Case Document 29-22 Filed 04/28/20 Page 1 of 56 A0 93 (Rev. 11113) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter of the Search of (Brie?y describe the property to be searched Case: 1 or identr'j?t the person by name and address) TO I Howell, Beryl A INFORMATION ASSOCIATED WITH Date 1 9/24/2018 ONE VIRTUAL PRIVATE SERVER Descriptmn: Search Seizure Warrant SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Western District of Michigan (identi?; the person or describe the property to be searched and give its location): See Attachment A I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identt?' the person or describe the property to be seizea?li' See Attachment YOU ARE COMMANDED to execute this warrant on or before October 8, 2018 (not to exceed 14 days) in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The Of?cer executing this warrant, or an Of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge United States Magistrate Judge) CI Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (checkthe appropriate box) CI for days (not to exceed 30) until, the facts justifying, the later speci?c date of Date and time issued: Jndge signature City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge Printed name and title Case Document 29-22 Filed 04/28/20 Page 2 of 56 A0 93 (Rev. 11l13) Search and Seizure Warrant (Page 2) Return Case No.2 Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Date Executing o?icer signature Printed name and title Case Document 29-22 Filed 04/28/20 Page 3 of 56 ATTACHMENT A Property to be Searched This warrant applies to the virtual private server using the IP address set forth below, which is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing, Michigan: Case Document 29-22 Filed 04/28/20 Page 4 of 56 ATTACHMENT I. Information to be disclosed by Liquid Web LLC To the extent that the information described in Attachment A is within the possession, custody, or control of Liquid Web LLC (hereinafter, ?the Provider?), regardless of where such information is stored, held or maintained, the Provider is required to disclose the following information to the government for the server listed in Attachment A (?Target Server?): a. A forensic copy of the contents of the Target Server described in Attachment information pertaining to the tool and process used to create said forensic copy; a log of the process; veri?cation of the process; a record of who created the copy, when it was created, and where it was created, including the person?s name, title, contact numbers, and address; b. A forensic copy of the undisturbed contents of random access memory of the running Target Server described in Attachment information pertaining to the tool and process used to create said forensic copy; a log of the process; veri?cation of the process; a record of who created the copy, when it was created, and where it was created, including the person?s name, title, contact numbers, and address; 0. All records of other subscriber information regarding the account, to include u?l name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of services utilized, the address used to register the account, login-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connection, Case Document 29-22 Filed 04/28/20 Page 5 of 56 log ?les, and means and source of payment (including any credit or bank account numbers); . All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken. II. Information to be Seized by the Government Any and all records that relate in any way to the accounts described in Attachment A which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18 U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C. 1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the period ?om June 1, 2015 to the present, including: a. All records, information, documents or tangible materials that relate in any way to communications regarding hacking, release of hacked material, communications with persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or communications regarding disinformation, denial, dissembling or other obfuscation about knowledge of, or access to, hacked material; All records, information, documents or tangible materials that relate in any way to communications or meetings involving Jerome Corsi,? Julian Case Document 29-22 Filed 04/28/20 Page 6 of 56 individual associated with the Trump Campaign, or any witness in the investigation; 0. Communications, records, documents, and other ?les related to any expenditure, independent expenditure, or disbursement for an electioneering communication; d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. All images, messages, communications, Calendar entries, search terms, ?address book? entries and contacts, including any and all preparatory steps taken in furtherance of the above-listed offenses; f. Communications, records, dOCuments, and other ?les that reveal efforts by any person to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; g. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; h. Evidence indicating the account user?s state of mind as it relates to the crimes under investigation; i. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); j. Credit card and other ?nancial information, including but not limited to, bills and payment records evidencing ownership of the subject account; Case Document 29-22 Filed 04/28/20 Page 7 of 56 k. All images, messages and communications regarding wiping software, or other methods to avoid detection by law enforcement; l. The identity of any non?U.S. records that help reveal the whereabouts of the made any expenditure, independent expenditure, or disbursement for an electioneering communication; and In. The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. n. Passwords and keys, and other access information that may be necessary to access the account and other associated accounts; 0. All existing printouts from original storage which concern the categories identi?ed in subsection Review Protocols Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. Case Document 29-22 Filed 04/28/20 Page 8_ of 56 v-:?irr airs i tints: IN THE UNITED STATES DISTRICT COURT A ., elem, Ufa. District Edukiuptey FOR THE DISTRICT OF COLUMBIA {ionrts for the Bistrict at Goiumbia IN THE MATTER OF THE SEARCH OF (338,9? 1318?80-02881 INFORMATION ASSOCIATED WITH ONE T0 Howell, Ben/1A. VIRTUAL PRIVATE SERVER Date I 9/24/2018 Description: Search <3 Seizure Warrant The United States has ?led a motion to seal the above?captioned warrant and related documents, including the application and af?davit in support thereof (collectively the ?Warrant?), and to require Liquid Web, LLC (?Liquid Web?), an electronic communication and/or remote computing services provider headquartered in Lansing, Michigan, not to disclose the existence or contents of the Warrant pursuant to 18 U.S.C. 2705(b). The Court ?nds that the United States has established that a compelling governmental interest exists to justify the requested sealing, and that there is reason to believe that noti?cation of the existence of the Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the warrant, the application and af?davit in support thereof, all attachments thereto and other related materials, the instant motion to seal, and this Order be SEALED until further order of the Court; and Case Document 29-22 Filed 04/28/20 Page 9 of 56 IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. 2705(1)), Liquid Web and its employees shall not disclose the existence or content of the Warrant to any other person (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until further order of the Court. r? THE HONORABLE BERYL A. HOWELL CHIEF UNITED STATES DISTRICT JUDGE Z: Afig?g/y Date DoCument29-22 Filed 04/28/20 Page 10 of 56 UNITED STATES DISTRICT COURT 71?. - - - bid? 16? it are "Ir. for the - 3 - Chara, 0.3. District it District Of Columbia {toasts to; the District of Gommhia (8.132351%: Case" Wee-02881 or ideiiti?) the persoii of: name and address) TO Beryl A- ASSOCIATED WITH Ass:gn. Date 2 9/24/2018 ONE VIRTUAL PRIVATE SERVER Description: Search Seizure Warrant APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identi?J the person or describe the property to be searched and give its location): See Attachment A located in the Western District of person or describe the property to be seized): See Attachment Michigan there is now concealed (identi?l the The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): [Erevidence of a crime; dcontraband, fruits of crime, or other items illegally possessed; lif property designed for use, intended for use, or used in committing a crime; El a person to be arrested or a person who is unlawfully restrained. The search is related to a Violation of: Code Section O?ense Description 52 U.S.C. 30121 Foreign Contribution Ban 18 U.S.C. 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy See Af?davit for add'l The application is based on these facts: See attached Affidavit. Continued on the attached sheet. El Delayed notice of days (give exact ending date if more than 30 days: under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet. My" Reviewed by Applicant ?5 signature '2 Patrick J. Myers, Special Agent, FBI Printed name and title is requested yle R. Freeny (ASC) Sworn to before me and signed in my presence. (f 7f 5/ Date: Judge signature Hon. Beryl A. Howell, Chief US. District Judge Printed name and title City and state: Washington, DC- Case Document 29-22 Filed 04/28/20 Page 11 91,5?) 