,Case Document 29-25 Filed 04/28/20 Page 1 of 61

A0 93 (Rev. 11! 3) Search and Seizure Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia
In the Matter of the Search of 
(Brie?y describe the property to be searched gas-e? 1 02918
or identify the person by name and address) SS!gne TO Beryl 
ASSign. Date 927/2018
INFORMATION ASSOCIATED WITH TWO ACCOUNTS Descri tion' Search - I
STORED AT PREMISES e?zure arm?
CONTROLLED BY TWITTER 
SEARCH AND SEIZURE WARRANT
To: Any authorized law enforcement of?cer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
{ideniijj} the person or describe the property to be searched and give its location): 

See Attachment A

I find that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (idemr?) the person or describe the property to be seized):

See Attachment 8

YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed J4 days)
[if in the daytime 6:00 am. to l0:00 p.1n. CI at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom or from whose premises the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to lion. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

El Pulsuant to 18 C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U. S. C.
2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice the person who, or whose
property, will be searched or SClzed (check the app: opr box) 

El for days (none exceed 30) I3 until, the facts justifying, the later speci?c date? of

Date and time issued: 47! 94"? dig/II KW

{Iudge? signature-

 

 

City and state: Washington, DC Hon. Beryl A. Howell Chief US District Judge

Pr hired name and title

 

 

 

Case Document 29-25 Filed 04/28/20 Page 2 of 61

A0 93 (Rev. 1 li? 13) Search and Seizure Warrant (Page 2)

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

 

 

Executing oj?cer Signature

Printed name and ri?e

 

 

 

Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 3 of 61

ATTACHMENT A
Property to be Searched

This wmrnnt applies to information associated with the Twitter accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Twitter, Inc. ("Twitter"), a company headquartered in San Francisco, California

-1-

 1.

Case Document 29-25 Filed 04/28/20 Page 4 of 61

ATTACHMENT 
Information to be disclosed by Twitter

To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. (?Twitter?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Twitter, or have been preserved

pursuant to a request made under 18 U.S.C. 2703 Twitter is required to disclose the following

information to the government for each account listed in Attachment A:

A.

H.

All ?Tweets? and Direct Messages sent, received, ?favorited,? or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;

All data and information associated with the profile page, including photographs, ?bios,?
and profile backgrounds and themes;

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;

All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account ?mentions? or ?replies?);

All photographs and images in the user gallery for the account;

All location data associated with the account, including all information collected by the
?Tweet With Location? service;

All information about the account?s use of Twitter?s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;

All data and information that has been deleted by the user;

A list of all of the people that the user follows on Twitter and all people who are following
the user the user?s ?following? list and ?followers? list);

A list of all users that the account has ?unfollowed? or blocked;

All ?lists? created by the account;

 

Case Document 29-25 Filed 04/28/20 Page 5 of 61

All information on the ?Who to Follow? list for the account;
All privacy and account settings;

All records of Twitter searches performed by the account, including all past searches saved
by the account;

All current and historical subscriber and payment information, including full name, e?mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identi?cation numbers, security questions. and answers,
registration IP address, payment history, and other personal identi?ers;

All email addresses and telephone numbers ever registered (Whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;

All data and information associated with the profile page, including photographs;

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to- access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created; -

The dates and times at which the account and pro?le were created, and the Internet Protocol
address at the time of sign?up;

All transactional records associated with the account, including any IP logs or other records
of session times and durations;

Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identi?er, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers
Mobile Equipment Identifiers Mobile Identi?cation Numbers
Subscriber Identity Modules Mobile Subscriber Integrated Services
. Digital Network Number International Mobile Subscriber Identi?ers
or International Mobile Equipment Identities and any other
information regarding the types of devices used to access the account;

All activity logs for the account;

All location information for the account, including all location data collected by any
plugins or widgets;

The types of service utilized by the user;

-3-

 

BB.

CC.

DD.

EE.

FF.

GG.

HH.

II.

Case Document 29-25 Filed 04/28/20 Page 6 of 61

All information about the account? 8 use of Twitter? 3 link service, including all website links
embedded in, exporting data to, or importing data from, the account?s website or blog;

All full website links that were shortened by Twitter?s link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked; -

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

All data and information that has been deleted by the user;

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked; -

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identi?er, or any other account or device identi?er;

Information regarding accounts linked to accounts towhich the Target Accounts are linked;

All records pertaining to communications between the Service Provider and any person
regarding the user or the user?s account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consiSts of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), l8

U.S.C. 371 (conspiracy), l8 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), l8 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:



 

Case Document 29-25 Filed 04/28/20 Page 7 of 61

a. All records, information, documents or tangible materials that relate in any Way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

b. All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, -Julian
Ass any

individual associated with the Trump Campaign, any Witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals;

e. All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;

f. Communications, records, documents, and other ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or

foreign principals;

 

Case Document 29-25 Filed 04/28/20 Page 8 of 61

 

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals.

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection .

Case Document 29-25 Filed 04/28/20 Page 9 of 61

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 

Case Document 29-25 Filed 04/28/20 Page 10 of 61

FILED
SEP272018

I Clark. U.S. District Bankruptc
IN THE UNITED STATES DISTRICT COURT cm, to, m, 3mm 0, commie

FOR THE DISTRICT OF COLUMBIA

 

 

IN THE MATTER OF THE SEARCH OF Case: 1 :18~sc?0291 8

INFORMATION ASSOCIATED WITH TWO Assigned To Howell, Beryl A.

