Case Document 29-26 Filed 04/28/20 Page 1 of 71

A0 93 (Rev. 1 1233) Search and Seizure warrant

UNITED STATES DISTRICT COURT

for the
District of Columbia

In the Matter of the Search of Case: 1:1 
(Brie?y describe the property to be searched A 8"30?0291 9 i
or identi?; the person by name and address) ASSiQned TO. Beryl A i
Date: 9/27/201 i
ASSOCIATED WITH FOUR Description 8 8 i
ACCOUNTS STORED AT PREMISES earch Seizure Warrant i
CONTROLLED BY FACEBOOK i

SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
(identi?; the person or describe the property to be searched and give its location):

 

See Attachment A

1 ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search Will reveal (identi?) the person or describe the property to be seized):

See Attachment 

YOU ARE COMMANDED to execute this warrant on or before October 1 1 . 2018 (not to exceed 14 days)

in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from Whose premises, the property was taken, 01' leave the copy and receipt at the place where the

property was taken.
The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory

as required by law and return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)

El Pursuant to 18 U. S. C. 3103a(b), i find that immediate noti?cation may have an adverseiesult listed In 18 S. C.
2705 (except for delay of t11al), and authorize the of?cer executing this warrant to delayr notice te the. person who, or whose

property, will be searched 01 seized (check the appropriate box) 
for days (not to exceed 30) El until, the facts justifying, the later specific date of-

 

 

Date and time issued: 7/2? ?19 f/?q 

 

fudge? signatw 

Hon. Beryl A. Howell, Judge

Printed Home and title

City and state: DC

 

 

Case Document 29-26 Filed 04/28/20 Page 2 of 71

A0 93 (Rev. LUI3) Search and Seizure Warrant (Page 2)

 

Return

 

Case 0.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory made in the presence of 

 

Inventory of the property taken and name of any person(s) seized:

 

 

Certi?cation

 

I declare under penalty of perjury that this inventory is correct and. was returned along with the original warrant to the
designatedjudge.

Date:

 

 

Executing o?icer ?s signature

 

Printed name and title

 

 

Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 3 of 71

ATTACHMENT A
Property to be Searched

This wanant applies to infonnation associated with the Facebook accounts registered to
the following email addresses ("Target Facebook Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook, Inc. ("Facebook"), a company headquartered in
Menlo Park, California:

This wanant also applies to information associated with the Instagram accounts registered
to the following email addresses ("Target Instagram Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook:

1-

 Case Document 29-26 Filed 04/28/20 Page 4 of 71

ATTACHMENT 

I. Information to be disclosed by 

A.

To the extent that the information described in Attachment A is within the

possession, custody, or control of the acebook, Inc. (hereinafter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, files, logs, or information that have been deleted but are still

available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target Facebook Accounts listed in Attachment A:





(0)



All contact and personal identifying information, including full name, user
identi?cation number, birth date, gender, contact e?mail addresses, physical address
(including city, state, and Zip code), telephone numbers, screen names, websites,
and other personal identi?ers.

All activity 10 gs for the account and all other documents showing the user?s posts
and other Facebook activities;

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated with those photos and-videos;
All pro?le information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends? Facebook user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Facebook group identi?cation numb ers;
future and past event postings; rejected ?Friend? requests; comments; gifts; pokes;

tags; and information about the user?s access and use of Facebook applications;

-2-

 

Case Document 29-26 Filed 04/28/20 Page All other records of communications and messages made or received by the user,
including all private messages, chat history, Video calling history, and pending
?Friend? requests;

All records relating to machine cookies;

All ?check ins? and other location information, including records of the user?s
latitude and longitude;

All IP logs, including all records of the IP addresses that logged into the account;
All records of the account?s usage of the ?Like? feature, including all acebook
posts and all non-Facebook webpages and content that the user has ?liked?;

All information about, the Facebook pages that the account is or was a ?fan? of;
All past and present lists of friends created by the account;

All records of Facebook searches performed by the account;

All information about the user?s access and use of Facebook Marketplace;

The types of service utilized by the user;

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

Group identi?cation numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group pro?le page;

All past and present Admins for the group;

The ?Creator? of the group;

 

Case Document 29-26 Fi-Ied 04/28/20 Page 6 of 71

(S)



B.

All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

All records pertaining to communications between Facebook and any person
regarding the user or the user?s Facebook account, including contacts with support
services and records of actions taken;

All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and-queried.

To the extent that the information described in Attachment A is within the

possession, custody, or control of the Facebook, Inc. (hereinafter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

- available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target Instagram Accounts listed in Attachment A:

a.

All contact and personal identifying information, including full name, user
identi?cation number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identi?ers;

All past and current usernames associated with the account;

All activity logs for the account and all other documents showing the user?s posts

and other Instagrarn activities;

 

Case Document 29-26 Filed 04/28/20 Page 7 of 71

d. The dates and times at which the account and pro?le were created, and the Internet
Protocol address at the time of sign-up;

e. All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated with those photos and videos;

f. All pro?le information; News Feed informatidn; status updates; Videos,
photographs, articles, and other items; Notes; friend lists, including the friends? and
followers? Instagram user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Instagram group identi?cation numbers;
future and past event postings; tags;

g. All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending

?Friend? or ?follower? requests;

h. All records relating to machine cookies;

i. All ?check ins? and other location information, including records of the user?s
latitude and longitude;

j. All IP logs, including all records of the IP addresses that logged into the account;

k. All records of the account?s usage of the ?follow? feature, including all Instagram

posts and all non-Instagram webpages and content that the user has ?liked?;

I. All past and present lists of friends created by the account;
m. All records of Instagram searches performed by the acdount;
n. The types of service utilized by the user;

 

II.

Case Document 29-26 Filed 04/28/20 Page 8 of 71

The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

All information regarding the particular device or devices used to login to or access
the account, including device identi?er information or cookie information,
including all information about the particular device or devices used to access the
account and the date and time of those accesses;

Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;

All past and present Admins for the group;

The ?Creator? of the group;

All privacy settings and other account settings, including privacy settings for
individual Instagrarn posts and activities, and all records showing which Instagram
users have been blocked by the account;

All records pertaining to communications between Facebook or Instagram and any
person regarding the user or the user?s Instagram accOunt, including contacts with

support services and records of actions taken.

Information to be Seized by the Government

Any and all records that relate in any way to the accounts described in Attachment A

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

 

Case Document 29-26 Filed 04/28/20 Page 9 of 71

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ban) for the

period from March 1, 2016 to the present, including:

at

All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to

communications or meetings involving Jerome Corsi, _Julian

individual associated with the Trump Campaign, any witness in the investigation;
Communications, records, documents, and other ?les related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;
Records of any funds or bene?ts disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

All images, messages, communications, calendar entries, search terms, ?address
book? entries and contacts, including any and all preparatory steps taken in

furtherance of the abdve-listed offenses;

 

Case Document 29-26 Filed 04/28/20 Page 10 of 71

f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user? state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

that help reveal the whereabouts of such person(s);

j. Credit card and other ?nancial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement; I

l. The identity of any non-US. records that help reveal the
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and

m. The identity of any records that help reveal the whereabouts
of the conununicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign

principals.

 

Case Document 29-26 Filed 04/28/20 Page 11 of 71

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;

0. All existing printouts from original storage which concern the categories identi?ed
in subsection 

111. Review Protocols

Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team,? separate and apart from the investigative team, in order to address potential privileges.

 

 Document 29-26 Filed 04/28/20 Page 12 of 71

can? 
IN THE UNITED STATES DISTRICT COURT 2' 2%

FOR THE DISTRICT OF COLUMBIA Wt. as. District at at - . .
. @0111! is for the District 

IN THE MATTER OF THE- SEARCH OF
INFOREIATION ASSOCIATED WITH FOUR
ACCOUNTS STORED AT PREMISES
CONTROLLED BY FACEBOOK

Case: 

Assigned To Howell, Beryl A.

Date 9/27/2018

Description: Search Seizure Warrant

 

em
The United. States has ?led a motion to seal the above-captioned warrant and related
documents, including the application and a?davit in support thereof (collectively the 
and to require Facebook, Inc. an electronic communication and/or remote
computing services provider headquartered in Menlo Park, California, not to disclose the existence
or'contents of the Warrant pursuant to 18 U.S.C. 2705(b). I
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that noti?cation
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to ?ee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See 18 U.S.C. 
. . IT IS THEREFORE ORDERED that the motion is and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related

materials, the instant motion to Seal, and this Order be SEALED until further order of the Court;

and

Case Document 29-26 Filed04/28/20 Page 13 Of 71

IT IS FURTHER ORDERED that, pursuant to 18 27050)), Facebook and its
employees shall not disclose the existence-or content of the Wan'ant to any other person (except
attorneys for Facebook for the purpose of receiving legal advice) fof a period of one year or until

further order of the Court.

x4473 - .W
THE HONORABLE HOWELL
CHIEF UNITED STATES DISTRICT JUDGE

. 7117720 72?.