5 111 11 :1 11111-1 Cierk, 1.1.11. 111111116151 Bankruptcy IN THE UNITED STATES DISTRICT COURT DISTRICT OF COLUMBIA 3911115 for the District of Golumhta IN THE MATTER OF THE SEARCH OF Case: 1 :18?sc?02881 INFORMATION ASSOCIATED WITH Assigned To Howe?, Beryl A. ONE VIRTUAL PRIVATE SERVER Assen- Date 9/24/2131 8 Description: Search Seizure Warrant AMENDED AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Patrick J. Myers, being ?rst duly sworn, hereby depose and state as follows: I INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application for a search warrant under 18 U.S.C. 2703(a), 2703 and 2703(c)(1)(A). The search warrant seeks authorization to search a private server (?Target Server?) controlled and operated by Liquid Web, LLC, a company with headquarters in Lansing, Michigan. The Virtual private Server to be searched, with Internet Protocol address-is believed to be used by Roger STONE and is described further below and in Attachment A. Upon receipt of the information described in Attachment A, government-authorized persons will review that information to locate the items described in Attachment B. 2. I am a Special Agent with the Federal Bureau of Investigation assigned to FBI Pittsburgh working directly with the Special Counsel?s Of?ce. I have been a Special Agent with the FBI since 2017. I was previously employed as a network and software engineer for approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national security investigations relating to foreign intelligence and cybersecurity. 3. The facts in this af?davit come from my personal observations, my training and experience, and information obtained from Other FBI personnel and witnesses. This af?davit is - Case Document 29-22 Filed 04/28/20 Page 12 of 56 intended to Show merely that there is suf?cient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 4. Based on my training and experience and the facts as set forth in this af?davit, there is probable cause to believe that the Target Server contains evidence, fruits, or instrumentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable cause to search the information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses, further described in Attachment B. - JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because it is ?a court of competent jurisdiction? as defined by 18 U.S.C. 2711. Id. 2703(a), Speci?cally, the Court is ?a district court of the United States (including a magistrate judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C. 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. PROBABLE CAUSE A. Background on Relevant Individuals i. Roger STONE 6. Roger STONE is a self?employed political strategist/consultant and has been actively involved in US. politics for decades. STONE worked on the presidential campaign of Case Document 29-22 Filed 04/28/20 Page 13 of 56 Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial relationship with the Campaign thereafter, STONE maintained his support for Trump and continued to make media appearances in support of the-Campaign. As described further below, STONE also maintained contact with individuals employed by the Campaign, including then- campaign chairman Paul MANAFORT and deputy chairman Rick GATES. ii. Jerome CORSI 7. Jerome CORSI is a political commentator who, according to publicly available information, currently serves as the ?Washington Bureau Chief for Inforwarscom.? According to publicly-available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter? for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of books regarding Democratic presidential candidates. 'As described further below, CORSI was in contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of hacked information by WikiLeaks, and appears to have obtained information regarding upcoming disclosures which he relayed to STONE. Case Document 29-22 Filed 04/28/20 Page 14 of 56 B. Russian Government-Backed Hacking Activity During the 2016 Presidential Election 9. On January 6, 2017, the USIC released a declassi?ed version of an intelligence assessment of Russian activities and intentions during the 2016 presidential election entitled, ?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC assessed the following: Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the US presidential election. Russia?s goals were to undermine public faith in the US democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed: a clear preference for President-elect Trump. 10. In its assessment, the USIC also described, at a high level, some of the techniques that the Russian government employed during its interference. The USIC summarized the efforts as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber activity?with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or ?trolls.?? 11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence services conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties.? Further, July 2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and maintained that access until at least June 2016.? The USIC attributed these cyber activities to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted -4- Case Document 29-22 Filed 04/28/20 Page 15 of 56 in the compromise of the personal e?mail accounts of Democratic Party of?cials and political . ?gures. By May, the GRU had ex?ltrated large volumes of data from the 12: With respect to the release of stolen materials,the USIC assessed ?with high con?dence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in cyber operations publicly and in exclusives to media outlets.? 13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his identity throughout the election. 14. The Special Counsel?s Of?ce has determined that individuals associated with the GRU continued to engage in hacking activity related to the 2016 presidential election through at least November 1, 2016. I 15. For example, in or around September 2016, these individuals successfully gained access to DNC computers housed on a third-party cloud?computing service. In or around late September, these individuals stole data from these cloud-based computers by creating backups of the cloud-based systems using the cloud provider?s own technology. The individuals used three new accounts with the same cloud computing service to move the ?snapshots? to those accounts. - 16. On or about September 4, 2016, individuals associated with the GRU stole the emails from a former White House adviser who was then advising the Clinton Campaign. These emails were later post on DCLeaks. 17. On or about November 1, 2016, individuals associated with the GRU spearphished over 100 accounts used by organizations and personnel involved in administering elections in numerous Florida counties. Case Document 29-22 Filed 04/28/20 Page 16 of 56 18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016 presidential election, including conspiracy to commit authorized access to protected computers. See United States V. Vz'klor Borisovz'ch Nety/csho, el (Case No. C. Public Interactions with Guccifer 2.0 and 'WikiLeaks 19. On June 14, 2016, the forensic ?rm that sought to remediate an unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to Russian government actors and the media reported on the announcement. On June 15, 2016, the persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated .on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part of the papers, thousands of ?les and mails, I gave to Wikileaks. They iwill publish them soon.? In that post, Guccifer 2.0 also began releasing hacked DNC documents. 20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from the DNC. 21. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer The article contained embedded publicly available Tweets from Guccifer 2.0 in the article and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he explains who he is and why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and- wise decision. He went to WikiLeaks with the DNC ?les and the rest is history. Now the world would see for themselves how the Democrats had rigged the game.? 22. On August 8, 2016, STONE addressed the Southwest. Broward Republican Case Document 29-22 Filed 04/28/20 Page 17 of 56 Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian ASSANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise? I aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: ?With regard to the October surprise, what would be your forecast on that given what Julian Assange has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close friend who served as an intermediary. 23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone numbers and email addresses from the ?les of the 24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0?s Twitter account was reinstated. 