ACCOUNTS STORED AT PREMISES Assign. Date 9/27/2018

CONTROLLED BY TWITTER Description: Search Seizure Warrant


The United States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the ?Warrant?),
and to require TWITTER, INC. an electronic communication and/or remote
computing services provider headquartered in San Francisco, California, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. 2705(b).

The Court ?nds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 I

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and af?davit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;

and

 

Case Document 29-25 Filed 04/28/20 Page 11 of 61

. IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. 2705(1)), TWITTER and its
employees shall not disclose the existence or content of the Warrant to any other person (except

attorneys for TWITTER for the purpose of receiving lega} advice) for a period of one year or until

THE HONORAELE BERYL A. HOWELL

CHIEF UNITED STATES DISTRICT JUDGE

further order of the Court.

12/72? r3 -

Date

 

Case Document 29-25 Filed 04/28/20 Page 12 of 61

A0 106 (Rev. OHIO) Applicatton for a Search Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia

SEP 27 2018

Glut, U.S. District Bankruptcy
Courts for the District of Coiumhia

in the Matter of the Search of

Brie?y describe the property to be searched
or idemy?; the person by name and address)

ASSOCIATED WITH
TWO ACCOUNTS STORED AT PREMISES
CONTROLLED BY TWITTER .

Case: 1'18-sc
. . ~02918
?ss?igned To Howell, BerylA
DSSigii. pate 9/27/2018 
Search 8. Seizure Warrant

APPLICATION FOR A SEARCH WARRANT

I, a federal iaw enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the

property to be searched and give its location):

See Attachment A

located in the Northern District of
person or describe the property to be seized):

See Attachment 

Catifornta there is now concealed (identify the

 

 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
devidence ofa crime;
[if contraband, fruits of crime, or other items possessed;
[if property designed for use, intended for use, or used in committing a crime;

a person to be arrested or a person who is uniawfuity restrained.

The search is related to a violation of:

Code Section O?ense Description
52 3012?! Foreign Contribution Ban 
18 U.S.C. 1001. 1030, 371 False Statements. Unauthorized Access of Protected Computer. Conspiracy
See Af?davit for add!

The application is based on these facts:
See attached Affidavit.

[if Continued on the attached sheet.

Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.



Applicant '5 signature

is requested

Reviewed by 

IKyte R. Freeny (ASC) Patrick J. Myers, Special Agent, 

Printed name and titie

 

Sworn to before me and signed in my presence.
Date: 2 ?ag We 
Judge '5 signature

Hon. Beryl A. Howeit, Chief US. District Judge

Printed name and ri?e

City and state: WashingtoiD,C_

 

Case Document 29-25 Filed 04/28/20 Page 13 of 61

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02913

INFORMATION ASSOCIATED WITH TWO - Assigned To Howell 89 IA
ACCOUNTS STORED AT PREMISES Assign. Date 9/27/2618 
CONTROLLED BY TWITTER Description: Search 8: Seizure Warrant

 

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 2705(@

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and af?davit
in support thereof (collectively herein the ?Warrant?) under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 ?2705(b). In regardto the non?
disclosure, the proposed Order would direct TWITTER, LLC an electronic
communication and/or remote computing services previder headquartered in San Francisco,
California, not to notify any other person (except attorneys for TWITTER for the purpose Of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further orderof the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court ?lings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315?16 Cir. 1980) (citing
Nixon 1). Warner Communications, Inc, 589, 598 (1978)). The Court may also seal the
Warrant to prevent-serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir.l991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a

court of competent jurisdiction? 83 de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

 

Case Document 29-25 Filed 04/28/20 Page 14 of 61

?district court of the United States . . . that hasjurisdiction over the offense being investigated.?
18 .S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. 3237.

3. Further, the Court has authority to require nonedisclosure of the Warrant under 18
U.S.C. 2705(1)). TWITTER provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. The
Stored Communications Act 18 U.S.C. 27014712, governs how TWITTER may be
compelled to-supply communications and other records using a subpoena, court order, or search
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber inforrnatiOn? using a subpoena, Section 2703 allows the Government to obtain other
?non-content? information using a court order, and Section allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
noti?cation. In relevant part, Section 2705(b) provides as follows:E

Preclusion of notice to subject of governmental access. *9 A governmental

entity acting under section 2703 . . . may apply to a court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court

deems not to notify any other person of the existence of the warrant,

subpoena, or court order. The court shall enter such an order if it determines that

there is reason to believe that noti?cation of the existence of the warrant, subpoena,

or court order will result in?
endangering the life or physical safety of an individual;

 

Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision. 

2

 

 

Case Documen129-25 Filed 04/28/20 Page 15 of 61

(2) ?ight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial
18 U.S.C. The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(1)) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705(b) make clear that if a courts [sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705(b), the court is required to
issue the non?disclosure order

In re Application for Order of Nondisclosure Pursuant to 18 2705(b) for Grand Jury
Subpoena 41 F. Supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command TWITTER not to notify any other person (except attorneys for TWITTER for the
purpose of receiving legal advice) of the existence of the Subpoena for a-period of one year or until
further order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating violations of 1 8 US .C.
2 (aiding and abetting), 18 U.S.C. 3 the fact), 18 U.S.C. ?4 (misprision ofa
felony), 18 .S.C. 371 (conspiracy), 18 U.S.C. 951 (acting as an unregistered foreign agent),
18 U.S.C. 1001 (false I statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer); 18 US C. 1343 (wire fraud), 18 U. 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), and 22 U.S.C. ?611 et seq.

(Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign contribution ban) (the ?Subject

 

Case Document 29-25 Filed 04/28/20 Page 16 of 61

Offenses?), arising out of the?conduct of Roger Stone and others. it does not appear that Stone is
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this
warrant to Stone could lead him to destroy evidence or notify others who may delete information
relevant to the investigation. I

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that TWITTER and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
Bl. Once alerted to this information, potential targets would be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and'avoid future prosecution. in particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or digital evidence relating to their
criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered mendisclosure under Section 2705(b) becomes no

longer needed, the Government will notify the Court and seek appropriate relief.

 

Case Document 29-25 Filed 04/28/20 Page 17 of 61

9. There is, therefore, reason to believe that noti?cation of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity-
to flee from prosecution, destroy or tamper. with evidence, and intimidate witnesses. See 18 U.S.C.
Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287?89.

10. Based on prior dealings with TWITTER, the United States is aware that, absent a
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.

WHERBFORE, for all the foregoing reasons, the government respectfully requests that the
above?captioned warrant, the application and af?davit in support thereof, and all attachments
thereto and other reiated materials be placed under seal, and furthermore, that the Court command
TWITTER not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of
one year or until further order of the Court. I

Respectfully submitted,

ROBERT s. MUELLER, 111
Special Counsel

Dated: 2123? /l By: :lr

Mtg]. Freon)! 
Th eciat Counsel?s Of?ce
(202) 616-3812

 

 

Case Document 29-25 Filed 04/28/20 Page 18 of 61 -

FILED

IN THE UNITED STATES DISTRICT COURT SEP 2 7 2013

FOR THEDISTRICT OF COLUMBIA Clerk. U.S. District Sni?ankruptcy
Courts tor the District at Columbla

IN THE MATTER OF THE SEARCH OF Case; 1118?50-02918 .
INFORMATION ASSOCIATED WITH Assigned To -. Howell. Beryl A.

TWO ACCOUNTS STORED AT PREMISES Assign Date 9127;2018 
CONTROLLED BY TWITTER D?scription: Search a Seizure Warrant

 

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

l, Patrick J. Myers, being ?rst duiy sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I tnake this affidavit in support of an appIiCation tor a search warrant for
information associated with the two Twitter accounts (the ?Target Accounts?), stored at premises

owned, maintained, controlled or operated by Twitter, Inc. (?Twitter?), a company headquartered

in San Francisco, California. As set forth below, the Target Accounts

Upon receipt

 

of the information described in Attachment A, government-authorized persons will review that
information to locate the items described in Attachment B.

2. I am a Special Agent With the Federal Bureau of Investigation assigned to
FBI Pittsburgh working directly with the Special Counsel?s Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately ?fteen years, including fer the FBI. As a Special Agent, I have conducted nations!
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this af?davit come from my personal observations, my training and

experience, and information obtained from other FBI personnel and witnesses. This af?davit is

 

Case Document 29-25 Filed 04/28/20 Page 19 of 61

intended to show merely that there is suf?cient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. . Based on my training and experience and. the facts as set forth in this af?davit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instruinentalities of violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to conimit
wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B. I

I JURISDICTION -

5. This Court has jurisdiction to issue the requested warrant because it is ?a court of

competent jurisdiction? as de?ned by 18 U.S.C. 2711. Id. 2703(a), 
Speci?cally, the-Court is ?a district court of the United States (including a magistrate
judge of such a court) . . . that hasjurisdiction over the offense being investigated.? 18 U.S.C.
271 The offense conduct included activities in Washington, DC, as detailed beldw.
I PROBABLE CAUSE
A. Background on Relevant Individuals
i. Roger 8TONE I
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US. politics for decades. STONE worked on the presidential campaign of

-2-

 

Case . Document 29-25 Filed 04/28/20 Page 20 of 61

Donald J. Trump (the ?Campaign?) until August 2015. Although Stone had no of?cial
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support 'of the Campaign. AS described further below,
STONE also maintained contact with individuals employed by the Campaign, including then?
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.

ii. Jerome 

Jerome CORSI is a political commentator who, according to publicly available
information, served as the ?Washington Bureau Chief for Inforwarscom.? According to
publicly?available sources, from-2014 until January 2017, was a ?senior staff reporter"
for the website ?World Net Daily? a/k/a ?WND.com.? CORSI has also written a number of
boolts regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

 

Case Document 29-25 Filed 04/28/20 Page 21 of 61

 

I B. Russian Government-Backed Hacking Activity During the 2016 Presidential
Election

. 9. On January 6, 20l7, the USIC released a declassi?ed version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following:

Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the

US presidential election. Russia?s goals were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State I?lillary] Clinton, and harm her

electability and potential presidency. We further assess Putin and the Russian

Government developed a clear preference for President-elect Trump.

it). In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?such as cyber
activity+with overt efforts by Russian Government agencies, state?funded media, third-party
intermediaries, and paid social media users or ?trolls.?