Date

 Document 29- 26 Filed 04/28/20 Page 14 of 71

[hf-H?


til?h .



If. 
i

UNITED STATES DISTRICT COURT 3? i

for the 33in} 3- i? 

District Of Columbia ?lerk Ux?l iJistriLt 8. Bankruptcy
Courts tor the District of Columbia

?3.1

In the Matter of the Search of

(Bi ie?y describe the pi ope? [y to be searched
or identify the person by name and address)

INFORMATION ASSOCIATED 
FOUR ACCOUNTS-STORED AT PREMISES
CONTROLLED BY FACEBOOK

Case: 1: 18 sc? 02919

Assigned To: Howell BerylA.
Assign Date: 9/27/2018

Description. Search Seizure Warrant



APPLICATION FOR SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identt?/ the person or describe the

property to be searched and give its location): 
See Attachment A
located in the Northern District Of California there is now concealed (identity the

 

 

person or describe the property to be seized):

See Attachment 

The basis ?01 the search under Fed. R. Crim. P. 41(c) 18 (check one orrnore):

[Elevidence of a crime;
lifeontiaband, fruits of crime, or other items illegally possessed;

property designed for use, intended for use, or used in Committing a crime;

a person to be arrested or a person who is unlawfully restrained.

The search is related to a Violation of: 

Code Section O?ense Description
52 U.S.C. 30121 - Foreign Contribution Ban 
18 U.S.C. 1001, 1030," 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Af?davit for ad d?l 

The application is based on these facts:
See attached Affidavit.

Er Continued on the attached sheet.
i3 Delayed notice of days (give exact ending date if more than 30 days:
under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet.

@Zp? ff??
Reviewed by I Applieant? signature
Patrick J. Myers, Special Agent, FBI

Printed name and tide

is requested

 

 

 

 

Kyie R. Freeny (ASC)

 

Sworn to before me and signed in my presence.

 

Date: 7/}f/213/2 @f 

Judge signature

Hon. Beryl A. Howell, Chief US. District Judge

Printed name and title

City and state: D-C-

Case Document 29-26 Filed 04/28/20 Page 15 of 71
I 1:3 $3253 5-ng
LL LL LL33 .3):

. SE 2 29323
IN THE UNITED STATES DISTRICT COURT
?1 '1 Clerk, US Dlat?eiE-i Bankruptcy
FOR THE DISTRICT OF COLUMBIA Semis fer the District of Columbia

IN THE MATTER OF THE SEARCH OF

INFORMATION ASSOCIATED WITH Case: 1 

Assigned To: Howell BerylA.
FOUR ACCOI NFS STORED AI
Assign. Date: 9/27/2018

PREMISES CONTROLLED BY

FACEBOOK Description: Search Seizure Warrant

 

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT

I, Patrick If Myers, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I make. this affidavit in support of an application for a search warrant for
information associated with the two Facebook accounts and two Instagram accounts (the ?Target
Accounts?), stored at premises owned maintained, controlled or operated by acebook A Inc.
(?Facebook?), a company headquartered in Menlo Park, California. As set forth below, the Target

Accounts are believed to be

 

Up on receipt of the information described in Attachment A, government-authorized

persons will review that information to locate the items described in Attachment B.

2. I am a Special Agent-with the Federal Bureau of Investigation assigned to .
FBI Pittsburgh werking directly-with the Special Counsel?s Office. I have been a Special Agent
with the FBI since-2017. I was previously employed as a network andsoftware engineer for
approximately ?fteen years, including for the FBI. As a Special Agent, I have conducted national-
security investigations relating to foreign intelligence and cybersecurity.

3. The facts in this affidavit come from my personal observations, my training and

experience, and informationobtained from other FBI personnel and witnesses. This affidavit is

-1-

Case Document 29-26 Filed 04/28/20 Page 16 of 71

intended to Show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.

4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
instrumentalities of Violations of 18 U.S.C. 371 (conspiracy), 18 U.S.C. 2 (aiding and
abetting), 18 U.S.C. 3 (acCessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18
U.S.C. 1001 (false statements), 18 U.S.C. 1030 (unauthorized access of a protected
computer), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to commit
Wire fraud), 18 U.S.C. 1505 and 1512 (obstruction ofjustice), 18 U.S.C. 1513 (witness
tampering), and 52 U.S.C. 30121(a)(1)(C) (foreign'expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instlurnentalities of the Subject Offenses, further described in Attachment B.

JURISDICTION A

5. i This Court has jurisdiction to issue the requested warrant because it is ?a court of

competent jurisdiction? as defined by 2711. Id. 2703(a), 
Speci?cally, the Court is ?a district court of the United States (including-a magistrate
judge of such a court) . . . that has jurisdiction over the offense being investigated.? 18 U.S.C. I
2711(3)(A)(i). The offense conduct included activities in Washington, DC, as detailed below.
PROBABLE CAUSE I
A. Background on Relevant Individuals
I Roger STONE
6. Roger STONE is a self?employed political strategist/consultant and has been

actively involved in US. politics for decades. STONE worked on the presidential campaign of



Case Document 29-26 Filed 04/28/20 Page 17 of 71

Donald J. Trump (the ?Ca1npaign?) until August 2015. Although Stone had no official
relationship with the Campaignthereafter, maintained his support for Trump and
continued to make media appearances in support of the, Campaign. As described further below,
STONE also maintained contact with individuals employed. by the Campaign, including then~
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI I I

7. Jerome CCRSI is a political commentator who", according to publicly available
information, served as the ?Washington Bureau Chief for Inforwarscom.? According to
publicly?available sources, from 2014 until January 2017, CORSI was a ?senior staff reporter?
for the website ?World Net Daily? a/k/a ?\VNDeom.? CORSI has also written a number of I
books regarding Democratic presidential candidates. As described further below, ICORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of

hacked information by. WikiLeaks, and appears to have obtained information regarding

upcoming disclosures which he relayed to STONE.

 

Casell:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 18 of 71

 

Russian Government?Backed Hacking Activity During the 2016 Presidential
Election I

On January 6, 2017, the USIC released a declaSsi?ed version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled,
?Assessing Russian Activities and Intentions in Recent US Elections.? In the report, the USIC
assessed the following: - I

Russian President Vladimir Putin ordered an in?uence campaign in 2016 aimed at the-

US presidential election. Russia?s goals Were to undermine public faith in the US

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her

?electability and potential presidency. We further assess Putin and the Russian

Government developed a clear preference for President?elect Trump.

10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a ?Russian messaging strategy that blends covert intelligence operations?snob as cyber
activity?With overt efforts by Russian Government agencies, state?funded media, third?party
intermediaries, and paid social media users or ?trolls.??

.1 l. . With-respect to ?cyber activity,? the USIC assessed that ?Russia?s intelligence
services condu0ted cyber operations against targets associated with the 2016 US presidential I
election, including targets associated with both major US political parties.? Further, July-
2015, Russian intelligence gained access to DemocraticNational Committee (DNC) networks

and maintained that access until at least June 2016.? The USIC attributed these cyber activities

to the Russian GRU, also known as the Main Intelligence DirectOrate: operations res-ulted I



Case Documentl29-26 Filed 04/28/20 Page 19 of 71

in the compromise of the personal e?mail accounts of Democratic Party of?cials and political
figures. By May, the GRU had extiltrated large volumes of data from the 

12. With respect to the release of stolen materials, the USIC assessed ?with high
con?dence that the GRU used the Guccifer 2.0 persona, DCLealcscom, and WildLeaks t0 
release US victim data obtained in cyber operations publicly and in exclusives-to media outlets.?

13. . Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.

14. The Special Counsel?s Office has. determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential-election through at
least November 1, 2016.

15. For example, in or around September 2016, these individuals successfully gained
- access to DNC computers housed on a third-party cloud+computing service. In or around late 
September, these individuals stole datalfrom these cloud?based computers by creating backups of
the cloud?based systems using the cloud provider?s own technology. The individuals
used three new accounts with the same cloud computing service to move the ?snapshots? to
those accounts. I

16. Cum about September 4, 2016, individuals associated with the IGRU stole the
emails from a former White House adviser who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.

17. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering

elections in numerous Florida counties.

Case Document 29-26 Filed 04/28/20 Page 20 of 71

18., On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to in?uence the 20 i 6
presidential election, including conspiracy to commit authorized access to protected computers.
See United States Viktor Borisovich at at]. (Case No. 

C. Public Interactions with Guccifer 2.0 and WikiLeaks

19. On June 14, 2016, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, ?[t]he main part
of the papers, thousands of ?les and mails, I gave to Wikileaks. They will publish them soon.?

In that post, Ouccifer 2.0 also began releasing hacked DNC documents.

