Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 1 of 35 AO 93 (Rev. 11/13) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) INFORMATION ASSOCIATED WITH ONE CELLULAR TELEPHONE NUMBER THAT IS STORED AT PREMISES CONTROLLED BY AT&T ) ) ) ) ) ) Case: 1: 18-sc-02671 Ass!gned To : Howell, Beryl A Assign. Date: 8/20/2018 Description: Search & Seizure Warrant SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of Florida (identify the person or describe the property to be searched and give its location): See Attachment A I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identify the person or describe the property to be seized): See Attachment B YOU ARE COMMANDED to execute this warrant on or before August 31, 2018 (not to exceed 14 days) ~ in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge (United States Magistrate Judge) 0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) 0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of Date and time issued: City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge Printed name and title Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 2 of 35 AO 93 (Rev. I l/13) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of : Inventory of the property taken and name of any person(s) seized: Certification I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Date: Executing officer's signature Printed name and title Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 3 of 35 ATTACHMENT A Property to be Searched This warrant applies to information associated with the cellular telephone assigned call number ("the Account"), that is stores at premises controlled by AT&T ("the Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida. -1- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 4 of 35 ATTACHMENT B I. Information to be disclosed by Provider To the extent that the information described in Attachment A is within the possession, custody, or control of the Provider, including any information that has been deleted but is still available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to disclose to the government the following information pertaining to the Account listed in Attachment A for the time period June 14, 2016 through November 15, 2016: a. The following information about the customers or subscribers of the Account: 1. Names (including subscriber names, user names, and screen names); ii. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses); m. Local and long distance telephone connection records; 1v. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol ("IP") addresses) associated with those sessions; v. Length of service (including start date) and types of service utilized; vi. Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"); Mobile Identification Number ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number ("MS ISDN"); International Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile Equipment Identities ("IMEi"); vii. Other subscriber numbers or identities (including the registration Internet Protocol ("IP") address); and viii. Means and source of payment for such service (including any credit card or bank account number) and billing records. -2- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 5 of 35 b. All records and other information (not including the contents of communications) relating to wire and electronic communications sent or received by the Account, including: 1. the date and time of the communication, the method of the communication, and the source and destination of the communication (such as the source and destination telephone numbers (call detail records), email addresses, and IP addresses); and 11. information regarding the cell tower and antenna face (also known as "sectors") through which the communications were sent and received. II. Information to be Seized by the Government Any and all records that relate in any way to the accounts described in Attachment A which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 14, 2016 to November 15, 2016. -3- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 6 of 35 AO 106 (Rev. 04/10) Application for a Search Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter of the Search of (Briefly describ • the p roperty to be searched or ide111ify the p erson by name nnd address) INFORMATION ASSOCIATED WITH ONE CELLULAR TELEPHONE NUMBER STORED AT PREMISES CONTROLLED BY AT&T l ) ) ) FI . AUG 2 O 2018 GI erk, U,S. District & Bankruptcy Courts for the District of Columbia Case: 1:18-sc-02671 Assigned To: Howell, Beryl A. Assign. Date: 8/20/2018 Description: Search & Seizure Warrant APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location) : See Attachment A located in the - --Southern - - - -- District of - - -- person or describe the property to be seized): Florida , there is now concealed (identify the - - - - - -- - See Attachment B The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more): ~ evidence of a crime; 0 contraband, fruits of crime, or other items illegally possessed; 0 property designed for use, intended for use, or used in committing a crime; 0 a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Offense Description Code Section 52 U.S.C. § 30121 18 U.S.C. §§ 1001, 1030, 371 See Affidavit for add'I Foreign Contribution Ban False Statements, Unauthorized Access of Protected Computer, Conspiracy The application is based on these facts: See attached Affidavit. ~ Continued on the attached sheet. 0 Delayed notice of days (give exact ending date if more than 30 days: - - - - - ) is requested under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. Reviewed by AUSA/SAUSA: IKyle R. Freeny (ASC) c_A~,.c.1. ~ ,..--·-~~pp 1ca11 s signature Andrew Mitchell, Special Agent, FBI Printed name and title Sworn to before me and signed in my presence. Date: _ 8_µg!