25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJStoneJr paying you back.? Guccifer also sent a private message to @RogerJStoneJr stating ?i?m pleased to say great man. please tell me if I can help anyhow. it would be a great pleasure to me.? 26. On August 18, 2016, Paul MANAFORT, longtime friend and associate, resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated I that MANAFORT had worked with a Washington D.C.?based lobbying ?rms to in?uence U.S. policy toward Ukraine. I 27. On August 21, 2016, using @Ro gerJ Stone] R, STONE tweeted: ?Trust me, it will Case Document 29-22 Filed 04/28/20 Page 18 of 56 soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a C-SPAN interview that same day, STONE reiterated that because of the work of a ??mutual acquaintance? of both his and the public [could]l expect to see much more from the-exiled whistleblower in the form of strategically?dumped Clinton email batches.? He added: ?Well, ?rst of all, II think Julian Assange is a hero. .. I think he?s taking on the deep state, both Republican and Democrat. i believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.? 2.8. - On September 16, 2016, STONE said in a radio interview with Boston Herald . Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly basis fairly soon. And that of course will answer the question as to what exactly what was erased on that email server.? I 29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, ?Wednesday HillaryClinton is done. #WikiLeaks.? I 30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 1 of the Ecuadoran Embassy in Londonannouncement which was part of WikiLeakS? 10-year anniversary celebration STONE told Infowars thathis intermediary described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr to tweet: ?Payload coming. #Lockthemup.? 31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post published an article containing a recorded conversation from a 2005 Access Hollywood shoot in which Mr. Trump had made a series of lewd remarks. 32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading Case Document 29-22 Filed 04/28/20 Page 19 of 56 The Podesta Emails #HillaryClinton #Podesta #imWithI?Ier? and containing a link to approximately 2,050 emails that had been hacked from John Podesta?s personal email account. 33. -WikiLeaks continued to release John Podesta?s hacked emails through Election Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21, 2016 C-SPAN and Twitter references argued publicly that ?[it is] a reasonable assumption to or at least a reasonable conclusion that had advanced warning [of the release of his emails] and the Trump campaign had advanced warning about what Assange was going to do. I think there?s at least a reasonable belief that [Assange] may have passed this information on to Commenting to the NBC News, STONE indicated that he had never met or spoken with Assange, saying that ?we have a mutual friend who?s traveled to London several times, and everything I know is through that channel of communications. I?m not implying I have any in?uence with him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were deleted. I hear that through my emissary.? - 34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing from an email address associated with WikiLeaks, denied that there was any backchannel communication during the Campaign between STONE and WikiLeaks. The same article quoted STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of charges I knew about the hacking of Podesta?s email (speculation and conjecture) and the timing or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the limited things I did predict (Oct disclosures) all came true.? D. Private Twitter Direct Messages with WikiLeaks and ASSANGE 35.? On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked Case Document 29-22 Filed 04/28/20 Page 20 of 56 Podesta emails, the Twitter account @Ro gerJ StoneJ sent a private direct message to the Twitter account @wikileaks.I The latter account is the of?cial Twitter account of WikiLeaks and has been described as such by numerous news reports. The message read: ?Since I was all over national TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents and debunking the false charges of sexual assault as trumped up bs you may want . to rexamine the strategy of attacking me? cordially 36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate that. However, the false claims of association are being used by the democrats to undermine the impact of our publications. Don?t go there if you don?t want us to correct you.? . 37. I On or about October 15, 2016, @RogerJStoneJr sent a direct message to @wikileaks: ?Ha! The more you \"correct\? me the more people think you?re lying. Your Operation leaks like a sieve. You need to ?gure out who your friends are.? 38. On or about November 9, 2016, one day after the presidential election, @wikileaks sent a direct message to @RogerJ StoneJ containing a single 'word: ?Happy?? @wikileaks immediately followed up with another message less than a minute later: ?We are now more free to communicate.? I 39. In addition, @RogerJ StoneJ also exchanged direct messages with ASSANGE, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged @JulianAssange, an address associated with AS SANGE in numerous public reports, stating: ?Still nonsense. As a journalist it doesn?t matter where you get information only that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account @RogerJStoneJr. -10- Case Document 29-22 Filed 04/28/20 Page 21 of 56 indisputably stolen from the goVernment and the courts ruled it was legal to do so and refused to issue an order restraining the paper from publishing additional articles. If the US government moves on you I will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I don?t knowiof any crime you need to be pardoned for - best regards. That same day, @JulianAssange responded: ?Between CIA and OM they?re doing quite a lot. On the Do] side that?s coming most strongly from those obsessed with taking down Trump trying to squeeze us into a deal.? 40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to @JulianAssange, reading: am doing everything possible to address the issues at the highest level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this forum as experience demonstrates it is monitored. Best regards E. Communications with STONE- and Others Regarding Forthcoming Leaks 41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for - address-n October 17, 2017, Chief Judge Howell issued a search warrant for one of STONES-addresses, or about December 19, 2017, Chief Judge Howell issued a search warrant for email account. On or about March 14, 2018, Chief Judge Howell issued a search warrant for iC10ud account. Information recovered pursuant to those search warrants indicated the following: 42. On or about May 15, 201-6,-emailed CORSI: ?Here is my ?ight schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI -11- Case Document 29-22 Filed 04/28/20 Page 22 of 56 appears to have forwarded the message to STONE at_ho replied to CORSI that, ?May meet Manafort guarantee nothing.? 43. On or about May 18, 2016, CORSI emailed STONE at? I with the title, ?Roger why don't you look this over before I send itt I believe that CORSI wrote, nd 1 did manage to see Mr. Trump for a few minutes today as we were waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and was very cordial. He would look for this memo from you this afternoon.? 44. On July 25, 2016, STONE, usin- sent an email to CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with Foundation, allegedly.? 45. On or about July 31, 2016, STONE, usi-emailed CORSI with the subject line, ?Call me The body of the email read: - should see Assange[.] - should ?nd Bernie [S]anders brother who called Bill a Rapist turn him for Trump[.] - should or more proof of Bill getting kicked out.? 46. On or about August 2, 2016 (approximately 19 days before STONE publicly tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at ?Word is friend in embassy plans 2 more dumps. One shortly after I?m back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox . will have me on mid?Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential campaign to get serious starting Sept. Still in pre~season games. Time to let more than Podesta to -12- Case Document 29-22 Filed 04/28/20 Page 23 of 56 be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad,.has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2 morc dumps? refers to AS SANGE, who resided in Ecuador?s London Embassy in 2016. 47. On or about August 5, 2016,-n associate of emailed STONE at The email contained a link to a poll indicating that Clinton led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal Julian Assange last night.? -ubsequently stated to investigators that, around the same time, STONE told him he had gone to London to meet stated that in 2018-told STONE he would be interviewed by the FBI and would have to divulge the conversation about meeting. AS SAN GE. STONE told-he was joking and had not actually met ASSANGE.2 48. Through a search of iCloud account, the FBI has uncovered evidence suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, in his email t-to have ?dined? with ASSANGE. For example, an associate of STONE sent a text to STONE at approximately on August 2, asking ?How did ur meeting go- in STONE responded. ?It?s this The following day, the associate asked, ?