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from .
the DNC. -

21. I On August 5, 2016, STONE published an article on Breitbartcom entitled, ?Dear-
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.? The article stated: ?It doesn?t seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of IGuccifer
I The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: ?Here?s Guccifer 2.0?s website. Have a look and you?ll see he eXplains who he is and
why he did the hack of the The article also stated: ?Guccifer 2.0 made a fateful and wise
decision. He. went to WikiLeaks with the DNC ?les and the rest is history. Now the world would
'see for themselves how the Democrats had rigged the game.?

22. On August 8, 2016, STONE addressed the Southwest Broward Republican

-5-

Case Docuiment 29-26 Filed 04/28/20 Page 21 of 71

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
AS SANGE to Russia Today (RT) several days earlier about an upcoming ?October Surprise?
aimed at the Hillary Clinton presidential campaign. Speci?cally, STONE was asked: ?With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he?s going to do?" STONE responded: ?Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the-Clinton Foundation but there?s no telling what the October surprise may be.? A few days
later, STONE clari?ed that while he was not personally in touch with AS SAN GE, he had a close
friend who served as an intermediary. I

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: ?@RogerJStoneJr thanks that
believe in the real #Guccifer2.? That same day, Guccifer 2.0 released the personal cellphone
. numbers and email addresses from the ?les of the 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr'calling
Guccifer 2.0 a after Guccifer 2.0 had been banned. from Twitter. The next day, I
Guccifer 2.0?s Twitter account was reinstated;

25. On August 17, 2016, Guccifer 2.0 publicly tweeted?, ?@RogerJStoneJr paying you
back.? Guccifer also sent a private message to gerJ Stone] stating ?i?m pleased to say 
great man. please tell me if 1 can help it anyhow. it would be a great pleasure to me.?

26. On August 18, 2016, Paul MANAFORT, longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a?Washington D.C.?based lobbying ?rms to in?uence US. I
policy toward Ukraine.

27. On August 21, 2016, using @Roger] Stonel R, STONE tweeted: ?Trust me, it will

Case Document 29-26 Filed 04/28/20 Page 22 of 71

soon the [sic] Podesta?s time in the barrel. #CrookedHillary.? In a interview that same
day, STONE reiterated that because of the work of a ?mutual acquaintance? of both his and
SAN the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches.? He added: ?Well, ?rst of all, Ithink Julian
Assange is a hero. . I think he?s taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those-emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot'rnore. These are lilte the Watergate tapes.?

28. On September 16, 2016, STONE said'in a radio interview with Boston Herald
Radio that he expected WikiLeaks to ?drop a payload of new. documents on Hillary on a Weekly -
basis fairly soon. And that-of course will answer the question as to what exactly what was erased
on that email server.?

29. - On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
?Wednesday HillaryClinton is done. #WikiLeaks.? I

30. On Sunday, October 2, 2016, Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in LondonSANGE announcement which was
part of WikiLeaks? 10-year anniversary celebration STONE told Infowars that his intermediary
described this release as the ?mother load.? On October 5, 2016, STONE used @RogerlStoneJr
to tweet: ?Payload coming. #Lothhemup.? .

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series of ler remarks.

32. I Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading

.8.

Case Document 29-26 Filed 04/28/20 Page 23 of 71

The Podesta Emails #HillaryClinton #Podesta #imWithI-Ier? and containing a link
to approximately 2,050 emails that had been hacked from John Podesta?s-personal email account.

33. WikiLeaks continued to release John Podesta?s hacked emails through Election
1 Day, November 8, 2016. on October 12, 2016, Pedesta referring back to August 21,
2016 and Twitter references argued publicly that ?[it is] a reasonable assumption to 
or at least a reasonable conClusion that had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there?s at least a reasonable belief that [Assange] may have passed this information on to
Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that ?we?have a mutual friend who?s traveled to London several times, and
everything I know is through that channel of commu'niCations. I?m not implying I have any
in?uence with hint or that I have advanced knowledge of the speci?cs of what he is going to do.
I do believe he has all of the e?mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary.?

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, Writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: ?Since I never communicated with WikiLeaks, I guess I must be innocent of
charges Iknew about the hacking of Podesta?s email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct dis-closures)- all came true.?

D. Private Twitter Direct Messages with WikiLeaks and ASSANGE

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked

-9-

Case Document 2926 Filed 04/28/20 Page 24 of 71

Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks.l The latter account is the of?cial Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: ?Since 1 was allover
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up be you may want
to rexarnine the strategy of attacking rne? cordially 

?36. Less than an hour later, @wikileaks responded by direct message: ?We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don?t 'go there if you don?t want us to correct you? 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to.
@wikileaks: ?Ha! The more you \"correct me the more people think you?re lying. Your
operation leaks like a sieve. You need to ?gure out who your friends are.?

3 8. On or about November-9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @Roger] Stone] containing a single word: ?Happy??
@wikileaks immediately followed up with another message less than a minute later: ?We are
now more free to cornniunicate.?

39. in addition, @Ro gerJ Stone] 1' also exchanged direct messages With AS SAN 
the founder of IWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SANGE in numerous public reports, stating:
?Still-nonsense. As a journalist it doesn?t matter where you get information only that it is

accurate and authentic. The New York Times printed the Pentagon Papers which were

 

I On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @Ro gerJ Stone} r. - .

. ?10-

Case Document 29-26 Filed 04/28/20 Page 25 of 71

indisputably stolen from the government and the courts ruled it was legal to do so. and refused to
issue an order restraining the paper from publishing additional articles. If the US. government

moves on you I will bring down the entire house of cards. With the trumped?up sexual assault
charges dropped 1 don?t know of any crime you need to be pardOned for best regards. That
same day, @JulianAssange responded: ?Between CIA and Do] they?re doing quite a lot. On the
side. that?s coming most strongly from those obsessed with taking down Trump tryingto
squeeze us into a deal.?

'40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct inessage to
@JulianAssange, reading: am doing everything possible to address the issues at the highest
level of Governrnent. Fed treatment of you and WikiLeaks is an outrage. Must be cireurnspect in
this forum. as experience demonstrates it is monitored. Best regards 

E. Communications with STONE, -a1_1d Others Regarding
Forthcoming Leaks

41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia

issued a search warrant for -address,? On October 17, I

2017, Chief Judge Howell issued a search warrant for one of -addresses,

 

On or about December 19, 2017, Chief Judge Howell issued a search

   

warrant for email account. On or about March 14, 2018, Chief Judge Howell

  

issued a search-warrant for iCloud account. Information recovered pursuant to those

search warrants indicated the following:

42. On or about May 15, 2016,-e1nailed CORSI: ?Here is my ?ight
schedule. Need to get somethingcon?nned now . . . CORSI responded, copied Roger 

Stone so he knows your availability to meet Manafort and DT this coming week.? CORSI

-11-

Case Document 29-26 Filed 04/28/20 Page 26 of 71

appears to have forwarded the message to STONE at?who replied to

CORSI that, ?May meet Manafort guarantee nothing.?

43. On or about May 18, 2016, CORSI emailed STONE at?

with the title, ?Roger Why don?t you look this over before I send it to-I believe that

CORSI wrote,

 
 

nd 1 did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon.?
44. On July 25, 2016-, STONE, usi_ sent an email to
CORSI with the subject line, ?Get to Assange.? The-body of the message read: ?Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. . .they deal with
. Foundation, allegedly.? 

45. On or about July 31, 2016, STONE, using emailed

CORSI with the subject line, ?Call me The bod},r of the email read1-should see

 

Assange[.] -should find Bernie [S]anders brother who called Bill a Rapist turn him'for
Trump[.] -should ?nd _or more proof of Bill getting kicked out. 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about ?Podesta?s time in the barrel?), CORSI emailed STONE at
?Word is friend in embassy plans 2 more dumps. One shortly after I?m
back. 2nd in Oct. Impact planned to be very damaging.? The email continued, ?Signs are ox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine. to surface Victor,
for now. bump for an'artifact of rigged polling. Won?t last. I expect presidential

campaign to get serious starting Sept. Still in pre?season games. Time to let more than Podesta to

-12-

Case Document 29-26 Filed 04/28/20 Page 27 of 71

be exposed as in bed enemy if they are not ready to HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke 
neither he nor she well. I expect that much of next dump focus, Setting stage for Foundation
debacle.? Investigators believe that reference to a ?friend in embassy [who] plans 2

more dumps? refers to ASSANGE, who resided in Ecuador?s London Embassy in 2016.