_)i}( ( / City and state: Washington, D.C. Judge's signature Hon. Rudolph Contreras, U.S. District Judge Printed name and title Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 7 of 35 ~Il AUG 2 o 2018 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH ONE CELLULAR TELEPHONE NUMBER THAT IS STORED AT PREMISES CONTROLLED BY AT&T Clork, U.S. District & Baok1optcy Courts for the blstrlct of Columbia Case: 1: 18-sc-02671 Assigned To : Howell, Beryl A. Assign. Date : 8/20/2018 Description: Search & Seizure Warrant AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant under 18 U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a certain cellular telephone assigned call number ("Target Telephone"), which is stored at premises owned, maintained, controlled or operated by AT&T, a wireless telephone service provider headquartered in North Palm Beach, Florida. The information to be disclosed by AT&T and searched by the government is described in the following paragraphs and in Attachments A and B. 2. I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and experience in investigating criminal and national security matters. 3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other FBI personnel and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 4. Based on my training and experience and the facts as set forth in this affidavit; there - 1- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 8 of 35 is probable cause to believe that violations of the following statutes have been committed or are being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § l 030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 3012l(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the information described in Attachment A for evidence of the Subject Offenses, further described in Attachment B. JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because it is "a court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C. § 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 6. When the Government obtains records under § 2703 pursuant to a search warrant, the Government is not required to notify the subscriber or any other person of the warrant, for such a period as the Court deems appropriate, where there is reason to believe that such notification will seriously jeopardize an investigation. 18 U.S.C. § 2705(b). PROBABLE CAUSE 7. The Special Counsel's Office, with FBI's assistance, is investigating the Russian government's efforts to interfere in the 2016 presidential election, as well as any links and/or coordination between the Russian government and individuals associated with the campaign of President Donald Trump ("Trump Campaign"). This includes investigating Roger Stone (STONE) -2- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 9 of 35 and others known and unknown, in connection with the hacking of email accounts associated with the Democratic National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks, among others. 8. This application seeks cell-site location information for the Target Telephone, used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this corresponds to the time period during which there is evidence that STONE was engaged in, and attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder Julian ASSANGE about the content of stolen documents prior to their public release. During this same time period, STONE was also in communications with members of the Trump Campaign. A. Background on Relevant Individuals 1. 9. Roger STONE Roger STONE is a self-employed political strategist/consultant and has been actively involved in U.S. politics for decades. STONE worked on the presidential campaign of Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official relationship with the Campaign thereafter, STONE maintained his support for Trump and continued to make media appearances in support of the Campaign. As described further below, STONE also maintained contact with individuals employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick GATES. ii. Jerome CORSI 10. Jerome CORSI is a political commentator who, according to publicly available information, currently serves as the "Washington Bureau Chief for Inforwars.com." According to -3 - Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 10 of 35 publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of books regarding Democratic presidential candidates. As described further below, CORSI was in contact with STONE during the summer and fall of 20 I 6 regarding forthcoming disclosures of hacked information by WikiLeaks, and appears to have obtained information regarding upcoming disclosures which he relayed to STONE. B. Russian Government-Backed Hacking Activity During the 2016 Presidential Election 12. On January 6, 2017, the USIC released a declassified version of an intelligence assessment of Russian activities and intentions during the 2016 presidential election entitled, "Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC -4- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 11 of 35 assessed the following: [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the US presidential election. Russia's goals were to undermine public faith in the US democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed a clear preference for President-elect Trump. 13. In its assessment, the USIC also described, at a high level, some of the techniques that the Russian government employed during its interference. The USIC summarized the efforts as a "Russian messaging strategy that blends covert intelligence operations-such as cyber activity-with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or 'trolls."' 14. With respect to "cyber activity," the USIC assessed that "Russia's intelligence services conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties." Further, "[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and maintained that access until at least June 2016." The USIC attributed these cyber activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC." 15. With respect to the release of stolen materials, the USIC assessed "with high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets." 16. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his identity throughout the election. 17. The Special Counsel's Office has determined that individuals associated with the -5- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 12 of 35 GRU continued to engage in hacking activity related to the 2016 presidential election through at least November 1, 2016. 18. For example, in or around September 2016, these individuals successfully gained access to DNC computers housed on a third-party cloud-computing service. In or around late September, these individuals stole data from these cloud-based computers by creating backups of the DNC's cloud-based systems using the cloud provider's own technology. The individuals used three new accounts with the same cloud computing service to move the "snapshots" to those accounts. 19. On or about September 4, 2016, individuals associated with the GRU stole the emails from a former White House advisor who was then advising the Clinton Campaign. These emails were later post on DCLeaks. 20. On or about November 1, 2016, individuals associated with the GRU spearphished over 100 accounts used by organizations and personnel involved in administering elections in numerous Florida counties. 21. On July 13, 2018, a grand jury in the District of Columbia returned an indictment against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 presidential election, including conspiracy to commit authorized access to protected computers. See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). C. Evidence of Google Searches Relating to the Conduct Under Investigation 22. During the course of its investigation, the FBI has identified a series of searches that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona. In pa1iicular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that searches were conducted for the terms "guccifer" and -6- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 13 of 35 "guccifer j une," from an IP address within the range 107. 77 .216.0/24. 1 This IP range is assigned to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida. 23. IP logs obtained from Twitter show that STONE used multiple IP addresses within the range 107.77.216.0/24 to log into his Twitter account@RogerJStoneJr. 24. Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about June 13, 2018, the FBI obtained all searches conducted by the CookieIDs that conducted the Guccifer-related searches described above. 2 Based on these results, the FBI has not yet been able to attribute the searches to any particular user. D. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks 25. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to Russian government actors and the media reported on the announcement. On June 15, 2016, the persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon." In that post, Guccifer 2.0 also began releasing hacked DNC documents. 26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from the DNC. 27. On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear 1 Google does not retain full IP addresses for searches conducted more than one year ago. The truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a range of up to 256 IP addresses. 2 Google assigns unique CookieIDs to searches conducted while a user is not logged into a Google account. All searches conducted from the same device and browser during a 24-hour window are associated with the same CookieID. -7- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 14 of 35 Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for themselves how the Democrats had rigged the game." 28. · On August 8, 2016, STONE addressed the Southwest Broward Republican Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October surprise, what would be your forecast on that given what Julian Assange has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation but there's no telling what the October surprise may be." A few days later, STONE clarified that while he was not personally in touch with AS SANGE, he had a close friend who served as an intermediary. 29. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone numbers and email addresses from the files of the DCCC. 30. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's Twitter account was reinstated. -8- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 15 of 35 31. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r great man. please tell me if I can help u anyhow. it would be a great pleasure to me." 32. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate, resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. policy toward Ukraine. 33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and [ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes." 34. On September 16, 2016, STONE said in a radio interview with Boston Herald Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis fairly soon. And that of course will answer the question as to what exactly what was erased on that email server." 35. On Saturday, October 1, 2016, usmg @RogerJStoneJr, STONE tweeted, "Wednesday@HillaryClinton is done. #WikiLeaks." 36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony -9- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 16 of 35 of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr to tweet: "Payload coming. #Lockthemup." 37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post published an article containing a recorded conversation from a 2005 Access Hollywood shoot in which Mr. Trump had made a series of lewd remarks. 38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading "REI,,EASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link to approximately 2,050 emails that had been hacked from John Podesta's personal email account. 