11. With respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks

- and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence Directorate: operations resulted

-4-

 

Case Document 29-25 Filed 04/28/20 Page 22 of 61

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political
?gures. By May, the GRU had ex?ltrated large volumes of data from the - 

12. With respect to the release of stolen materials, the USIC assessed ?with high -
con?dence that the GRU used the Guccifer 2.0 persona. DCLeaks.com, and WikiLeaks to I
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.?

l3. Guccifer 2.0, who claimed to be an independent Remanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Of?ce has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third~party cloud-computing service. In or around late
September, these individuals stole data from these cloud~based computers by creating backups of
the cloud?based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts. I

16. On orabout September 4, 2016, individuals assdciated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida ecunties.

 

Case Document 29-25 Filed 04/28/20 Page 23 of 61

18. On luly 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military of?cers for criminal offenses related to efforts to in?uence the 2016
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Vikror Borisovich NegIksho, er al. (Case No. 

C. Public Interactions. with Guccifer 2.0 and WikiLeaks

19. On June 14, 2016, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC back. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.?

In that post, Guccifer 2.0 also began releasing hacked DNC documents. I

20. I On July 22, 2016, WikiLcaks published approximately 20,000 email-s stolen from
meDNc.

21. On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 20?s website. Have a look and you?ll see he explains who he is and
why he. did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks With the DNC ?les and the rest is history. Now the World would
see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican



 

Case Document 29-25 Filed 04/28/20 Page 24 of 61

Organization. During his speech, he was asked about a statement by WikiLcaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?? STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with ASSANGE, he had a close
friend who served as an intermediary.

23. On August 12,- 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a'twe-et using @RogerJStoneJr calling
Guccifer 2.0 a after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0?3 Twitter account was reinstated. I

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, ?@RogerJ Stone] paying you
back.? iuccifer also sent a private message to @RogerJStoneJr stating ?i?rn pleased to say 
great man. please tell me if I can help anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that worked with a Washington D.C.~based lobbying ?rms to in?uence U.S. .
policy toward Ukraine. 

27. 'On August 2i, 2016, using @RogerJStoneJR, STONE twe'eted: ?Trust me, it will

 

Case Document 29-25 Filed 04/28/20 Page 25 of 61

soon the [sic] Podesta?s time in the barrel.#CreokedHi11ary.? in a interview that same
day, STONE reiterated that becairse of the work of a ??mutual acquaintance? of both his and
the public [could] expect to see much more from the exiled whistleblower in the
form of strategically?dumped Clinton email batches.? He added: ?Weil, ?rst of all, I think Julian
Assange is a hero. .. i think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all ofthose emails that Hume Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and alot more. These are like the Watergate tapes.?

28. On September 16, 2016, STONE said in a radio stems with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server.?

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinto-n is done. #WikiLeaks.? I

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tw'eeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the clay of the ASSANGE announcement which was
part of WikiLeaks? 10-year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerJStoneJr
to tweet: ?Payload coming. #Lockthemup.?

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article Containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of lewd remarks.

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading



 

Case Document 29-25 Filed 04/28/20 Page 26 of 61

The Podesta Emails #HillaryClinton #Podesta #imWithHer? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta referring back to August 21,
2016 and Twitter references argued ?[it is] a reasonable assumption to 
or at least a reasonable conclusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that-he had never met or spoken
with Assange, saying that ?we have a mutual friend whole traveled to London several times, and
everything I know is through that channel of communications. I?m not implying I have any
in?uence with him or that i have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e?rnails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since 1 never commnnicated with WikiLeaks, I guess I must be innocent of -
charges I knew abbut the hacking of Podesta?s email (speculation and conjecture) and the timing
or scepe of their subsequent disclosures. So 1 am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true.?

I). Private Twitter Direct Messages with WikiLeaks and ASSANGE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

-9-

 

Case Document 29-25 Filed 04/28/20 Page 27 of 61

I Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikilealts.I The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since 1 was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are.
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me? cordially 

36. Less than an hour later, @wikileaks responded by direct message: ?We'appreciate 
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t go there if you don?t want us to correct you.?

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: ?Ha! The more you \"correct me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

38. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to communicate.?

39. In addition, @RogerJStoneJl' also exchanged direct messages with ASSANGE,
the founder of WikiLeaks. For example, onJune 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
?Still nonsense. As ajournalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were

 

On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.

-10-

 

Case Document 29-25 Filed 04/28/20 Page 28 of 61

indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped?up sexual assault
charges dropped I don?t know of any crime you need to be pardoned for best regards. That
same'day, @JulianAssange responded: ?Between CIA and Do] they?re doing quite a lot. On the
Do} side that?s coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."

40. On Saturday, June l0, 20-17, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

this forum as experience demonstrates it is monitored. Best regards 

E. Communications with Others Regarding
Forthcoming Leaks

41. On September 1 1, 2017, Chief Judge Beryl A. Howell of thelDistrict'of Columbia

issued a search warrant for -address,? On October 17,

2017, Chief Judge Howell issued a search warrant for one of -a'ddresses,

On or about December 19, 2017, Chief Judge Howell issued a search

 
 

warrantfor email account. On or about March 14, 2018, Chief Judge Howell

issued a search warrant for iCloud account. Information recovered pursuant to these

search warrants indicated the following:

42. On or about May 15, 201 6-emailed CORSI: ?Here is my ?ight

schedule. Need to get something con?rmed now . . . CORSI responded, copied Roger

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

 

Case Document 29-25 Filed 04/28/20 Page 29 of 61

appears to have forwarded the message to STONE at?who replied to

CORSI that, ?May meet Manafort guarantee nothing.?