47. On or about August 5, 2016_ an associate of emailed
STONE at ?The email contained a link to a poll indicating that Clinton - 

led Trump by 15 points. STONE responded ?enjoy it while can[.] I dined with my new pal
Julian Assange last night.? -ubsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet stated
that in 2018,-told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol- he was joking and
had not actually met -

48. Through asearch of iCloud account, the FBI has uricovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to - to have ?dined? with ASSANGE. For example, an associate of
STONE sent a text to STONE at approximately 3 :3 8PM on August 2, asking ?How did ur meeting

go in STONE responded. ?It?s this The following day, the associate asked,

?Any report from at meeting?? On or about August 4, 2016, STONE texted the associate, ?Will

 

 

Case . Document 29-26 Filed 04/28/20 Page 28 of 71

call later heading for-airport Additionally, investigators have identi?ed a photograph in
iCloud that appears to have been taken on August 3, 2016 and had goo?location
information indicating that it was taken in 'Los Angeles. I I

49. . 0a or- about August 15, 2016,?C0Rsr emailed STONE at

?Give me a call today if you can. Despite MSM drumroll that HRC is

already elected, it?s not over yet. More to come than anyone realizes. Won?t really get started

 

until after Labor Day. I?m in NYC this week. Jerry.? . .
50. On or about August 31, 2016, CORSI emailed STONE at
?Did you get the PODESTA na'iteup.? STONE replied 

51. On or about August 31, 2016, CORSI messaged STONE, ?Podesta paid $180k to
invest in Uranium One was hired by Rosatorn in Giustra scandal. Podesta now under FBI
investigation tied to. Ukraine Yanukovych 4 Panama papers reveals Podesta hired by
S[b]erbank, Russia?s largest ?nancial institution Pod-esta ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin.?

52. On or about September 6, 2016, CORSI emailed STONE. at

. ls NY Post going to use the Pedesta [sic] stuf 

53. On or about September 24, 2016- emailed coast ?1 will have much -

 

more on Turkey. Need a back channel highly sensitive stuff.? CORSI responded, ?We have

secure back channel through Roger. 1 saw him again in NYC last Friday and spoke to him about

it again back, ?Awaiting secret ?le. Explosives. Hope you are well.

Can't wait for the debate. Channeling Reagan, I'hope!? responded, ?Keep me posted
about In a subsequent meeting with investigators,- indicated this

conversation concerned possible derogatory information he was trying to obtain from Turkey.

-14-

Case DOCUment 29-26 Filed 04/28/20 Page 29 of 71

54. On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: ?Assange what?s he got? Plope it?s good.? STONE wrote
back, ?It is. I?d tell Bannon but he doesn?t call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled.? The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote:??You should call Roger. See
below. You didn?t get from me.? BANNON wrote back, ?I?ve got important stuff to worry
about.? The associate responded, ?Well clearly he knows what Assange has. I?d say that?s I
important.?
55. . On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did-
not make any new releases. Instead, AS SAN GE promised more documents, including I
information ?affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the US election process.? AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the US. election?related documents would all come out before Election Day.
56'. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
?Assange made a fool of himself. Has nothing or he. would have released it. Total BS hype.? 
57. That same day, BANN ON emailed STONE at? ?What was
that this STONE replied, ?Fear. Serious security concern. He thinks they are going
to kill-him and the London police are standing done BANNON wrote back, ?He didn?t

cut deal w/ STONE replied, ?Don?t think so BUT his lawyer -is a big

democrat.?

-15-

Case Document 29-26 Filed 04/28/20 Page 30 of 71

58. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANN ON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANN ON had been hoping for releases of damaging information that morning.

. F. STONE and CORSI Communications on October 7, 2016, when the Pedesta Emails
Are Released. . - -

5 9. According to a publicly available news article,3 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received-a phone call from
a sOurce regarding a previously unaired Video of candidate Trump. According to the same I
article, ?Fahrenthold didn?t hesitate. Within a few moments of watching an outtake of foetage
from a 2005 segment on ?Access Hollywood,? the Washington Post reporter was on the phone,
calling Trump?s campaign, ?Access Hollywood,? and NBC for reaction.? .

60. According to phone records? at approximately I
11:27 AM, cons: placed a call to STONE, which-STONE did not answer. 

61. At approximately STONE received a phone call from the Washington
Post. The approximately twenty minutes.

62. At approximately STONE called CORSI and the two spoke for
approximately seventeen minutes. I

63. At approximately CORSI called STONE and the two spoke for

approximately twenty minutes.

 

3 stoom/ lifestyle! 
ceS ?1 1e6-875 6?20 1 bfe943b66__story.html

~16?

Case Document 29-26 Filed 04/28/20? Page 31 of 71

64. At approximately the Washington Post published a story regarding the
Access Hollywood tape. I

65. At. approximately 4:3 0PM, WikiLeaks tweeted out its ?rst release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.

On or about August 2, 2016, coast emailed STONE using expect

that much of next dump focus, setting stage for Foundation debacle.?

66. - At approximately author who has written about the

Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, ?WikiLeaks The Podesta Emails,? with a link to the .

newly?released Podesta' emails. Approximately ten minutes later, STONE, using

-orwarded .message to CORSI without comment. STONE

does not appear to have forwarded the email to any other individual.

 

G. STONE Asks CORSI for to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak

67. On or about October 8, 2016, STONE messaged CORSI, ?Lunch postponed 
have to go see CORSI responded to STONE, ?Ok. I understand.? Approximately twenty
minutes later, CORSI texted, ?Clintons know they will lose a week of Paula Jones media with 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbersabout Wednesday, October 12, 2016, at approximately STONE,

using ?mailed Corsi asking him to ?send me your best podesta links.?

STONE emailed CORSI at approximately EDT, ?need your BEST podesta pieces.?

CORSI wrote back at approximately EDT, ?0k. Monday. The remaining stuff on

-17-

Case Document 29-26 Filed 04/28/20 Page 32 of 71

Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it?s easy to understand will. take weekend. Your choice??

69. On or about that same day, October 12, 20l6, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately EDT, CORSI
emailed STONE at bot? with the subject
line ?Podesta talking points.? Attached to the email was a ?le labeled, STONE
podesta talking points Oct 12 2016.docx.? The ?talking points? included the statement that

I ?Podesta is at the. heart of a Russian-government money laundering operation that benefits
?nancially- Podesta personally and the Clintons through the Clinton Foundation.?

70. I CORSI followed up several minutes later with another email titled, ?Podesta
talking points,? with the text ?sent a second time just to be sure you got it.? STONE emailed
CORSI back via the Hotmail Account, ?Got them and used them.? 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at

Joule ties to RUSSIA MONEY LAUNDERTNG to
CLINTON STONE responded, ?Nice but I was hoping for a piece I could
post under my by?line since I am the one under attack by Fodesta and-now Mook.? CORSI-
wrote back to STONE, ?I?ll give you one more NOBODY YET HAS It looks to me
like -skimmed maybe billions off Skolkovo Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once -
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America? 
Clinton Fund account, there?s no telling how much money he laundered, or where it ended up.

I Nothing in Clinton Foundation audited ?nancials or IRS Form 9903 about received via

-13-

Case Document 29-26 Filed 04/28/20 Page 33 of 71

Russia 85 Metcombank[.] I?m working on that angle now.? STONE-replied, ?Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM 

72. On or about Thursday, October 13, 2016 at approximately EDT, CORSI 

sent STONE an email a_ith the subject, article I
RUSSIAN MARIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN The text stated: ?Roger[,] You are free to publish this under your own
name.? That same day, STONE posted a blog post with the title, ?Russian Ma?a money
laundering, the Clinton oundatitin and John Podesta.? In that post, STONE wrote, ?although I
have had some back?channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.? The post
then asked, ?Just how muchrnoney did a controversial Russian billionaire -
investor with ties to the Vladimir Putin and the Russian government, launder through
Meteornbank, a Russian regional bank owned 99.978 percent by -with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that. is-operated by the Clinton
I Foundation??

73. I On or about October 14, 2016, CORSI sent a message to. STONE at his iCloud
account, ?I?m in NYC. Thinking about writing piece attacking Leer and other women. It?s
basically a rewrite of what?s out there. Going through new Wikileaks drop on Podesta.?

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
?On Assange, can you call me now before STONE responded, ?Missed just I
landed JFK on Infowars now.? CORSI wrote back, ?Call afterwards. Have some important

intel to share.?

-19-

Case Document 29-26 Filed 04/28/20 Page 34 of 71

75. On or about October 17, 2016, CORSI emailed STONE at
?with the subject, ?Fwd:
ASSANGE. . .URGENT. . wrote, ?From a very trusted source,? and forwarded an email
with the header information stripped out, showing only the body text. The email read, I
?gured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set bf dead man ?les that include Hillary.
It?s what they used to call a ?Mexican stand offH? Only hope is that if Trump speaks out to save
him[.] Otherwise he?s dead anyway, once he?s dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He?s called Podesta?s bluff and
raised him the election.? Based on review of the original email that CORSI forwarded, the
?trusted source? was a self?identi?ed retired librarian who gathers information from public chat
rooms. I
'76. On or about October 18', 2016, CORSI messaged STONE at his iCloud account,
?Pls call. Important.?