39. WikiLeaks continued to release John Podesta's hacked emails through Election Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE's August 21, 2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails] and the Trump campaign had advanced warning about what Assange was going to do. I think there's at least a reasonable belief that [Assange] may have passed this information on to [STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken with Assange, saying that "we have a mutual friend who's traveled to London several times, and everything I know is through that channel of communications. I'm not implying I have any influence with him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he has all of the e-mails that Ruma Abedin and Cheryl Mills, the Clinton aides, thought were deleted. I hear that through my emissary." 40. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing from -10- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 17 of 35 an email address associated with WikiLeaks, denied that there was any backchannel communication during the Campaign between STONE and WikiLeaks. The same article quoted STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the limited things I did predict (Oct disclosures) all came true." E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE 41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter account @wikileaks. 3 The latter account is the official Twitter account of WikiLeaks and has been described as such by numerous news reports. The message read: "Sine~ I was all over national TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking me- cordially R." 42. Less than an hour later, @wikileaks responded by direct message: "We appreciate that. However, the false claims of association are being used by the democrats to undermine the impact of our publications. Don't go there if you don't want us to correct you." 43. On or about October 15, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like a sieve. You need to figure out who your friends are." 44. On or about November 9, 2016, one day after the presidential election, @wikileaks 3 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account@RogerJStoneJr. -11- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 18 of 35 sent a direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately followed up with another message less than a minute later: "We are now more free to communicate." 45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged @JulianAssange, an address associated with ASSANGE in numerous public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from the government and the courts ruled it was legal to do so and refused to issue an order restraining the paper from publishing additional articles. If the US government moves on you I will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down Trump trying to squeeze us into a deal." 46. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to @JulianAssange, reading: "I am doing everything possible to address the issues at the highest level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this forum as experience demonstrates it is monitored. Best regards R." F. CORSl's Communications with STONE, Forthcoming Leaks 4 7. and Others Regarding On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for STONE's address, 2017, Chief Judge Howell issued a search warrant for one of STONE's On October 17, addresses, On or about December 19, 2017, Chief Judge Howell issued a search -12- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 19 of 35 warrant for email account. On or about March 14, 2018, Chief Judge Howell issued a search warrant for STONE's iCloud account. Information recovered pursuant to those search warrants indicated the following: 48. On or about May 15, 2016, emailed CORSI: "Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI appears to have forwarded the message to STONE at who replied to CORSI that, "May meet Manafort -guarantee nothing." 49. On or about May 18, 2016, CORSI emailed STONE a with the title, "Roger -- why don't you look this over before I send it I believe that CORSI wrote, and I did manage to see Mr. Trump for a few minutes today as we were waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and was very cordial. He would look for this memo from you this afternoon." 50. On July 25, 2016, STONE, using sent an email to CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation, allegedly." 51. On or about July 31, 2016, STONE, using CORSI with the subject line, "Call me MON." The body of the email read: Assange[.] Trump[.] 52. emailed should see should find Bernie [S]anders brother who called Bill a Rapist - tum him for should find or more proof of Bill getting kicked out." On or about August 2, 2016 (approximately 19 days before STONE publicly -13- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 20 of 35 tweeted about "Podesta's time m the barrel"), CORSI emailed STONE at , "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016. 53. an associate of STONE's, emailed On or about August 4, 2016, STONE at The email contained a link to a poll indicating that Clinton led Trnmp by 15 points. STONE responded on or about the same day, "enjoy it while u can[.] I dined with my new pal Julian Assange last night." subsequently stated to investigators that, around the same time, STONE told him he had gone to London to meet ASSANGE. also stated that in 2018, told STONE he would be interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. STONE told he was joking and had not actually met AS SAN GE. 4 -14- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 21 of 35 54. Through a search of STONE's iCloud account, the FBI has uncovered evidence suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, in his email to to have "dined" with ASSANGE. For example, an associate of STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked, "Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will call later - heading for airport now[.]" Additionally, investigators have identified a photograph in STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-Iocation information indicating that it was taken in Los Angeles. 