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will Case Document 29-22 Filed 04/28/20 Page 24 of 56 call later heading for airport Additionally, investigators have identi?ed a photograph in iCloud that appears to have been taken on August 3, 2016 and had gee-location information indicating that it was taken in Los Angeles. On or about August 15, 2016, CORSI emailed STONE at ??Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it not over yet. More to come than anyone realizes. Won? treally get started until after Labor Day. I?m in NYC this week. Jerry.? 0. On or about August 31,2016, CORSI emailed STONE at ??Did you get the PODESTA writeup.? STONE replied On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to invest in Uranium One was hired by Rosatom 1n Giustra scandal. Podesta now under FBI investigation tied to Ukraine Yanukovych Panama papers reveals Podesta hired by S[b]erbank, Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton false narrative attempting to tie Trump to Putin.? On or about September 6, 2016, CORSI emailed STONE at Is NY Post going to use the Pedesta [sic] stuff?? On or about September 24, 2016-emailed CORSI, will have much more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded, ?We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again today ?-wrote_ back, ?Awaiting secret ?le. Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!? CORSI responded, ?Keep me posted about In a subsequent meeting with investigators-indicated this conversation concerned possible derogatory information he was trying to obtain from Turkey. -14- Case Document 29-22 Filed 04/28/20 Page 25 of 56 54. On or about October 3, 2016, an associate of STONE emailed STONE at and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled.? The associate forwarded the email to Steve BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to Worry about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s important.? I 55. On or about October 4, 2016, ASSANGE gave a press conference at the Ecuadorian Embassy. There had been speculation in the press leading up to that event that AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did not make any new releases. Instead, AS SANGE promised more documents, including information ?affecting three powerful organizations in three different states, as well as, of course, information previously referred to about the U.S. election process.? ASSANGE also stated that WikiLeaks would publish documents on various subjects every week for the next ten weeks, and vowed that the U.S. e1ection~related documents would all come out before Election Day. 56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: ?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.? 57. That same day, BANN ON emailed STONE a ?What was that this STONE replied, ?Fear. Serious security concern. He thinks they are going to kill him and-the London police are standing done BANNON wrote back, ?He didn?t cut deal w/ STONE replied, ?Don?t think so BUT his lawyer - is a big democrat.? -15- Case Document 29-22 Filed 04/28/20 Page 26 of 56 58. When BANNON spoke with investigators during a voluntary interview on February 14, 2018, he initially denied knowing whether the October ?11, 2016 email to STONE was about WikiLeaks. Upon further questiOning, BANNON acknowledged that he was asking STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and BANNON had been hoping for releases of damaging information that morning. F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails Are Released. I 59. According to a publicly available news article,3 at approximately 11AM on Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source regarding a previously unaired video of candidate Trump. According to the same article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage from a 2005 segment on ?Access Hollywood,? the Washington Post. reporter was on the phone, calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.? 60. According to phone records? at approximately . 11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 61. At approximately STONE received a phone call from the Washington Post. The call lasted approximately twenty minutes. 62. At approximately STONE called CORSI and the two spoke for approximately seventeen minutes. 63. At approximately CORSI called STONE and the two ?spoke for approximately twenty minutes1d74714-80e5?1 1e6~8 -16- Case Document 29-22 Filed 04/28/20 Page 27 of 56 64. At approximately the Washington ?Post published a story regarding the Access HollywOod tape. 65. At approximately WikiLeaks tweeted out its ?rst release of emails hacked from'John Podesta that focused primarily on materials related to the Clinton Foundation. On or about August 2, 2016, CORSI emailed STONE usin? expect that much of next dump focus, setting stage for Foundation debacle.? 66. At approximately an author who has written about the Clinton Foundation, and who, according to emails and phone records, regularly Communicates with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the newly?released Podesta emails. Approximately ten minutes later, STONE, using forwarded-message to CORSI without comment. STONE does not appear to have forwarded the email to any other individual. G. STONE Asks CORSI for to Post About Podesta After STONE Is Accused of Advance Knowledge of the Leak 67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed have to go see CORSI responded to STONE, ?Ok.'1 understand.? Approximately twenty minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers.? 68. On or about Wednesday, October 12, 2016, at approximately STONE, using?emailed Corsi asking him to ?send me your best podesta links.? STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.? CORSI wrote back at approximately EDT, ?0k. Monday. The remaining stuff on -17- Case Document 29-22 Filed 04/28/20 Page 28 of 56 Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian translated but to write it up so it?s easy to understand will take weekend. Your choice?? . 69. On or about that same day, October 12, 2016, Podesta accused STONE of having advance knowledge of the publication of his emails. At approximately EDT, CORSI emailed STONE at boll?it?ll the subject line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that ?Podesta is at the heart of a Russian- government money laundering operation that bene?ts ?nancially Podesta personally and the Clintons through the Clinton Foundation.? 70. CORSI followed up several minutes later with another email titled, ?Podesta talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed CORSI back via the -Account, ?Got them and used them.? 71. On or about Thursday, October 13, 2016, CORSI emailed STONE at Joule 84 ties to RUSSIA MONEY LAUNDERIN to CLINTON STONE responded, ?Nice but I was hoping for a pieCe I could post under my by-line since I am the one under attack by Podesta and now Mock.? CORSI wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me like - skimmed maybe billions off Skolkovo Skolkovo kept their money with Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once - had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s Clinton Fund account, there?s no telling how much. money he laundered, or where it ended up. Nothing in Clinton Foundation audited ?nancials or IRS Form 9908 about received Via -18- Case Document 29-22 Filed 04/28/20 Page 29 of 56 Russia MetcombankL] I?m working on that angle now.? STONE replied, ?Ok Give me SOMETHING to post on Podesta since 1 have now promised it to a dozen MSM 72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI sent STONE an email a-with the subject, STONE article RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN The text stated: ?Roger[,] You are free to publish this under your own name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although I have had some back-channel communications with. Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.? The post then asked, ?Just how much money did? a controversial Russian billionaire investor with ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional bank owned 99.978 percent by -with the money transferred Via Deutsche Bank and Trust Company Americas in New York City, with thelmoney ending up in a private bank account in the Bank of America that is operated by the Clinton Founda?on?? I 73. On or about October 14, 2016, CORSI sent a message to his iCloud account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s I basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.? 74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, ?On Assange, can you call me now before STONE responded, ?Missed just landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important intel to share.? -19- Case Document 29-22 Filed 04/28/20 Page 30 of 56 75. On or about October 17, 2016, CORSI emailed STONE at ASSANGE. . .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email with the header information stripped out, showing only the body text. The email read, I ?gurcd this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if they move to extradite him. My guess is that he has a set of dead man files that include Hillary. It?s what they used to call a ?Mexican stand offH? Only hope is that if Trump speaks out to save him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC Wins, Assange can kiss his life away. Interesting gambit Assange has to play out-He?s called Pedesta?s bluff and raised him the election.? 