77. On or about October 19, 2016, STONE published an article on Breitbartcom in
which he claimed he had, ?no advance notice of Wikileaks? hacking of Podesta?s e-inails.?
STONE. stated that, predicted that Podesta?s business dealings would be exposed. I didn?t hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website.? STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.

On or about November 8, 2016, the United States presidential election took place.

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,

?Congratulations, Roger. He could not have done it without you.?

?20? 

Case Document 29-26 Filed 04/28/20 Page 35 ?of 71

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud

account, ?Are you available to talk on phone?? Several minutes later, CORSI messaged, ?I?m in

London. Have some interesting news for you.?

 

Case Document 29-26 Filed 04/28/20 Page 36 of 71

 

Case Document 29-26 Filed 04/28/20 Page 37 of 71-

 

I. Congressional Testimony and Public Statements About His Relationship
with Wildleaks

88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:

Members of this Committee have made three basic assertions against me which must be
remitted here today. The charge that I knew in advance about, and predicted, the hacking
cf Clinton campaign chairman John Podesta?s email, that I had advanced knowledge of

the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or

that, my now public exchange with a persona that our intelligence agencies claim, but

cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,

such assertions are conjecture, supposition, projection, and allegations but none of them
are facts?

My Tweet of August 21, 2016, in which 1 said, ?Trust me, it will soon be the Podesta?s
time in the barrel. #CrookedHillary? must be examined in context. I posted this at a time
that'my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweetof August 21, 2016, makes no mention, whatsoever, of Mr. Podesta?s email, but
does accurately predict that the Podesta brothers business activities in Russia with the
oligarchs alound Putin, their uranium deal, theit bank deal, and their Gazprorn deal,
would come under public scrutiny?

[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks?
publisher Julian Assange? announced that he was in possession of Clinton DNC emails.
.I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
?intermediary?, ?go-between? and ?mutual friend.? All of these monikers are equally
true.

-23 

Case Document 29-26 Filed 04/28/20 Page 38 of 71

89. In a document dated March 26, 2018 titled ?Minority Views,? Democratic

- members of HPSCI published excerpts from Stone?s September 2017 testimony before 

Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or
encouragement been in any type of contact with Julian Assange? 
MR. STONE: No.

Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had con?rmed with the intermediary 

STONE: That 

Q: was the length and the breadth of what you were referring to?

MR. STONE: That is correct, even though it was repeated to me on numerous separate

occasions.

90. In the month that followed his testimony before HPSCI, on or about October 24,
i 2017, STONE published an article on his website, stonecoldtruth.corn, titled ?Is it the Podesta?s
Time in the Barrel Yet?? In that article, STONE stated: was this inevitable scrutiny of the
Podestas? underhanded business dealings that my ?time in the barrel? referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta?s emails. .I . . [M]y tweet referred to Podesta?s business dealings with Russia, and the
expectation that it would become a news story?. I

J. Messaging to Randy CREDICO about ?Back channel?

91'. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his ?intermediary? to ASSANGE), messaged STONE, ?My
laWyer wants to see me today.? STONE responded, ?Stonewall it. Plead the ?fth. Anything to
save the plan? Richard CREDICO responded, ?Ha ha.?

92. On or about November 21, 2017, CREDICO messaged STONE, was told that

the house committee lawyer told my lawyer that I will be getting a STONE wrote

-24-

Case Document 29?26 Filed 04/28/20 Page 39 of 71

back, ?That was the point at which your lawyers should have told them you would assert your,
5th Amendment rights if compelled to appear.? They continued to message, and CREDICO
wrote, ?My lawyer wants me to cut a deal.? STONE wrote back, ?To do what Nothing
happening in DC the day before Thanksgiving why are busting my chops??

'93. On or about November 24, 2017, STONE, texted CREDICO, ?Assange is a
journalist and a damn good once meeting with him is perfectly legal and all you ever told me was

i he had the goods [o]n Hillary and would publish them which he himself said in public b4 told
me . It?s a fucking witchunt CREDICO replied, told you to watch his tweets. That?s
what I was basing it On. I told you to watch his Tweets in October not before that I knew nothing .
about the DNC stuffL] I just followed his STONE responded, never said anything
about the DNC but it was August.? CREDICO wrote back, ?It was not August because I didn?t
interview him or meet him until August 26th[.] That was my ?rst communication with his
secretary in London, August 26th.? STONE wrote back, ?Not the way I remember it oh well I
guess Schiff will try to get one of us indicted for I
. 94. STONE and CREDICO continued to exchange messages and on November 24,

2017, CREDICO wrote to STONE, ?fForensic evidence proves that there is no back Channel. So
now you can relaxabout November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28,- 2017, CREDICO and STONE communicated via text message more than a dozen
times. I

96. On November 29, 2017, STONE publicly stated that CREDICO was his

?intermediary.? In a public Facebook post, STONE further stated that ?Credico merely 

-25-

- Case Document 29-26 Filed 04/28/20 Page 40 of 71

con?rmed for Mr. Stone the accuracy of Julian Assange?s interview of June 12, 2016 with the
British ITV network, where Assange said he had ?e?rnails related to Hillary Clinton which are
pending publication,? . . . Credico never said he knew or had any information as to source or
content of the material.?

97. On or about December 1, 2017, CREDICO messaged STONE, don?t know why
you had back Channel now I had to give all of my forensic evidence to
the FBI today what a You could have just told him-the truth that you didn?t have a
back Channel they now know that I was not until September of this year[.] You had
no back-channel and you could have just told the truth . . . You want me to cover you for perjury
STONE responded, ?What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if don?t want talk about AND if you turned over anything to the FBI you?re
a fool.? CREDICO responded, ?You open yourself up to six counts of perjury[.] [But I?m sure
that wasn?t sworn testimony so you?re probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn?t have put me in this bad spot
. . . you should go back . . . and amend your testimony and tell them the truth.? CREDICOI
repeated: ?you need to amend your testimony before I testify on the 15th.? STONE replied, ?If
you testify you?re a fool. Because of tromp [sic] I could never get away! with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for

perjury if you?re stupid enough to 

 

4 [Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.

~26?

Case Document 29-26 Filed 04/28/20 Page 41 of 71

98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to message about being ?stupid enough to testify,? CREDICO told
STONE: ?Whatever you want to say I have solid forensic evidence.? STONE responded: ?Get
yourself a real lawyer instead of some liberal wimp who doesn?t know how to tell his guys to-
fuck off good night.? CREDICO then wrote: ?Just tell them the truth and swallow your ego you
never had a back Channel particularly on June STONE responded: ?You got nothing.?

99. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPS CI and would invoke his Fifth Amendment rights.

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, ?Hope don?t fuck Up my efforts to get Assange a CREDICO
messaged STONE, have the email frOm his chief of staff August 25th 2016 to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact.? .

101. On or about January 8, 2018, CREDICO messaged STONE, stating: ?Embassy
logs. . . 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year.?

102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: ?You lied to the house Intel committee . . . But you-?11 get
off because you?re friends with Trump so don?t worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 

reporters cepies of email messages he had received from STONE in the prior few days that

.27..

Case Document 29-26 Filed 04/28/20 Page 42 of 71

stated, ?You are a rat. You are a stoolie. You backstab your friends run your mouth my
lawyers are dying Rip you to shreds.? Another message stated, ?I?m going to-talre that dog away
from you,? referring to therapy do g. CREDICO stated that it was ?certainly scary .-
. . When you start bringing up my dog, you?re crossing the I
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency.5 In these messages, STONE, on April 9, 2018,
stated: am so ready. Let?s get it-on. Prepare to In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO ?told
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too.'

He was depressed about it. Or was he lying.? The article noted that CREDICO stated he?did not

have prostate cancer and did not have any such discussion with STONE.

K. The Target Accounts

 

 

5 I
threatened?dOg?l 3 591 1370.htm1
6 8/0 5/10 

-23-

Case Document 29-26 Filed 04/28/20 Page 43 of 71

 

Case Document 29-26 Filed 04/28/20 Page 44 of 71

 

- Case Document 29-26 Filed 04/28/20 Page 45 of 71

 

Case Document 29-26 Filed 04/28/20 Page 46 of 71.

BACKGROUND CONCERNING FACEBOOK

116.. Facebook owns and operates a free?access social networking website of the same
name that can be accessed at http://wwfaceboolccom. Facebook allows its users .to establish
accounts withFacebook, and users can then use their accounts to share written news, photographs,
videos, and other information with 'other Facebook users, and sometimes with the general public.

117. Facebook asks users to provide basic contact and personal identifying information
to Faceboolc, either during the registration process or thereafter. This information may include the
. user?s full name, birth date, gender, contact e?mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identi?ers. acebook
also assigns a user identi?cation number to each account.