43. 011 of about May 18, 2016, coasr emailed STONE at?

with the title, ?Roger -- why don?t you look this over before I send it to-I believe that I

com
and I did manage to see Mr. Trump for a few minutes today as we were

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and

 

 

was very cordial. He would look for this memo from you this afternoon.?

44. On July 25, 2016, STONE, using _ent an email to
CORSI with the subject line, ?Get to Assange.? The body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
Foundation, allegedly.? 

45. I On or about July 31, 2016, STONE, using ?emailed
CORSI with the subject line, ?Call me The body of the email read: -should see
AssangeL] -should ?nd Bernie [S]anders brother who called Bill a Rapist turn him for
Trump[.] -should ?nd -or more proof of Bill getting kicked out.?

46.. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), OORSI emailed STONE at I

??Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are Fox
will have me on mideAug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. bump for HRC an artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in preseason games. Time to let more than Podesta to

-12-

 

Case Document 29-25 Filed 04/28/20 Page 30 of 61

be exposed as in bed enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, .settingstage for Foundation
debacle." Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016, __an associate of emailed
STONE at? The email contained a link to a poll indicating that-Clinton

led Trump by 15 points. STONE responded ?enjoy it while can[.] i dined with my new pal
Julian Assange last night.? - subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet stated
that in STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting ASSANGE. STONE toid- he was joking and
had not actually met ASSANGE.2

48. Through a search of iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to -0 have ?dined? with ASSANGE. For example, an associate of
STONE. sent a text to STONE at approximately on August 2, asking ?How did ur meeting

go in STONE responded. ?it?s this The following day, the associate asked,

?Any report from ur meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

 

Case Document 29-25 Filed 04/28/20 Page 31 of 61

call later heading for airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had geowlocation
information indicating that it was taken in Los Angeles.
. On or about August 15, 2016, CORSI emailed STONE at 
??Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it?s not over yet. More to come than anybne realizes. Won?t really get started
until after Labor Day. i?rn in NYC this week. Jerry.?
50 . On or about August 31, 2016, emailed STONE at
_?Did you get the PODESTA writeup.? STONE replied 

On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation tied to Ukraine Yanukovych ?a Panama papers reveals Podesta hired by
Russia?s largest ?nancial institution Podesta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, emailed STONE at I

Is NY Post going to use the Pedesta [sic] stuff??
53. On or about September 24, 2016,-emailed CORSI, will have much

more on Turkey. Need a back channel highly sensitive stuf x? CORSI responded, ?We have

secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about

it again back, ?Awaiting secret ?le. Hope you are well.

Can?t wait for the debate. Channeling Reagan, I hope!? CORSII responded, ?Keep me posted

about In a subsequent meeting with investigators,-indicated this .

conversation concemed'possible derogatory information he was trying to obtain from Turkey.

-14-

 

Case Document 29-25 Filed 04/28/20 Page 32 of 61

54. On or about October 3, 2016, an associate of STONE eniailed STONE at
and asked: ?Assange what?s he got? Hope it?s good.? STONE wrote

back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in JaniMany scores will be settled.? 'I?heassociate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: ?You should call Roger. See'
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s
important.?

55. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to thenwcandidate Clinton, but WikiLeaks did

. not make any new releases. Instead, ASSANGE promised more documents, including
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process.? ASSANGE also stated that
WikiLeaks would publish documents on various-subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud 
?Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.?

57. That same day, BANNON emailed STONE at? ?What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done BANNON wrote back, ?He didn?t
eat deal w/ STONE replied, ?Don't think so BUT his lawye-is a big

demo crat.?

-15-

 

Case Document 29-25 Filed 04/28/20 Page 33 of 61

58. When BANNON spoke with investigators during a voluntary interview on.
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE-about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.

F. STONE and CORSI Communications on October 7, 2016, when the Padesta Emails
Are Released. 

59. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,



calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.-?

60. According to phone records at approximately

1 1:27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately STONE received a phone call from the Washington

Post. The call lasted approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for

approximately seventeen minutes.

63. At approximately CORSI called STONE and the two spoke for

approximately twenty minutes.

 

3 
d747l 4-80e5-1 lc6-87Se?2cl bfe943 b66_story.html

?i6-

 

Case Document 29-25 Filed 04/28/20 Page 34 of 61

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape. 

65. At approximately WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, CORSI emailed STONE using expect

that rnuch of next dump focus, setting stage for Foundation debacle.?

66. At approximately author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with. STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? withla link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using

forwarded-message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual. I

G. STONE Asks CORSI for to Post About Podcsta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI reSponded to STONE, ?Ok. I understand.? Approximately twenty-
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job

numbers.?

68. On or about Wednesday, October 12, 2016, at approximately STONE,

using _mailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?Ok. Monday. The remaining stuff on

-17- .

 

Case Document 29-25 Filed 04/28/20 Page 35 of 61

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice??

69. On or about that same day, October 12, 2016, Podcsta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at both ?With the subject
line ?Podesta talking points.? Attached to the email was a file labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that
?Podesta is at the heart of a Russian?government money laundering operation that bene?ts
?nancially Podesta personally and the Clintons throngh the Clinton Foundation.?

70. CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second timejust to be sure you got it.? STONE emailed
back via the-Account, ?Got them and used them.?