76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, ?Pls call. Important.? . 77. On or about October 19, 2016, STONE published an article on Breitbart.com in which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.? STONE stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear it from Wikileaks, although Julian Assange and I share a common friend. I reported theistory on my website.? STONE linked to the story he had asked CORSI to write for him on October 13, 2016 discussed above. 78. On or about November 8, 2016, the United States presidential election took place. I 79. I On or about November 9, 2016, CORSI messaged STONE at his iCloud account, ?Congratulations, Roger. He could not have done it without you.? -20- Case Document 29-22 Filed 04/28/20 Page 31 of 56 80. On or about November 10, 2.016, CORSI messaged STONE at his iCloud account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in London. Have some interesting news for you.? Case Document 29-22 Filed 04/28/20 Page 32 of 56 Case Document 2922 Filed 04/28/20 Page 33 of 56 I. Congressional Testimony and Public Statements About His Relationship with Wikileaks . 88. on September 26, 2017, STONE testified before the House Permanent Select Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the public what he said were his opening remarks to the committee. In them, STONE stated: Members of this Committee have made three basic assertions against me which must be rebutted here today. The charge that I knew in advance about, and predicted, the hacking of Clinton campaign chairman John Pedesta?s email, that I had advanced knowledge of the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or that, my now public exchange with a persona that our intelligence agencies claim, but cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, such assertions are conjecture, supposition, projection, and allegations but none of them are facts. . . . My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s time in the barrel. #CrookedHillary? must'be examined in context. I posted this at a time that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump campaign over allegations regarding his business activities in Ukraine. I thought it manifestly unfair that John Podesta not be held to the same standard. Note, that my Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but does accurately predict that the Podesta brothers? business activities in Russia with the oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, would come under public scrutiny. . . . et me address the charge that I had advance knowledge of the timing, content and source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks? publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed Assange to independently con?rm this report, and he subsequently did. This journalist assured me that WikiLeaks would release this information in October and continued to assurerme of this throughout the balance of August and all of September. This information proved to be correct. I have referred publicly to this journalist as an, ?intermediary?, ?go-between? and ?mutual friend.? All of these monikers are equally true. -23.. Case Document 29-22 Filed 04/28/20 Page 34 of 56 89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI. Those excerpts include the following: Q: Have any of your employees, associates, or individuals acting on your behest or encouragement been in any type of contact with Julian Assange? MR. STONE: No. Q: So throughout the many months in which you represented you were either in communication with Assange'or communication through an intermediary with Assange, you were only referring to a single fact that you had con?rmed with the intermediary MR. STONE: That Q: was the length and the breadth of what you were referring to? MR. STONE: That is correct, even though it was repeated to me on numerous separate occasions. 90. In the month that followed his testimony before HPSCI, on or about October 24, 2017, STONE published an article on his website, stonecoldtruth.com, titled ?Is it the Podesta?s Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some have quite falsely claimed, to the hacking and publication almost two months later of John Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the expectation that it would become a news story.? J. Messaging to Randy CREDICO about ?Back channel? 91. On or about November 19, 2017, Randy CREDICO (who, as described further below, STONE publicly identi?ed as his ?intermediary? to AS SAN GE), messaged STONE, ?My lawyer wants to see me today.? STONE responded, ??Stonewall it. Plead the ?fth. Anything to save the plan? Richard CREDICO responded, ?Ha ha.? 92. On or about November 21, 2017, CREDICO messaged STONE, was told that the house committee lawyer told my lawyer that I will be getting a STONE wrote -24? Case Document 29-22 Filed 04/28/20 Page 35 of 56 back, ?That was the point at which your lawyers should have told them you would assert your 5th Amendment rights if compelled to appear.? They continued to message, and CREDICO wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what? Nothing happening in DC the day before Thanksgiving why are busting my chops?? 93. 011 or about November 24, 2017, STONE, texted CREDICO, ?Assange is a journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was he had the goods [o]n Hillary and would publish them which he himself said in public b4 11 told me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s what I was basing it on.-I told-you to watch his Tweets in October not before that I knew nothing about the DNC stuf?j I just followed his STONE respOnded, never said anything about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t interview him or meet him until August 26th[.] That was my ?rst communication with his secretaiy in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I i guess Schiff will try to get one of us indicted for 94. STONE and CREDICO continued to exchange messages and on November 24, 2017, CREDICO wrote to STONE, ?Forensic evidence proves that there is no back Channel. So now you can relax.? 95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he received from HPSCI that was dated November 27, 2017. Toll records show that on November 27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen times. 96. - On November 29, 2017, STONE publicly stated that CREDICO was his ?intermediary.? In a public Facebook post, STONE further stated that ?Credico merely -25- Case Document 29-22 Filed 04/28/20 Page 36 of 56 con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the British ITV network, where Assange said he had ?e-mails related to Hillary Clinton which are pending publication,? . . . Credico never said he knew or had any information as to source or content of the material.? 97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why you had back Channel now I had to give all of my forensic evidence to the FBI today what a You could have just told him the truth that you didn?t have a back Channel they now know that I was not in London until September of this year[.] You had no back-channel and you could have just told the truth . . . You want me to cover you for perjury STONE responded, ?What the fuck is your problem? Neither of us has done anything wrong or illegal. You got the best press of your life and you can get away with asserting for 5th Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot . . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If you testify you?re a fool. Because of tromp [Sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for perjury if you?re stupid enough to I 98. STONE and CREDICO continued to IneSSage each other on or about December 1, 2017. In response to message about being ?stupid enough to testify,? CREDICO told 4 Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI. -26c Case Document 29-22 Filed 04/28/20 Page 37 of 56 STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you never had a back Channel particularly on June STONE responded: ?You got nothing.? 99. On or about December 13, 2017, according to public reporting, CREDICO indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 100. STONE and CREDICO continued to exchange text messages, and on or-about January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. STONE responded, ?Hope don?t fuck Up my. efforts to get Assan'ge a CREDICO messaged STONE, have the email from his chief of staff August 25th 2016 responding to an email I sent to WikiLeaks website email address asking you would do my show[.] That was my initial contact.? 101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy logs . . . 