'118. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identi reation number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a ?Friend Request.? If the recipient of a ?Friend Request?
accepts the request, then the two users will become ?Friends? for purposes of Facebook and can
exchange communications or View information about each other. Each Facebook user?s account
includes a list of that user? 3 ?Friends? and a ?News Feed,? which highlights information about the
user?s ?Friends,? such as pro?le changes, upcoming events, and birthdays.

119. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook

users, or to anyone with access to the Internet, including people who are not Facebook users. A

32?

Case Document 29-26 Filed 04/28/20 Page 47 of 71

Facebo-ok user can also. create ?lists? of Facebook friends to facilitate the application of these
privacy settings. acebook accounts also include other account settings that users can adjust to
control, for example, the types of noti?cations they receive from Facebook.

120. Facebook users can create, pro?les that include photographs, lists of personal
interests, and other information. Faeebobk users ?can also post ?status? updates about their
whereabouts and actions, as well" as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming ?events,?
such as social occasions, bylisting the event?s time, location, host, and guest list. In addition,
Facebook users can ?check in? to particular locations or add their geographic locations to their
Faceboolc posts, thereby revealing their geographic locations at particular dates and times. A
particular user?s pro?le page also includes which is a space where the user and his or
her-?Friends? can post messages, attachments, and links that will typically be visible to anyone
who can view the user?s pro?le.

121. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted when s/he uploaded-the photo or video. It also
provides users the ability to ?tag? label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a noti?cation of the tag and a link to. see the
photo or video. For Facebook?s purposes, the photos and videos associated with a user?s account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that: user tagged in them.

122. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e?mail messages, are sent to thelrecipient?s ?Inbox? on

acebook, which also stores copies of messages sent by the recipient, as well as other information.

-33-

Case Document 29-26 Filed 04/28/20 Page 48 of 71

Facebook users can also post comments on the Facebook pro?les of other users or on their own
pro?les; such comments are typically associated with a speci?c posting or item on the pro?le. In
addition, Facebook- has a Chat feature that allows users to send and receive instant messages
through Facebook. I These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call. I

123. If a Facebook user does not want to interact with another user on Facebook, the
?rst user-can ?block? the second user from seeing his or her account. -

124. Facebook has a ?like? feature that allows users to give positive feedback or connect
to particular pages. Facebook users can ?like? Facebook posts or updates, as well as webpages or
content on third?party (tie. non?Facebook) websites. Facebook users can also become ?fans? of
particular Facebook pages.

125. Facebook has a search function that enables its users to search Facebook for
keywords, usernames, or pages, among other things.

126. Each Facebook account has-an activity log, which is a list of the user?s posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as ?liking? a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user?s Facebook page. . 

127. Facebook Notes is a blogging feature available-to Facebook users, and it enables
users to write and post notes or personal web logs (?blogs?), or to import their blogs ?orn other

services, such as Xanga, LiveJournal, and Blogger.

-34-

Case Document 29-26 Filed 04/28/20 Page 49 of 71

128. The Facebook Gifts feature allows users to send Virtual ?gifts? to their friends that
appear as icons on the recipient?s pro?le page. Gifts cost money to purchase,and apersonalized
message can be attached to each gift. Facebook users can also send each other ?pokes,? which are
free and simply result in a noti?cation to the recipient that he or she has been?poked? by the
sender.

129. Facebook also has a Marketplace feature, which allows users to post free classi?ed
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.

130. In addition to the applications described above, Facebook also provides its users
with access to thousands of other applications (?apps?) on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user?s access or
use of that application may appear on the user?s pro?le page.

131. Some Facebook pages are af?liated with groups of users, rather than one individual
user. Membership. in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and. reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator andfor creator of the group. FacebOok uses the term ?Group Contaot Info? to
describe the contact information for the group?s creator and/or administrator, as well as a PDF of
the'current status of the group pro?le page. I

132. Facebook uses the term ?Neoprint? to describe an expanded View of a given user
pro?le. The ?Neoprint? for a given user can include the following. information from the user?s
pro?le: pro?le contact information; News. Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends?

Facebook user identi?cation numbers; groups and networks of which the user is a member,

-3 5-

 Case Document 29-26 Filed 04/28/20 Page 50 ofi71

including the groups? Facebook group identi?cation numbers; future and past event postings;
rejected ?Friend? requests; comments; gifts; pokes; tags; and information about the user?s access
and use of Facebook applications. 

. 133. Facebook also retains Internet Protocol logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook pro?le,
that user?s IP log would re?ect thelfact that the user viewed the pro?le, and would Show when and
from what IP address the user did so.

134. Social networking providers like ac'ebook typically retain additional information
about their users? accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). - In some cases, Facebook users may 

communicate directly With Facebook about issues relating to their accounts, 'such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
,Facebook typically retain records about such corhrhunications, including records of I contacts
between the user and the provider?s support services, as well as records of any actions taken by
the provider or user as a result of the communications.

135. As explained herein, information stored in connection with a Facebook account
may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal
conduct under investigation, thus enabling the United States to establish and prOve each element
or alternatively, to exclude the innocent from further. suspicion, In my training and experience, a

Facebook user?s ?Neoprint,? IP log, stored electronic communications, and other data retained by

-35-

Case DoCument 29-26 Filed 04/28/20 Page 51 of 71

Facebook, can indicate who has used or controlled the Facebook account. This ?user attribution?
evidence is analogous to the search for ?indicia of occupancy? while executing a search warrant
at a residence. For example, pro?le contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be 7
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (lP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context of Facebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo?location into
some of its services. Geo-location allows, for example, users to ?tag? their location in posts and
Facebook ?friends? to locate each other. This geOgraphic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, acebook account activity may
provide relevant insight into the Facebook account owner?s state of mind as it relates to the offense .
under .investigatiOn. 'For example, information on the Facebook account may indicate the oWner?s
motive and intent to commit a crime information indicating a plan to commit a crime), or
consciousness of guilt (eig., deleting account information in an effort to conceal evidence from
law enforcement).

136. Therefore, the computers of Facebook are likely to contain all the material

described above, including stored electronic communications and information concerning

-3 7-

Case Document 29-26 Filed 04/28/20' Page 52 of 71

subscribers and their use of Facebook, such as account access information, transaction information,
and other account information. -
BACKGROUND CONCERNING INSTAGRAM
137. From my review of publicly available information provided by lnstagram about
its service, including instagrain?s ?Privacy. Policy,? I am aware of the following about Instagram
and about the informationcollected and retained by Instagrarn. I
I 138. Instagram is a social networking service owned by Facebook, Inc. Instagrarn
owns and operates a free?access social?networking website of the same name that can be
accessed at http:/fmvwinstagramcom. Instagrarn allows its users to. create their own profile
pages, which can include a short biography, a photo of themselves, and other information. Users
can access Instagrarn through the Instagram website or by using-a special electronic application
created by the company that allows-users to access the service through a mobile device.
139. Instagrarn permits users to post photos-to their pro?les on Instagrarn and
otherwise share photos with others on Instagrarn, as well as certain other social?media services,
including Flickr, Facebook, and Twitter. When posting or sharing a photo on Instagrarn, auser
can add to the photo: a caption; various ?tags? that can be used to search for the. photo (8. g. a
user made add the tag #vw so that people interested in Volkswagen vehicles can search for and
?nd the photo); location information; and other information. A user can also apply a variety of -
?filters? or other visual effects that modify the look of the posted photos. In addition, Instagrarn
allows users to make comments on posted photos,'including photos that the user posts or photos

posted by otherusers of Instagram. Users can also f?like? photos.

-33-

Case Document 29-26 Filed 04/28/20 Page'53 of 71

140. Upon creating an lnstagram account, an Instagram user must create a unique
Instagram username and an account password. This information is collected and maintained by
lnstagram.

l41. Instagram asks users to provide basic identity and contact information upon
registration and also allows users to provide additional identity information for their user pro?le.
This information may include the user?s full name, e?mail addresses, and phone numbers, as well
as potentially other persbnal information provided directly by the user to Instagram.? Once an
account is created, users may also adjust various privacy and account settings for the account on
Instagram. Instagram collects and maintains this information.

142'. 'Instagram- allows users to have ?friends,? which are other individuals with whom
the user can share information without making the information public. Friends on Instagram
may come from either contact lists maintained by the user, other third-party social media
websites and information, or searches conducted by the user on Instagram profiles. Instagram
collects and maintains this information.

143. Instagram also allows users to ?follow? another user, which means that they
receive updates about posts made by the other user. Users may also ?unfollow? users, that is,
stop following them or block the, which prevents the bloCked user ?om following that user.

144. Instagram allow users to post and share various types of user content, including
photos, Videos, captions, comments, and other materials. Instagrarn collects and maintains user
content that users post to Instagram or share through Instagram.

I 145; Instagram users may send photos and videos to select individuals or groups Via

Instagram Direct. Information sent Via lnstagram Direct does not appear in a user?s feed, search

history, 'or profile.