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

Joule ties to RUSSIA MONEY LAUNDERING to

CLINTON STONE responded, ?Nice but I was hoping for a piece I could

 

post under my lay-line since I am the one under attack by Podesta and now Mook.? CORSI
wrote back to STONE, ?I'll give you one more NOBODY YET HAS It looks to me
like -kimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America?s
Clinton Fund acCount, there?s no telling hriw much money he laundered, or where it ended up.

Nothing in Clinton Foundation audited ?nancials or IRS Form 9903 about received via

-13-

 

 

Case Document 29-25 Filed 04/28/20 Page 36 of 61

Russia Metcombank[.] I?m working on that angle now.? STONE replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI
sent STONE an email at?with the subject, STONE article
RUSSIAN MAFIA STYLE G, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton Foundation and John Podesta.? In that post, STONE wrote, ?although 
have had some communications with Wikilcaks I had no advance notice about the
backing of Mr. Podesta nor 1 have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by -With the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?? I

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. - On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
?On Assange, can you call me now before STONE responded, ?Missed -?just
landed JFK on lnfowars now.? wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

 

Case Document 29-25 Filed 04/28/20 Page 37 of 61

75. On or about October 17, 2016, CORSI emailed STONE at
. .URGENT. . CORSI wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and UK. He will drop the goods on them if
they move to extradite him. My guess-is that he has a set of dead man files that include Hillary.
It?s what they used to call a ?Mexican stand off[.] Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.? Based on review of the original email that CORSI forwarded, the
?trusted source? was a self?identi?ed retired librarian who gathers information from public chat
rooms.

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbartcom in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-mails.?
STONE stated that, predicted that Podesta?s business dealings would be eXposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

73. I On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.? 

H20-

 

Case Document 29-25 Filed 04/28/20 Page 38 of 61

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

 Document 29-25 Filed 04/28/20 Page 39 of 61

 

Case Document 29-25 Filed 04/28/20 Page 40 of 61 - 

 

I. Congressional Testimony and Public Statements About His Relationship
with Wikileaks -

88. On September 26, 2017, STONE testi?ed before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts. .

My Tweet of August 21, 2016, in which I said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time .
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Turnip
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my

Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers? business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,

would come under public scrutiny. . . .

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange? announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked ajournalist who I knew had interviewed
Assange to independently con?rm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go-between? and ?mutual friend." All of these monikers are equally
true.

-23-

 

Case Document 29-25 Filed 04/28/20 Page 41 of 61

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic
members of HPSCI published excerpts from Stone?s September 2017 testimony before HPSCI.
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or

encouragement been in any type of contact with Julian Assange?

MR. STONE: No.

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange,

you were only referring to a single fact that you had con?rmed with the intermediary 

MR. STONE: That 

Q: was the length and the breadth of what you were referring to? -

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, I
2017, STONE published an article on his website, stoneeoldtruth.eom, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. . . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story.?

J. Messaging to Randy CREDICO about ?Back channel?

91. On or about November 19, 2017, Randy CREDICO (who, as described further.
below, STONE publicly identi?ed as his ?intermediary? to ASSANGE), messaged STONE, ?My
lawyer wants to see me today.? STONE responded, ?Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told-that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24.

 

Case Document 29-25 Filed 04/28/20 Page 42 of 61

back, ?That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a dea STONE wrote back, ?To do what Nothing
happening in DC the day before Thanksgiving why are busting my chops??

93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 11 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] Ijust followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for 

94. I STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, ?_?Forensic evidence proves that there is no back Channel. So
now you can relax.?

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? in a public Facebook post, STONE further stated that ?Credico merely 

-25-

 

Case Document 29-25 Filed 04/28/20 Page 43 of 61

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e-rnails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could haVe just told him the truth that you didn?t have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICO
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If 
you testify you?re a fool. Becauseiof tromp [sic] i could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

-26..

 

Case Document 29-25 Filed 04/28/20 Page 44 of 61

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say i haVe solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?Yiou got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.?

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?EmbasSy
logs . . -. 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you?ll get
off because you?re friends with Trump so don?t worry. .1 have all the forensic evidence[.] 1 was
not a ba[cl<] Channel and I have all those emails from September of 201 6 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown

reporters copies of email messages he had received from STONE in the prior few days that

-27-

 

Case Document 29-25 Filed 04/28/20 Page 45 of 61

stated, "You are a rat. You are a stoolie. You hackstab your friends run your mouth my
lawyers are dying Rip you to shreds." Another message stated, ?I?m going to talte that dog away
from you,? referring to therapy dog. CREDICO stated that it was ?certainly scary .
. . When you start bringing up my dog, you?re crossing the 
104? On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.6 In these messages, STONE, on April 9, 2013,
stated: am so ready. Let?s get it on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . I. . It was sent in response to that. We talked about it too.

He was depressed about it. Or was he The article noted that CREDICO stated he did not

have prostate cancer and did not have any such discussion with STONE.

K. The Target Accounts

 

 

5 
threatened?dog? 35 91 13 70.html
6 

~28? 

 

Case Document 29-25 Filed 04/28/20 Page 46 of 61 .