55. On or about August 15, 2016, CORSI emailed STONE at "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm in NYC this week. Jerry." 56. On or about August 31, 2016, CORSI emailed STONE at "Did you get the PODESTA writeup." STONE replied "[y]es." 57. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by S [bJerbank, Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton false narrative attempting to tie Trump to Putin." 58. On or about 6, September 2016, CORSI emailed STONE at : "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?" 59. On or about September 24, 2016, -15- emailed CORSI, "I will have much Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 22 of 35 more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted about file[.]" In a subsequent meeting with investigators, indicated this conversation concerned possible derogatory information he was trying to obtain from Turkey. 60. On or about October 3, 2016, an associate of STONE emailed STONE at and asked: "Assange - what's he got? Hope it's good." STONE wrote back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's important." 61. On or about October 4, 2016, AS SANGE gave a press conference at the Ecuadorian Embassy. There had been speculation in the press leading up to that event that ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did not make any new releases. Instead, ASSANGE promised more documents, including information "affecting three powerful organizations in three different states, as well as, of course, information previously referred to about the U.S. election process." ASSANGE also stated that WikiLeaks would publish documents on various subjects every week for the next ten weeks, and vowed that the U.S. election-related documents would all come out before Election Day. 62. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: "Assange made a fool of himself. Has nothing or he would have released it. Total BS hype." -16- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 23 of 35 63. That same day, BANNON emailed STONE at "What was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer 64. is a big democrat." When BANNON spoke with investigators during a voluntary interview on February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON had been hoping for releases of damaging information that morning. G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails Are Released 65. According to a publicly available news article, 5 at approximately 11AM on Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source regarding a previously unaired video of candidate Trump. According to the same article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling Trump's campaign, 'Access Hollywood,' and NBC for reaction." 66. According to phone records at approximately 11 :27 AM, CORSI placed a call to STONE, which STONE did not answer. 67. At approximately 11 :53AM, STONE received a phone call from the Washington Post. The call lasted approximately twenty minutes. 5 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iev.:d-tape-of-donald-trumpthen-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875e-2c 1bfe943 b66_story.html -17- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 24 of 35 68. At approximately 1:42PM, STONE called CORSI and the two spoke for approximately seventeen minutes. 69. At approximately 2:18PM, CORSI called STONE and the two spoke for approximately twenty minutes. 70. At approximately 4:00PM, the Washington Post published a story regarding the Access Hollywood tape. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked 71. from John Podesta that focused primarily on materials related to the Clinton Foundation. On or "I expect that about August 2, 2016, CORSI emailed STONE using much of next dump focus, setting stage for Foundation debacle." 72. At approximately 6:27PM, an author who has written about the Clinton Foundation, and who, according to emails and phone records, regularly communicates with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the newly-released Podesta emails. forwarded Approximately ten minutes later, STONE, using message to CORSI without comment. STONE does not appear to have forwarded the email to any other individual. H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is Accused of Advance Knowledge of the Leak 73. On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers." 74. using On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, emailed Corsi asking him to "send me your best podesta links." -18- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 25 of 35 STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces." CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian translated but to write it up so it's easy to understand will take weekend. Your choice?" 75. On or about that same day, October 12, 2016, Podesta accused STONE of having advance knowledge of the publication of his emails. At approximately 3 :25PM EDT, CORSI emailed STONE at both , with the subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a Russian-government money laundering operation that benefits financially Podesta personally and the Clintons through the Clinton Foundation." 76. CORSI followed up several minutes later with another email titled, "Podesta talking points," with the text "sent a second time just to be sure you got it." STONE emailed CORSI back via the Hotmail Account, "Got them and used them." 77. On or about Thursday, October 13, 2016, CORSI emailed STONE at "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me like skimmed maybe billions off Skolkovo - Skolkovo kept their money with Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's Clinton Fund account, there's no telling how much money he laundered, or where it ended up. Nothing in -19- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 26 of 35 Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]" 78. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI sent STONE an email at with the subject, "ROGER STONE article RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own name." That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post then asked, "Just how much money did a controversial Russian billionaire investor with ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional bank owned 99.978 percent by with the money transferred via Deutsche Bank and Trust Company Americas in New York City, with the money ending up in a private bank account in the Bank of America that is operated by the Clinton Foundation?" 79. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta." 80. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to share." -20- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 27 of 35 81. On or about October 17, 2016, CORSI emailed STONE at with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email with the header information stripped out, showing only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set of dead man files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and raised him the election." 82. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, "Pis call. Important." 83. On or about October 19, 2016, STONE published an article on Breitbart.com in which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails." STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on my website." STONE linked to the story he had asked CORSI to write for him on October 13, 2016 discussed above. 84. On or about November 8, 2016, the United States presidential election took place. 85. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, "Congratulations, Roger. He could not have done it without you." 86. On or about November 10, 2016, CORSI messaged STONE at his iCloud account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London. Have some interesting news for you." -21- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 28 of 35 I. The Target Telephone 87. Search warrant returns for STONE's Hotmail account, show that on numerous occasions, including in 2016, STONE provided the Target Telephone Number to individuals as his cellular telephone number and/or the way to reach him. On or about August 17, 2017, AT&T, indicated that the "user" of the Target Telephone Number is "Roger J. Stone." Publicly available databases indicate the Target Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a company investigators have linked to STONE. 88. There is evidence that STONE used the Target Phone in connection with the conduct under investigation. For example, according to records : a) STONE called CORSI on or about July 25, 2016 from the Target Phone, and spoke with him for approximately twenty-six minutes. Less than roughly two hours after that call, STONE emailed CORSI, "Get to Assange [a]t the Ecuadorian Embassy in London and get the pending wikileaks emails .... " b) On or about July 30, 2016--one day before STONE instructed CORSI to have contact ASSANGE-Manafort, who was then-Chairman of the Trump Campaign, called STONE on the Target Phone Number. The two spoke for approximately sixty-seven minutes. c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure, STONE received a call from the Washington Post at the Target Phone Number, and shortly thereafter, STONE had two conversations with CORSI from the Target Phone Number. 89. As set forth in Attachment B, this application seeks cell-site location information -22- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 29 of 35 for the Target Telephone between Ju ne 14. 201 6-the day before a Google search was conducted for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0's first public appearance-and November 15, 2016- one week after the 2016 presidential election and less than one week after CORSI messaged STONE about having "interesting news" for him. Given STONE's repeated communications with and/or about the WikiLeaks releases during this time, including discussions about the content of the documents prior to their release, there is probable cause to believe that STONE's whereabouts during this time period will yield evidence of the Subject Offenses under investigation. Location information for the Target Phone will assist investigators in determining, among other things: whether STONE was in Florida at the time of the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or around any of the events or communications discussed above; and where STONE was on the night he claimed he "dined" with ASSANGE. 6 Location information will also assist investigators in identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential co-conspirators during this time period. BACKGROUND CONCERNING AT&T 90. In my training and experience, I have learned that AT&T is a company that provides cellular telephone access to the general public. I also know that providers of cellular telephone service have technical capabilities that allow them to collect and generate information about the locations of the cellular telephones to which they provide service, including cell-site data, also 6 As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to have met AS SANGE, but the FBI is investigating whether STONE may have met an intermediary instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site location information varies depending on the distance between towers (among other things). Given the density of Los Angeles, I believe that cell-site location data for STONE's trip there would assist investigators in determining, among other things, whether STONE was present at the locations he has publicly claimed to have been. -23- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 30 of 35 known as "tower/face information" or "cell tower/sector records." Cell-site data identifies the "cell towers" (i.e., antenna towers covering specific geographic areas) that received a radio signal from the cellular telephone and, in some cases, the "sector" (i.e., faces of the towers) to