-39-

Case Document 29-26 Filed 04/28/20 Page 54 of 71

146. Users on lnstagrarn may also search Instagram for other users or particular types
of photos or other content.

l47. For each user, Instagram also collects and retains information, called ?log ?le?
information, every time a user requests access to lnstagram, whether through a web page or
through an app. Among the log ?le information that lnstagi?arn?s servers automatically record is
the particular web requests, any Internet Protocol address associated with the request, type?
of browser used, any referringtexit web pages and associated URLs, pages viewed, dates and
times of access, and other information. I

148. Instagram also collects and maintains are small text ?les
containing a string of numbers that are placed on a user?s computer or mobile device and that
allows Instagram to collect information about how a user uses Instagram. For example,
lnstagram uses cbokies to help users navigate between pages ef?ciently, to remember
preferences, and to ensure advertisements are relevant to a user?s interests.

149. Instagrarn also collects information on the particular devices used to access
Instagram. In particular, Instagram may record ?device identi?ers,? which includes data ?les
and other information that may identify the particular electronic device that was used to access
Instagram.

150. Instagram also collects other data associated with user content. For example,
lnstagram collects any ?hashtags? associated with user content keywords used), ?geotags?
that mark the location of a photo and which may include latitude and longitude information,
comments on photos, and other information.

151. Instagram also may communicate with the user, by email or otherwise. lnstagram

collects and maintains copies of communications between Instagram and the user.

_40_

Case Document 29-26 Filed 04/28/20 Page 55 lot 71

152. As explained herein, information stored in connection with an Instagrarn account
may provide crucial evidence of the ?who, what, why, when, where, and how? of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience,
an lnstagrarn user?s account activity, IP log, stored electronic communications, and other data
retained by lnstagram, can indicate who has used or controlled the Instagram account. This
?user attribution? evidence is analogous tothe search for. ?indicia of occupancy? while executing
a search warrant at a residence. For example, pro?le contact information, direct messaging lo gs,
shared photos and videos, and captions (and the data associated with the foregoing, such as geo?
location, date and time) may be evidence of who used or controlled the Instagram account at a-
relevant time. Further, Instagram account activity can show how and when the account was
accessed or used. or example, as described herein, lnstagram logs the Internet Protocol (IP)
addresses from which users access their accounts along with the time and date. By determining
the physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the account access and use relating to the crime under
investigation. Such information allows investigators to understand the geographic and
chronological context of Instagram access, use, and events relating to the crime under
investigation. Additionally, Instagram builds gee?location into some of its services. Geo- 
location allows, for example, users to ?tag? their location in posts and Instagram ?friends? to
locate each other. This geographic and timeline information may tend to either ineulpate or
exculpate the Instagram account owner. Last, Instagram account activity may provide relevant
insight into the Instagram account owner?s state of mind as it relates to the offense under

investigation. For example, information on the Instagram account may indicate the owner?s

-41-

Case Document 29-26 Filed 04/28/20 Page 56 of 71

motive and intent to commit a crime information indicating a plan to commit a crime), or
consciousness of guilt deleting account information in an effort to conceal evidence from
law enforcement).

153. Based on the information above, the computers of lnstagram are likely to contain
all the material described above with respect to the Target Instagram Accounts, including stored
electronic communications and information concerning subscribers and their use of Instagram,
such as account access information, which would include information such as the IP addresses
and devices used to access the account, as well as other account information that might be used
to identify the actual user or users of the account at particular times.

FILTER REVIEW PROCEDURES

154. Review of the items described in AttaChment A and Attachment will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorneysclient and .
other operative privileges. The procedures include use, if necessary, of a designated ?filter
team,? separate and apart from the investigative team, in order to address potential privileges.

CONCLUSION

155. Based on the forgoing, I request that the Court issue the proposed search warrant.

156.. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not
required for the service or execution of this warrant. 

REQUEST FOR SEALING

157. I further request that the Court order that all papers in support of this application,

including the affidavit and search warrant, be sealed until further order of the Court. These

documents discuss an ongoing criminal investigation, the full nature and extent of which is not

-42-

Case Document 29-26 Filed 04/28/20 Page 57 of 71

known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.

Respectfully submitted,

 

 

PEE?iclc J. Myers
Special Agent
?Federal Bureau of Investigation

Subscribed and sworn to before me on this 22 day of September, 2018.



The Honorable Beryl A. Howell
Chief United States District Judge

-43_

Case Document 29-26 - Filed 04/28/20 Page 58 of 71

A
Property to be Searched
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses (?Target Facebook Accounts?), stored at premises owned,
maintained, controlled, or operated by Facebook, Inc. (?Faceboolc?), a company headquartered in

Menlo Park, California:

  

This warrant also applies to information associated with the Instagram accounts registered
to the following email addresses (?Target Instagram Accounts?), stored at premises owned,

maintained, controlled, or operated by Facebook:

 

Case Document 29-26 Filed 04/28/20 Page 59 of 71 

I

ATTACHMENT 

I. Information to be disclosed by acebook/Instagram

A.

To the extent that the information described in Attachment A is Within the

possession, custody, or control of the Faecbook, Inc. (hereina?lter ?the Provider?), regardless of

whether such information is stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

available to the Provider, the Provider is required to disclose the following information to the

government for each of the Target'Facebook'A'ecounts listed in Attachment A:









All contact and personal identifying informatiOn, ineluding full name, user
identi?cation number, birth date, gender, contact e~rnail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.

All activity logs for the account and all other documents showing the user?s posts .
and other acebook activities;

All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
data and any other metadata associated With those photos and videos;
All pro?le information; News Feed information; status updates; videos,
photographs, articles, and other items; Netes; Wall postings; friend lists, including 
the friends.? Facebook user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Facebook group identification numbers;
future and past event postings; rejected ?Friend? requests; comments; gifts; pokes;

tags; and information about the user?s access and use of Faeebook applications;

-2-

Case Document 29-26 Filed 04/28/20 Page All other records of communications and messages made or received by the user;
including all private messages, chat history; video calling history; and pending
?Friend? requests; I
All records relating to machine Cookies;

All ?check ins? and other location information; including records of the user?s
latitude and'longitude;

All IP logs; including all records of the'IP addresses that logged into the account;
All records of the-account?s usage of the ?Like? feature; including all Facebook

'1

posts and all non?Facebook webpages and content that the user has ?liked?;

All information about the Facebook pages that the account is or was a an? of;

All past and present lists of friends created bv the account;
All records of Facebook searches performed by the accoiint;

All information about the user?s access and use of Facebook Marketplace;

I The types of service utilized by the user;

The; length of service (including start }d_ate) and the means and source of any
payments associated with the service (including any credit card or bank account
number);

Group identi?cation numbers; a list of users currently registered to the group; a list

of users who like the page; group or page contact information; including all contact

information for the creator and/or administrator of the group and a PDF of the

current status of the group pro?le page;
All past and. present Admins for the group;

The ?Creator? of the group;

Case 1:19-rnc-00029-CRC Document 29-26 Filed 04/28/20 Page 61 of 71 

(S)



(11)

B.

All privacy settings and other account settings, including priva?ey settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;

All records pertaining to communications between Facebook and any person
regarding the user or the user?s Facebook account, including contacts with support
services and records of actions taken;

All records related to advertisements and advertising conducted through, the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and?queried.

To the extent that the information described in Attachment A . is Within the

possession, custody, or control of the Facebook, Inc. (hereinafter ?the Provider?), regardless of

whether such informationis stored, held or maintained inside or outside of the United States, and

including any emails, records, ?les, logs, or information that have been deleted but are still

available to the Provider, the'Provider is required to disclose the following information to the .I

government for each of the Target Instagram Accounts listed in Attachment A:

a.

All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e?mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal, identifiers;

All past and current usernames associated with the account;-

All activity logs for the account and all other documents showing the user?s posts

and other Instagram activities;

Case Document 29-26 Filed 04/28/20 Page 62 of 71

d. The dates and times at which the account and pro?le were created, and the Internet
- Protocol address at the tinieof sign?up; 

c. All photos and videos-uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged-in them, including Exchangeable Image File -
data and any other metadata associated with those photos and Videos;

f. All pro?le information; News Feed . information; status updates; Videos,

I photographs, articles, and other items; Notes; friend lists, including the ?'iends? and
followers? Instagram user identi?cation numbers; groups and networks of which
the user is a member, including the groups? Instagram group identi?cation numbers;
future and past event postings; tags; I

g. i All other records Iof comrhunications and me_sSages made or received by the user,
including all private messages, chat history, Video calling history, and. pending

?Friend? or.?follower? requests; .

h. All records relating to machine Cookies;

i. All ?check ins? and other location information, including records of the user?s
latitude and longitude; I

j. All IP 10 gs, including all records of the IP addresses that logged into the account;

k. I All records of the account?s usage of the ?follow? feature, including all Instagrarn

posts and all non?lns?tagrarn webpages and content that the user has ?liked?;
I. 'All past and present lists of friends created by the account;
7

n1. All records of Instagrarn searches performed by the account;

n. The types of service utilized by the user;

11.