 

Case Document 29-25 Filed 04/28/20 Page 47 of 61

 

Case Document 29-25 Filed 04/28/20 Page 48 of 61

BACKGROUND CONCERNING TWITTER
115. In my training and experience, Twitter owns and operates a free?aecess social?

networking website of the same name that can be accessed at Twitter

 

Case Document 29-25 Filed 04/28/20 Page 49 of 61

allows its users to create their own pro?le pages, which can include a short biography, a photo of
themselves, and location information. Twitter also permits users create and read l40-character
messages called ?Tweets,? and to restrict their ?Tweets? to individuals whom they approve. These
features are described in more detail below.

1 16. Upon creating a Twitter account, a Twitter user must create a unique Twitter
username and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.

117. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafterrThis information may include the user?s full name, e?mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identi?ers. For eaCh user, Twitter may retain information about
the date and time at which the user?s profile was created, the date and time at which the account
was created, and the Internet Protocol address at the time of sign?up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which Computers or other devices were used to access a given Twitter account.

18. A Twitter user can post a personal photograph or image (also known as an
??avatar") to his or her profile, and can also change the pro?le background or theme for his or her
account page. In addition, Twitter users can post ?bios? of 160 characters or fewer to their pro?le
pages.

ll9. Twitter also keeps 1P logs for each user. These logs contain information about the
user?s logins to Twitter including, for each access, the 1P address assigned to the user and the

date stamp at the time the user accessed his or her pro?le.

-32-

 

Case Document 29-25 Filed 04/28/20 Page 50 of 61

91

120. As discussed above, 'l?witter users can use their Twitter accounts to post ?Tweets
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also ?favorite,? ?retweet,? or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter usernaine, often preceded by the sign,
Twitter designates that Tweet a ?mention? of the identi?ed user. In the ?Connect? tab for each
account, Twitter provides the user with a list of other users who have ?favorited? or ?retweeted?
the user?s own Tweets, as well as a list of all Tweets that include the user?s usernarne (ta, ailist
of all ?mentions? and ?replies? for that usernarne).

121. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that?the user has shared on Twitter,
including images uploaded by other services. I

122. Twitter users can also opt to include location data in their Tweets, which will
reveal the users? locations at thetime they post each Tweet. This ?Tweet With Location?
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.

123. When Twitter users want to post a Tweet that includes a link to awebsite, they
can use Twitter?s link service, which converts the longer website link into a shortened link that
begins with This link service measures how many times a link has been clicked.

124. A Twitter user can ?follow? other Twitter users, which means subscribing to
those users? 'l?weets and site updates. Each user pro?le page includes a list of the people who are
folloWing that user (119., the user?s ?followers? list) and a list of people whom that user follows
(218., the user?s ?following? list). Twitters users can ?unfollow? users whom they previously

followed, and they can also adjust the privacy settings for their pro?le so that their Tweets are

-33-

 

Case Document 29-25 Filed 04/28/20 Page 51 of 61

visible only to the peeple whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into ?lists? that display on the right 
side of the user?s home page on Twitter. Twitter also provides users with a list of ?Who to
Follow,? which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.

125. in addition to posting Tweets, a Twitter user can. also send Direct Messages
(DMS) to one of his or her followers. These messages are typically visible only-to the sender and
the recipient, and both the sender and the recipient have the power to delete the message'from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular ?user, but older DMs are stored on Twitter?s database. I

126. Twitter users can con?gure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can con?gure his or her Twitter account to send updates to the
user?s mobile phone, and the user can also set up a ?sleep time? during which Twitter updates
will not be sent to the user?s phone.

127. Twitter includes a search function that enables its users to search all public
Tweets for keywords, uscrnames, or subject, among other things. A Twitter user may save up to
25 past searches.

128. . Twitter users can connect their Twitter accounts to third?party websites and
applications, which may grant these websites and applications access to the users? public Twitter
pro?les.

129. If a Twitter user does not want to interact with another user on Twitter, the ?rst 

user can ?block? the second user from following his or her account.

-34-

 

Case Document 29-25 Filed 04/28/20 Page 52 of 61

130. In some cases, Twitter users may communicate directly with Twitter about issues
relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider?s support services, as well as records of any actions taken by
the provider or user as a result of the cemmunications. Twitter may also suspend a particular user-
for breaching Twitter?s terms of service, during which time the Twitter user will be prevented
from using Twitter?s services.

131. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user?s account information, log, storedelectronic communications, and other data

retained by Twitter, can indicate who has used or controlled the Twitter account. This ?user
attribution? evidence is analogous to the search for ?indicia of occupancy? while executing a
search warrant at a residence. For example, pro?le contact information, communications,
?tweets? (status updates) and ?tweeted? photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant

time. Further, Twitter account activity can show how and when the account was acCessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along. with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.

Such information allows investigators to understand the geographic and chronological context of

-35-

 

Case Document 29-25 Filed 04/28/20 Page 53 of 61

Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds gee?location into some of its services, If enabled by the user, physical location is
automatically added to ?tweeted? communications. This geographic and'timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitteraccount owner?s state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner?s motive and intent to commit a crime information indicating a criminal
plan) or consciousness of guilt deleting account information in an effort to conceal
evidence from law enforcement).

132. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information

FILTER REVIEW PROCEDURES

133. Review of the items described in Attachment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney?client and
other operative privileges; The procedures include use, if necessary, of a designated ??lter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION

 

134. Based on the forgoing, I request that the Court issue the proposed search warrant.
135. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement officer is not

required for the service or execution of this warrant.

-36?

