attached to the message was a scan of a business card for John Podesta. Several hours later, replied: "Ha ... maybe he wants to go phishing with us?" 65. I know from my training and experience that the term "phishing" is used to refer to the practice of sending emails purporting to be from a reputable party in order to trick individuals to reveal to the sender personal information, including passwords. Public reports indicate that Podesta's emails were obtaining through a "phishing" scheme. F. U.K.-Based Email Account 66. address, In addition to his Gmail account, also uses a U.K.-based email Investigators found emails with this address in Gmail account. The U.K. email address was also listed in messages sent as a means of reaching him. A publicly-available database lists the U.K. email address as belonging to The U.K. email address is housed outside the United States, and investigators anticipate it may take substantial time to retrieve the messages on the account via a potential treaty request. In addition, it is possible that emails may have been deleted or no longer maintained. I know from my training and experienced that users often download and store emails on their phones, tablets, and laptops, such as the Target Devices. Even if information has been deleted by the user, the Government may be able to employ forensic tools to recover information 17 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 20 of 23 from his devices. In addition, as described further below, the Target Devices may include a variety of other stored communications, including voicemail, text message, and other third party messaging systems which may have used to communicate with CORSI, STONE, and others regarding WikiLeaks. THE PERSON AND BAGGAGE TO BE SEARCHED CONTAIN EVIDENCE, FRUITS, AND INSTRUMENTALITIES 67. I also have probable cause to believe that the person and baggage to be searched contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above, as described in the warrants' respective Attachments A and B. 68. Records indicate that has purchased a ticket on I know from my training and experience that individuals often carry electronic devices and storage media of the type described in Attachment B with them when they travel both on their persons and in their baggage. These devices and media include but are not limited to cellular phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives. 69. From my training and experience, I am also aware that personal computer systems are generally capable of creating, receiving, and otherwise processing computer files such as email, word-processing documents, photographs, and spreadsheets. As evidenced by the emails above, uses computer systems to communicate with CORSI and STONE regarding WikiLeaks. 70. Based on my training, experience, and information provided by other law enforcement officers, I know that many smartphones (which are included in Attachment B) can now function essentially as small computers. Smartphones have capabilities that include serving 18 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 21 of 23 as a wireless telephone, digital camera, portable media player, GPS navigation device, sending and receiving text messages and e-mails, and storing a vast range and amount of electronic data. Examining data stored on devices of this type can uncover, among other things, evidence that reveals or suggests who possessed or used the device. 71. Based on my knowledge, training, experience, and information provided to me by other agents, I know that computer files or remnants of such files can be recovered months or years after they have been written, downloaded, saved, deleted, or viewed locally or over the Internet. This is true because: • Electronic files that have been downloaded to a storage medium can be stored for years at little or no cost. Furthermore, when users replace their computers, they can easily transfer the data from their old computer to their new computer. • Even after files have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person "deletes" a file on a computer, the data contained in the file does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data, which might not occur for long periods of time. In addition, a computer's operating system may also keep a record of deleted data in a "swap" or "recovery" file. • Wholly apart from user-generated files, computer storage media, in particular, computers' internal hard drives, contain electronic evidence of how the computer has been used, what it has been used for, and who has used it. This evidence can take the form of operating system configurations, artifacts from operating system or application operation, file system data structures, and virtual memory "swap" 19 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 22 of 23 or paging files. It is technically possible to delete this information, but computer users typically do not erase or delete this evidence because special software is typically required for that task. • Similarly, files that have been viewed over the Internet are sometimes automatically downloaded into a temporary Internet directory or "cache." The browser often maintains a fixed amount of hard drive space devoted to these files, and the files are overwritten only as they are replaced with more recently viewed Internet pages or if a user takes steps to delete them. CONCLUSION 72. Based on the forgoing, there is probable cause to believe that one or more people have violated the statutes specified above and that electronic devices and media containing evidence, fruits, and instrumentalities of those crimes, are contained on the person of (described further in that warrant's Attachment A) and his baggage (described further in that warrant's Attachment A), and for the seizure of the electronic devices and media described in further in Attachment B. REQUEST FOR AUTHORIZATION TO EXECUTE THEWARRANTS BEFORE 6 AM OR AFTER 10 PM 73. In addition, I request that the search warrants authorize searches and seizures before 6 AM and after 10 PM. Although flight is scheduled to land at I am aware that flight departure and arrival times can vary widely from those announced because of adverse weather or other delays throughout the airline transportation system. If because of a flight delay flight landed at 10:01 PM, a warrant without the 20 Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 23 of 23 requested authorization could not be executed for another 8 hours, requiring me to either obtain a new warrant or to detain and his baggage until 6 AM the next morning. The requested authorization will allow the searches and seizures to progress as efficiently as possible, with minimal delay to and any other person with whom he is travelling. REQUEST FOR SEALING 74. I further request that the Court order that all papers in support of this application, including the affidavit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation, the full nature and extent of which is not known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. Sworn to under the pains and penalties of perjury, Curtis Heide Special Agent Federal Bureau of Investigation 21