17 other pieces of information prove that I did not have any conversations with Assange until September of last year.? 102. CREDICO and STONE continued to message each other, and on or about anuary 25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] I was not a ba[ck] Channel and have all those emails from September of 201 6 to prove 103. On or about April 13, 2018, news reports stated that CREDICO had shown reperters copies of email messages he had received from STONE in the prior few days that stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to take that dog away -27- Case Document 29-22 Filed 04/28/20 Page 38 of 56 from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary . . . When you start bringing up my dog, you?re crossing the 104. On or about May 25, 2018, CREDICO provided additional messages he stated were from STONE to another news agency.6 In these messages, STONE, on April 9, 2018, stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he considered this email from STONE a threat. STONE stated in the article that CREDICO ?told me he had terminal prostate cancer . . . It was sent in response to that. Weltalked about it too. He was depressed about it. Or was he lying.? The article noted that CREDICO stated he did not have prostate cancer and did not have any such discussion with STONE. K. The Target Server and Efforts to Remove Documents and Information from his-Residence 105. On or about Friday, May 18, 2016_an assistant to STONE, was voluntarily interviewed by investigators from the Special Counsel?s Of?ce-old investigators that he became assistant in Florida in 2015, and that during the summer of201?6, he acted as right-hand man. -old investigators, in substance and in part, that STONE was scared about getting hacked and scared about the government ?snooping? on him, and that STONE was in the process of hardening his home systems and trying to move things off his desktop computer to a secure semen-further advised that STONE had a new t?tech guy? assisting him. I 106. -old the FBI that as part of this process, STONE was his data but not deleting it. Analysis of iCloud, which was searched pursuant to a warrant 5 threatened?do g-13 S91 13 70.html 6 -23- Case Document 29-22 Filed 04/28/20 Page 39 of 56 issued by Chief Judge Howell on or about August 3, 2018, nonetheless indicates that call logs and chats occurring prior to March 1, 2018 have been deleted. Call logs and/or chats from certain additional periods of time (for- example, June 29, 2018 to July 13, 2018) also appear to have been deleted. To date, the FBI has not been able to determine when those deletions occurred. 107. On or about May 22,2018_ who provided tech services for iMacs, was voluntarily interviewed by the FBI by telephone (having previously been interviewed in person). - stated that wife had hired someone else to set up an offsite remote server for data at their Fort Lauderdale residence. - identi?ed the individual . who set up the 'server as -f Freestyle Systems, whom-net in person at house in early April. -indicated that STONE was concerned with his business and work if his computers were seized and he did not have access to them, and he wanted to be able to continue to work, write, and get the word out in that event. -stated that he believed that the remote server is hosted by Liquid Web and that STONE pays approximately $5 00 per month for it. I 108. Based on open source information, I know that Liquid Web, LLC is a US provider offering dedicated servers, VPS hosting, and cloud servers with Linux or Windows. ?the government obtained subscriber records from Liquid Web for an account opened by-Those records Show that on or about March 27, 2018, - purchased a server described as ?Item: DS.123 0V5 - Dedicated Server - Single Intel Xeon CPU - US Central Zone? for $324 per month (?Target Server?). On or about the same day, a new inventory entry was made in the Liquid Web system, reading ?New entry in inventory [223 605:2869647]: description: owner_rel_id: -29- Case Document 29-22 Filed 04/28/20 Page 40 of 56 - In my training and experience, this indicates that the server purchased by -was named?According to public WHOIS records, the domain 109 9. According to records obtained from Liquid Web the name of the Target Server was changed to_on or about March 28, 2018. The Target Server was assigned the IP addres- Based on a search conducted on shodan.io, a specialized search engine that scans information about all devices connected to the Internet, the Target Server?s con?guration has not been changed since March 28, 2018. 110. According to communications produced by - on or about March 27, 2018~the same day that-?rst leased the Target wife tekte-Would you be willing to speak to - who has setting [sic] up a hosted server for Rogers computer? . . . .All of Rogers data is still on his desktop but because of his issues with government agencies and after a total backup of his system and a forensic audit of all the emails and documents on his computer it was concluded that all future information would be safer on an outside server. . . 111. On or about April 9, 2018-sent STONE an email at ith the subject, ?Remote server update.? In that email,-stated, ?After ?nding out he couldn?t wipe the data from yorir drives ?_(new IT guy) wanted us to buy new hard drives and replace the drives on your iMac (and have [Stone?s attorney] put them away in safety deposit box)? -lso told STONE that, if the data Was migrated onto a server that runs Windows (which the Target Server does), ?[b]oth iMacs . . . would need to be put somewhere out of the house/apt to accomplish ?getting data out of the house.?? Case Document 29-22' Filed 04/28/20 Page 41 of 56 112. April 9, 2018 email suggests that, at the rim-id not understand tha- had already stood up a server for STONE. In substance- recommended against the use of a remote Windows server, and asked STONE to ?[l]et me know. if you want to stay put, or go to windows server wit- 113. According to communications provided by-lo the FBI, on or about April 25, 2018,.exte- just got a call fiom- and it appears Roger IS going forward with the server idea.? When-asked exactly?-vas doing-replied, the ?les to the server . . . 114. Based on the foregoing, and my training and experience, there is probable to cause to believe that the Liquid Web remote server with IP addres_ e. the Target Server, is a dedicated server used by, and set up on behalf of, STONE, and that the Target Server contains evidence, fruits, and/or instrumentalities of the Subject Offenses. BACKGROUND CONCERNING LIQUID WEB 115. Based on open source information, I know that Liquid Web, LLC, which hosts the Target Server, is a company based in Lansing, Michigan, which offers dedicated servers, VPS hosting, and cloud servers with Linux or Windows. The Target Server is among a number of VPSs running on physical servers controlled by Liquid Web. According to public WHOIS data, the Target Server is located in Lansing, Michigan. I 116. Based on my knowledge, training, and experience, I know that computer ?les or remnants of such ?les can be recovered months or even years after they have been downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic ?les downloaded to a storage medium can be stored for years at little or no cost. Even when ?les have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person -31- Case Document 29-22 Filed 04/28/20 Page 42 of 56' ?deletes? a ?le on a computer, the data contained in the ?le does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data. 117. Therefore deleted ?les, or remnants of deleted ?les, may reside in free space or slack space that is, in space on the storage medium that is not currently being used by an active ?le ??for long periods of time before they are overwritten. In addition, a computer?s operating system may also keep a record of deleted data in a ?swap? or ?recovery? ?le. 118. Wholly apart from user-generated ?les, computer storage media contain electronic evidence of how a computer has been used, what it has been used for, and who has used it. To give a few examples, this forensic evidence can take the form of operating system con?gurations, artifacts from operating system or application operation, ?le system data structures, and virtual memory ?swap? or paging ?les. Computer users typically do not erase or delete this evidence, because special software is typically required for that task. However, it is technically possible to delete this information. 1 19. Similarly, ?les that have been viewed via the Internet are sometimes automatically downloaded into a temporary Internet directory or ?cache.? The browser often maintains a ?xed amount of hard drive space devoted to these ?les, and the ?les are only overwritten as they are replaced with more recently viewed Internet pages or if a user takes steps to delete them. 120. As further described in Attachment B, this application seeks permission to locate not only the computer ?les that might serve as fruits and instrumentalities or the crimes described in the warrant, but also for evidence, also described in Attachment B, that established how computers were used, the purpose of their use, who used them, and when. 121. Data on the storage medium not currently associated with any ?le can provide evidence of a ?le that was once on the storage medium but has since been deleted or edited, or of -32- Case Document 29-22 I Filed 04/28/20 Page 43 of 56 a deleted portion of a ?le (such as a paragraph that has been deleted from a word processing Virtual memory paging systems can leave traces of information on the storage medium that show what tasks and processes were recently active. Web browsers, email programs, and chat programs store con?guration information on the storage medium that can reveal information such as online nicknames and passwords. Operating systems can record additional information, such as the times the computer was in use. Computer ?le systems can record information about the dates ?les were created and sequence in which they were created. 