which the telephone connected. These towers are often a half-mile or more apart, even in urban areas, and can be 10 or more miles apart in rural areas. Furthennore, the tower closest to a wireless device does not necessarily serve every call made to or from that device. Accordingly, cell-site data provides an approximate location of the cellular telephone but is typically less precise than other types of location information, such as E-911 Phase II data or Global Positioning Device ("GPS") data. 91. Based on my training and experience, I know that AT&T can collect cell-site data about the Target Telephone. Cell-site location data is typically generated only when the phone is used to engage in communications. I also know that wireless providers such as AT&T typically collect and retain cell-site data pertaining to cellular phones to which they provide service in their normal course of business in order to use this information for various business-related purposes. 92. Based on my training and experience, I know that wireless providers such as AT&T typically collect and retain information about their subscribers in their normal course of business. This information can include basic personal information about the subscriber, such as name and address, and the method(s) of payment (such as credit card account number) provided by the subscriber to pay for wireless telephone service. I also know that wireless providers such as AT&T typically collect and retain information about their subscribers' use of the wireless service, such as records about calls or other communications sent or received by a particular phone and other transactional records, in their normal course of business. In my training and experience, this information may constitute evidence of the crimes under investigation because -24- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 31 of 35 the information can be used to identify the Target Telephone user or users and may assist in the identification of co-conspirators and/or victims FILTER REVIEW PROCEDURES 93. Review of the items described in Attachment A and Attachment B will be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other operative privileges. The procedures include use, if necessary, of a designated "filter team," separate and apart from the investigative team, in order to address potential privileges. The government, however, does not at this time anticipate that any of the items described in Attachment A will contain materials requiring review by a designated filter team. CONCLUSION 94. Based on the forgoing, I request that the Court issue the proposed search warrant. 95. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not required for the service or execution of this warrant. -25- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 32 of 35 REQUEST FOR SEALING 96. I further request that the Court order that all papers in support of this application, including the affidavit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation, the full nature and extent of which is not known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. Respectfully submitted, c:::::~ Andrew Mitchell Special Agent Federal Bureau of Investigation Subscribed and sworn to before me on this .Jfl day of August, 2018. The Honor ble Rudolph Contreras United States District Judge -26- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 33 of 35 ATTACHMENT A Property to be Searched This warrant applies to information associated with the cellular telephone assigned call number ("the Account"), that is stores at premises controlled by AT&T ("the Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida. -1- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 34 of 35 ATTACHMENT B I. Information to be disclosed by Provider To the extent that the information described in Attachment A is within the possession, custody, or control of the Provider, including any information that has been deleted but is still available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to disclose to the government the following information pertaining to the Account listed in Attachment A for the time period June 14, 2016 through November 15, 2016: a. The following information about the customers or subscribers of the Account: i. Names (including subscriber names, user names, and screen names); 11. Ill. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses); Local and long distance telephone connection records; 1v. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol ("IP") addresses) associated with those sessions; v. Length of service (including start date) and types of service utilized; vi. Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"); Mobile Identification Number ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number ("MSISDN"); International Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile Equipment Identities ("IMEi"); vii. Other subscriber numbers or identities (including the registration Internet Protocol ("IP") address); and vu1. Means and source of payment for such service (including any credit card or bank account number) and billing records. -2- Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 35 of 35 b. All records and other information (not including the contents of communications) relating to wire and electronic communications sent or received by the Account, including: 1. the date and time of the communication, the method of the communication, and the source and destination of the communication (such as the source and destination telephone numbers (call detail records), email addresses, and IP addresses); and 11. information regarding the cell tower and antenna face (also known as "sectors") through which the communications were sent and received. II. Information to be Seized by the Government Any and all records that relate in any way to the accounts described in Attachment A which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 14, 2016 to November 15, 2016. -3-