 

Case Document 29-25 Filed 04/28/20 Page 54 of 61

REQUEST FOR SEALING
136. I further request that the Court order that all papers in support of this application,
including the af?davit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
doCuments because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

9%

z?atrick J. Myers
Special Agent
Federal Bureau of Investigation

Subscribed and sworn to before me on this day of September, 2018}



The Honorable Bleryl A. Howell
Chief United States District Judge

-37-

 

Case Document 29-25 Filed 04/28/20 Page 55 of 61

ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Twitter aecounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or

operated by Twitter, Inc. (?Twitter?), a company headquartered in San Francisco, California

 



 

Case Document 29-25 Filed 04/28/20 Page 56 of 61

I.

ATTACHMENT 

Information to be disclosed by Twitter

To the extent that the information described in Attachment A is within the possession,

custody, or control of Twitter, Inc. (?Twitter?), including any messages, records, ?les, logs, or

information that have been deleted but are still available to Twitter, or have been preserved

pursuant to-a request made under 18 U.S.C. 2703 Twitter is required to disclose the following

information to the government for each account listed in Attachment A:

A.

All ?Tweets? and Direct Messages sent, received, ?favorited,? or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;

The content of all communications (public or private) sent to or from, stored in draft form

in, or otherwise associated with the account, including the content of all messages,

attachments, and header information;

All data and information associated with the pro?le page, including photographs, ?bios,?
and pro?le backgrounds and themes; 

All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, phdtos, and videos; 

All information from the "Connect? tab for the account, including all lists of Twitter users

who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets

that include the username associated with the account ?mentions" or ?replies?);
All photographs and images in the user gallery for the account;

All location data associated with the account, including all information collected by the
?Tweet With Location? service;

All information about the account's use of Twitter?s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked; 

. All data and information that has been deleted by the user;

A list of all of the people that the user follows on Twitter and all people who are following
the user the user?s ?folloWing? list and ?followers? list); 

A list of all users that the account has ?unfollowed? or blocked;

All ?lists? created by the account; -

 

Case Document 29-25 Filed 04/28/20 Page 57 of 61

All information on the ?Who to Follow? list for the account;
All privacy and account settings;

All records of Twitter searches performed by the account, including all past searches saved
by the account; -

All current and historical subscriber and payment information, including full name, e?mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identi?cation numbers, security questions. and answers,
registration address, payment history, and other personal identi?ers;

All email addresses and telephone numbers ever registered (whether successfully or not)

- to the account, including dates of any changes and the IP addresses used for any changes;

All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;-

All data and information associated with the pro?le page, including photographs;

All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created; 

The dates and times at which the account and profile were created, and the Internet Protocol
address at the time of sign-up;

All transactional records associated with the account, including any logs or other records
of session times and durations; 

Any information identifying the device or devices used to access-the account, including a
device serial number, a GUID or Global Unique Identi?er, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers
Mobile Equipment Identi?ers Mobile Identi?cation Numbers
Subscriber identity Modules Mobile Subscriber Integrated Services

Digital Network Number International Mobile Subscriber Identi?ers
. or International Mobile Equipment Identities and any other

information regarding the types of devices used to access the account;

All activity logs for the account;

All location information for the account, including all location data collected by any
plugins or widgets;

The types of service utilized by the user;

-3-

 

Case Document 29-25 Filed 04/28/20 Page 58 of 61

BB.

CC.

DD.

EB.

FF.

GG.

HH.

11.

II.

All information about the account?s use of Twitter?s link service, including all website links
embedded in, exporting data to, or importing data from, the acco unt?s website or blog;

. All full website links that were shortened by Twitter?s link service, all resulting shortened

links, and all information about the number of times that a link posted by the account was
clicked;

All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;

All data and information that has been deleted by the user;

The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number); 

All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;

Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration 11? address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identi?er; 

Information regarding accounts linked to accounts to which the Target Accounts are linked;

All records pertaining to communications between the Service Provider and any person
regarding the user or the user?s account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber. -

. Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, ?nite, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 13-

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 .S.C. 1030 (unauthorized

access ofa protected computer); 18 U.S.C. 1505 and 1512 (obstruction ofjustice),18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

-4.

 

Case Document 29-25 Filed 04/28/20 Page 59 of 61

a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or regarding disinformation, denial, disSernbling
or other ob?lscation about knowledge of, or access to, hacked material;

b. Ali records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, - Julian

individual associated with the Trump Campaign, any witness in the investigation;

0. Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;

d. Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals; -

e. I All images, messages, communications, calendar entries, search terms, ?address
book? entries and I contacts, including any and all preparatory steps taken in
?irtherance of the above-listed offenses;

f. Communications, records, documents, and pther ?les that reveal efforts by any
person to conduct activities on behalf of, for the bene?t? of, or at the direction of
any foreign government, foreign of?cials, foreign entities, foreign persons, or

foreign principals;

 

Case Document 29-25 Filed 04/28/20 Page 60 of 61

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under inVestigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;

i. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such 

j. I Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account; I

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement;

l. The identity of any non?US. persontsy?including records that help reveal the
whereabouts of the made any eitpenditure, independent
expenditure, or disbursement for an electioneering communication; and

In. The identity Of any records that help reveal the whereabouts
of the person(s)mwho communicated with the account about any matters relating
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign
principals. I I

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed

in subsection Ha.

 

Case Document 29-25 Filed 04/28/20 Page 61 of 61

Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney?client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.