122. Forensic evidence on a computer can also indicate who has used or controlled the computer. This ?user attribution? evidence is analogous to the search for ?indicia of occupancy? while executinga search warrant at a residence. For example, registry information, con?guration ?les, user pro?les, email, email address books, ?chat,? instant messaging logs, photographs, and correspondence (and the data associated with the foregoing, such as ?le creation and last accessed dates) may be evidence of who used or controlled the computer at a relevant time. 123. A person with appropriate familiarity with how a. computer works can, after examining this forensic evidence in its proper context, draw conclusions about how computers were used, the purpose of their use, who used them, and when. 124. The process of identifying the exact ?les, blocks, registry entries, logs, or other forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. While it is possible to specify in advance with particularity a description of the records sought, evidence of this type is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a computer is evidence may depend on other information stored onthe computer and the application of knowledge about how a computer behaves. _33_ Case Document 29-22 Filed 04/28/20 Page 44 of 56 125. The FBI anticipates executing this warrant under the above-cited ECPA provisions by using the search warrant to compel Liquid Web to provide a copy of the Target Server, including a copy of the memory used by the Target Server. Generally speaking, this copy duplicates every bit and byte on the Target Server, including all files, slack space, Master File Table, and metadata in exactly the ordcr they appear on the original; in order words, the taking of a complete electronic picture of the computer?s data, including all hidden sectors deleted ?les, and memory. In my training and experience, the data associated with the Target Server, including artifacts such as slack space and deleted ?les, are segregated as part of the Target Server and can be imaged separately from other VPSS that may be stored on the same physical server. After obtaining a copy of the Target Server, FBI agents or their experts will review that information to locate the items described in Section II of Attachment B. 126. This application seeks a warrant to search all responsive records and information under the control of Liquid Web, a provider subject to the jurisdiction of the Court, regardless of where Liquid Web has chosen to store such information. The government intends to require, pursuant to the warrant, the disclosure of the contents of wire or electronic communications and any records of other information pertaining to the customers or subscribers if such communication, records, or other information is within Liquid Web?s possession, custody, or control, regardless Iof where that information is stored. 127. As noted above,- told the FBI that, in connection with efforts to move material off his desktop to a secure server, STONE was data. Accordingly, it is possible that part or all of the data on the Target Server is In my training and experience, I know that if the FBI obtains a forensic copy of the undisturbed contents of random access memory of the running Target Server, which is sought in this application, it may be -34- Case Document 29-22 Filed 04/28/20 Page 45 of 56 possible to carve data to locate password. If this application is granted and the server is, in fact, the FBI intends to use that process to locate the password through - forensic means, and to use the password to access the server in execution of the warrant. FILTER REVIEW PROCEDURES 128. Review of the items described in Attachment A and Attachment will be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney?client and other operative privileges. The procedures include use, if necessary, of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. CONCLUSION 129. Based on the forgoing, I request that the Court issue the proposed search warrant. 130. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement officer is not required for the service or execution of this warrant. -3 5- Case Document 29-22 Filed 04/28/20 Page 46 of 56 REQUEST FOR SEALING 131. I further request that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until ?irther order of the Court. These documents discuss an ongoing criminal investigation, the full nature and extent of which is not known to all of the targets of the investigation. Accordingly, there is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. Respectfully submitted, Patrick J. Myers Special Agent Federal Bureau of Investigation xi 7?4 Subscribed and sworn to before me on this 2 /day of September, 2018. . The Honorable Beryl A. Howell . Chief United States District Judge ?36- Case Document 29-22 Filed 04/28/20 Page 47 of 56 ATTACHMENT A Property to be Searched This warrant applies to the Virtual private server using the IP address set forth below, which is controlled and/or operated by Liquid Web, LLC, a company headquartered i? Lansing, . Michigan: Case Document 29-22 Filed 04/28/20 Page 48 of 56 ATTACHMENT 1. Information to be disclosed by Liquid Web LLC To the extent that the information described in Attachment A is within the possession, custody, or control of Liquid Web LLC (hereinafter, ?the Provider?), regardless of where such information is stored, held or maintained, the Provider is required to disclose the following information to the government for the server listed in Attachment A (?Target Server?): a. A forensic copy of the contents of the Target Server described in Attachment information pertaining to the tool and process used to create said forensic copy; a log of the process; veri?cation of the process; a record of who created the copy, when it was created, and where it was created, including the person?s name, title, contact numbers, and address; A forensic copy of the undisturbed contents of random access memory of the running Target Server described in Attachment information pertaining to the tool and process used to create said forensic copy; a log of the process; verification of the process; a record of who created the copy, when it was created, and where it was created, including the person?s name, title, contact numbers, and address; c. All records of other subscriber information regarding the account, to include u?l name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of services utilized, the IP address used to register the account, login-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connection, Case Document 29-22 Filed 04/28/20 Page 49 of 56 log ?les, and means and source of payment (including any credit or bank account numbers); . All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken. 11. Information to be Seized by the Government Any and all records that relate in any way to the accounts described in Attachment A- which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18 U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C. 1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the period from June 1, 2015 to the present, including: a. All records, information, documents or tangible materials that relate in any way to communications regarding hacking, release of hacked material, communications with persons or entities associated with WikiLeaks, including but not limited-to Julian Assange, or communications regarding disinformation, denial, dissembling or other obfuscation about knowledge of, or access to, hacked material; All records, information, documents or tangible materials that relate in any way to communications or meetings involving Jerome Corsi, - Julian Case Document 29-22 Filed 04/28/20 Page 50 of 56 individual associated with the Trump Campaign, or any witness in the investigation; 0. Communications, records, documents, and other ?les related to any expenditure, - independent expenditure, or disbursement for an electioneering communication; d. Records of any ?uids or bene?ts disbursed by or offered on behalf of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; c. All images, messages, communications, calendar entries, search terms, ?address book? entries and contacts, including any and all preparatory steps taken in furtherance of the above-listed offenses; f. Communications, records, documents, and other ?les that reveal efforts by-any person to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; g. Evidence indicating how and when the account was accessed or used, to determine, the geographic and chronological context of account access, use, and events relating - to the crimes under investigation and to the account owner; h. Evidence indicating the account user?s state of mind as it relates to the crimes under investigation; i. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); j. Credit card and other ?nancial information, including but not limited to, bills and payment records evidencing ownership of the subject account; Case Document 29-22 Filed,04/28/20 Page 51 of 56 k. All images, messages and communications regarding wiping software, or other methods to avoid detection by law enforcement; The identity of any non-US. records that help reveal the whereabouts of the made any expenditure, independent expenditure, or disbursement for an electioneering communication; and The identity of any person(s)iincluding records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Passwords and keys, and other access information that may be necessary to access the account and other associated accounts; All existing printouts from original storage which concern the categories identi?ed in subsection - Review Protocols Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. Case Document 29-22 Filed 04/28/20 Page 52 of 56 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT 0" m? EDI A Case: IN THE MATTER OF THE SEARCH OF Assigned To Howell Beryl A INFORMATION ASSOCIATED Assign. Date - VIRTUAL PRIVATE SERVER 1 Description: Search 8 Seizure Warrant MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND TO REQUIRE UNDER 18 U.S.C. 2705(b) The United States of America, moving by and through its undersigned counsel, respectfully moves the Court for an Order placing the above?captioned warrant and the application and af?davit in support thereof (collectively herein the ?Warrant?). under seal, and precluding the provider from notifying any person of the Warrant pursuant to 18 U.S.C. 2705 In regard to the non? disclosure, the prOposed Order would direct Liquid Web, LLC (?Liquid Web?), an electronic communication and/or remote computing services provider headquartered in Lansing, Michigan, not to notify any other person (except attorneys for Liquid Web for the purpose of receiving legal advice) of the existence or content of the Warrant for a period of one year or until further order of the Court. JURISDICTION AND LEGAL BACKGROUND 1. The Court has the inherent povver to seal court I ?lings when appropriate, including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (DC. Cir. 1980) (citing Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of I the Warrant. See Washington Post v. Robinson, 935 .2d 282, 287?89 (DC. Cir. 1991). 2. I In addition, this Court has jurisdiction to issue the requested order because it is ?a court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a Case Document 29-22 Filed 04/28/20 Page 53 of 56 ?district court of the United States . . . that has jurisdiction over the offense being investigated.? 18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation occurred within Washington, DC. See 18 U.S.C. 3237. 3. Further, the Court has authority to require non-disclosure of the Warrant under 1.8 U.S.C. 2705(b). Liquid Web provides an ?electronic communications service,? as defined in 18 U.S.C. 2'510( 15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The Stored Communications Act 18 U.S.C. 2701?2712, governs how Liquid Web may be compelled to supply communications and other records using a subpoena, court order, or search warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic ?subscriber information? using a subpoena, Section 2703(d) allows the Government to obtain other ?non-content? information using a court order, and Section 2703 allows the . Government to obtain contents of comr?unications using a search warrant. See 18 U.S.C. 2703. 4. The SCA does not set forth any obligation for providers to notify subscribers about Subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such noti?cation. In relevant part, Section 2705(b) provides as follows:I Preclusion of notice to subject of governmental access. A governmental entity acting under section 2703 . . . may apply to a court for an order commanding a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or court order is directed, for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order. The court shall enter such an order if it determines that there is reason to believe that noti?cation of the existence of the warrant, subpoena, or court order will result in? 1 Section 2705 contains additional requirements for legal process obtained pursuant to 18 U.S.C. 2703(b)(1)(B), but the Government does not seek to use-the proposed Order for any legal process under that provision. Case Document 29-22 Filed 04/28/20 Page 54 of 56 (1) endangering the life or physical safety of an individual; ?ight from prosecution; (3) destruction of or tampering with evidence; (4) intimidation of potential witnesses; or (5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 18 2705(b). The United States District Court for the District of Columbia has made clear that a nondisclosure order under Section 2705(b) must be issued once the Government makes the requisite showing about potential consequences of noti?cation: The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there is reason to believe that notifying the customer or subscriber of the court order or subpoena may lead to one of the deleterious outcomes listed under 2705(b), the court must enter an order commanding a service provider to delay notice to a customer for a period of time thatthe court determines is appropriate. Once the government makes the required showing under 2705(b), the court is required to issue the non-disclosure order. In re AppZication for Order of Nondisclosure Pursuantto 18 US. C. 59 2705 for Grand Jury Subpoena 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to command Liquid Web not to notify any other person (except attorneys for Liquid Web for the purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until ?irther order of the Court. FACTS SUPPORTING SEALING AND NON-DISCLOSURE 6. The Federal Bureau of Investigation is investigating Violations of 1 8 U. S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18 U.S.C. 371 (conspiracy), 18 U.S.C. 951 (acting as an unregistered foreign agent), 18 U.S.C. 1030 (unauthorized access of a protected computer); 18 U.S.C. 1343 (wire hand), 18 U.S.C. 1340 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject Offenses?), in connection with efforts to compromise the networks of the Democratic National 3 Case Document 29-22 Filed 04/28/20 Page 55 of 56 Convention the Democratic Congressional Campaign Committee and the email accounts of US. persons involved in the 2016 presidential election, followed by the public release of stolen materials through various outlets. 7. In this matter, the government requests that the Warrant be sealed until further order of the Court and that Liquid Web and its employees be directed not to notify any other person of the existence or content of the Warrant (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until further order of the Court. Such an order is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is neither public nor known to the targets of the investigation, and its disclosure may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and related papers may also alert the targets to the scope of information known to the FBI. Once alerted to this information, potential targets vvould be immediately prompted to destroy or conceal incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid future prosecution. In particular, given that they are known to use electronic communication and remote computing services, the potential target could quickly and easily destroy or digital evidence relating to their criminal activity. 8. Given the complex and sensitive nature of the criminal activity under investigation, and also given that the criminal scheme may be ongoing, the Government anticipates that this con?dential investigation will continue for the next year or longer. However, should circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed, the Government will netify the Court and seek appropriate relief. Case Document 29-22 Filed 04/28/20 Page 56 of 56 9. There is, therefore, reason to believe that noti?cation of the existence of the I Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. Because of such potential jeopardy to the investigation, there also exists a compelling governmental interest in con?dentiality to justify the government?s sealing request. See Robinson, 935 F.2d at 287?89. 10. Based on prior dealings with Liquid Web, the United States is aware that, absent a court order under Section 2705(b) commanding Liquid Web not to notify anyone about a legal request, Liquid Web may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic communications for a certain account, notify the subscriber or customer of the exiStence of the warrant prior to producing the material sought. WHEREFORE, for all the foregoing reasons, the government respectfully requests that the above-captioned warrant, the application and af?davit in support thereof, and all attachments thereto and other related materials be placed under seal, and ?rrtherrnore, that the Ceurt command Liquid Web not to notify any other person of the existence or contents of the above-captioned warrant (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until further order of the Court. - Respectfully submitted, ROBERT S. MUELLER, Special Couns Dated: 4/l ?87 By: Ky . Freeny \g Th cial Counsel?s f?ce (202) 616-3812