Case Document 29-26 Filed 04/28/20 Page 63 of 71

The length of service (including start date) and the means and source of any

payments associated with the service (including any credit card or bank account

number);



All information regarding the particular device or devices used to login to or access
the account, including device identi?er information or cookie information,
including all information about the particular device or devices used to access the
account and the date and time of those accesses;

Group identi?cation numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator andfor administrator of the group and a PDF of the
current status of the group pro?le page;

All past and present Admins for the group;

The ?Creator? of the group; I

All privacy settings and other account settings including privacy settings for
individual Instagram posts and activities, and all records showing which Instagram
users have been blocked by the account;

All records pertaining to communications between acebook or-Instagram and any

person regarding the user or the user?s Instagrarn accOunt, including contacts with

support services and records of actions taken.

Information to be Seized by. the Government

Any and all records that relate in any way to the accounts described in Attachment A

whichconsists of evidence, ?uits, or instrumentali-ties of violations of 18 U.S.C. 2 (aiding and

abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C. 4 (misprision of a felony), 18

Case Document 29-26 Filed 04/28/20 Page 64 of 71

U.S.C. 371 (conspiracy), 18 U.S.C. 1001 (false statements), 18 1030 (unauthorized

access of a protected computer); 18 U.S.C. 1505 and 1.512 (obstruction of justice), 18 U.S.C.

1513 (witness tampering), 18 U.S.C. 1343 (wire fraud), 18 U.S.C. 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. 30121 (foreign contributions ham-for the

period from March 1, 2016 to the present, including:

a.

All records, information, documents or tangible materials that relate in any Way to

communications regarding hacking, release cf hacked material, communications

I with persons or entities associated with WikiLealts, including but not limited to

Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to, hacked material;

All records, information, documents or tangible materials that relate in any way to

   
 

communications or meetings introlving Jerome Corsi, Julian

Assange, Randy Credico, any
individual associatedwith the Trump Campaign, any witness in the investigation;
Communications, records, documents, and other ?les related to any expenditure,
independent eitpenditure, or disbursement for an electioneering communication;
Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign of?cials, foreign entities, foreign persons, or foreign
principals; 

All images, messages, cemmunications, calendar entries, search terms, ?address

. book?_ entries and contacts, including any and all preparatory steps taken in

furtherance of the above?listed offenses;

Case Document 29-26 Filed 04/28/20 Page 65 of 71

f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the bene?t of, or at the direction of
any I foreign government, foreign of?cials, foreign entities, foreign persons, or
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating

to the crimes under investigation and to the account owner;

h. Evidence indicating the account user?s state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the account, including records

I that help reveal the whereabouts of such 

j.l Credit card and Other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;

k. All images, messages and communications regarding wiping software, 
or other methods to avoid detection by law enforcement; I

l. The identity of any non?US. records that help reveal the I
whereabouts of the made any expenditure, independent
expenditure, or disbursement for an electioneering comr'nunication; and

m; The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating-
to activities conducted by on behalf of, for the bene?t of, or at the direction of any
foreign government, foreign of?cials, foreign entities, foreign persons, or foreign

principals.

Case Document 29-26 Filed 04/28/20 Page 66 of 71

n. Passwords and keys, and other access information that may be necessary
to access the account and other associated accounts;
. o. All existing printouts from original storage which concern the categories identi?ed .
in subsection I
Review Protocols
Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney?client and other
operative privileges. When appropriate, the procedures shall include use of a designated ?filter

team,? separate and apart from the investigative team, in order to address potential privileges.

Case Document 29-26 Filed 04/28/20 Page 67 of 71

IN THE UNITED STATES DISTRICT COURT
OR THE DISTRICT OF COLUMBIA

IN THE MATTER OF THE SEARCH OF Case: 1:18?50?0291 9
INFORMATION ASSOCIATED WITH FOUR Assigned To Howell, Beryl A.
ACCOUNTS STORED AT PREMISES Assign. Date 

 

CONTROLLED BY FACEEOOK Description: Search St Seizure Warrant

MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND
TO REQUIRE UNDER 18 U.S.C. 2705(b)

The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (colleCtively herein the ?warrant? under seal, and precluding the provider from.
notifying any person of the Warrant pursuant to 18 U.S.C. ?2705(b). In regard to the non?
disclosure, the proposed Order would direct Facebook, Inc. acebook?), an electronic
communication and/or remote computing services provider headquartered in Menlo Park,-
California, not to notify any other person (except attorneys for Facebook for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
further order of the Court.

JURISDICTION AND LEGAL BACKGROUND

1. The Court has the inherent power to seal court ?lings when appropriate,
including the Warrant. United States v. Hubbard,_650 F.2d 293, 315?16 (DC. Cir. 1980) (citing
Nixon v. Warner Communications, Inc, 435 US. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, suchjedpardy creates-a compelling governmental interest in preserving the con?dentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287?89 (DC. Cir. 1991).

2. In addition, this Court has jurisdiction to issue the requested order because it is ?a

court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. Speci?cally, the Court is a

Case Document 029-26- Filed 04/28/20 Page 68 of 71

?district court of the United States . . . that has jurisdiction over the offense being investigated.?
18 U.S.C. 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, DC. See 18 U.S.C. 3237.

.3. Further, the Court has authority to require non?disclosure of the Warrant under 18
U.S.C. 2705(b). Facebook provides an ?electronic communications service,? as de?ned in 18
U.S.C. 2510(15), and/or ?remote computing service,? as de?ned in 18 U.S.C. 2711(2). The
Stored CommunicatiOns Act 18 U.S.C. 2701?2712, governs how Faceboolt may be
compelled to supply communications and other records using a subpoena, court order, or search-
warrant. Speci?cally, Section 2703(c)(2) authorizes the Government to obtain certain basic
?subscriber information? using a subpoena, SectiOn 2703 allows the Government to obtain other
- ?non-content? information using a court order, and Section allows the
Government to obtain contents iof using a search Warrant. See 18 U.S.C. 2703.

4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, When necessary,
Section 27-05(b) of the SCA enables the Government to obtain a courtgorder to preclude such .
noti?catiOn. In relevant part, Section 2705(1)) provides as follows".1

Preclusion of notice to subject of governmental access. A governmental 

entity acting under section2703 . may apply to a? court for an order commanding

a provider of electronic communications service or remote computing service to

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order; The court shall enter such an order if it determines that

there IS reason to believe that noti?cation of the existence of the warrant, subpoena,
or court order will result 1n?

 

Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U. S. 
2703(b)(1)(B), but the GOvernrnent does not seek to use the proposed Order for any legal process
under that provision.

Case Document 29-26 Filed 04/28/20 Page 69 of 71

endangering the life or physical safety of an individual;
(2) ?ight from prosecution; -
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. 2705(b). he United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(1)) must be issued once the Government makes the
requisite showing about potential consequences of noti?cation:
The explicit terms of section 2705 make clear that if a courts [Sic] ?nds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under 2705 the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the

government makes the required showing under 2705 the court is required to
issue the non-disclosure order.

In re AppZicatz'on for Order ofNondz?chosure Pursuant to 18 US. C. 551270565) for Grand Jury
Subpoena 41 F. supp. 3d 1, 5 (D.D.C. 2014).

5. Accordingly, this .motion to seal sets forth facts "showing reasonable grounds to
command Facebook not to notify any other person (except attorneys for acebooic for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year 011111111 further
order of the Court.

FACTS SUPPORTING SEALING AND NON-DISCLOSURE

6. The Federal Bureau of Investigation is investigating, among other things, -
violations of 18 U.S.C. 2 (aiding and abetting), 18 U.S.C. 3 (accessory after the fact), 18 U.S.C.
4 (misprision of a felony), 18 U.S.C. 371 (conSpiracy), 18 U.S.C. 951 (acting as an
unregistered foreign agent), 18 U.S.C. 1030' (unauthorized access of a protected computer);
18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1349 (attempt and conspiracy to cormnit wire fraud),
and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. 30121 (foreign

contribution ban) (the ?Subject Offenses?), in connection with. efforts to compromise the networks

3

Case Document 29-26 Filed 04/28/20 Page 70 of 71

of the Democratic National Convention the Democratic Congressional Campaign
Committee and the email accounts of US. persons involved in the 2016 presidential
election, followed by the public release of stolen materials through various outlets.

7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Facebook and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Faeebook for the purpose of receiving
legal advice)'l for a period of one year or until further order of the Court. Such an order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may-alert
these targets to the nature, scope, and'focus of the ongoing investigation. Disclosure of the Warrant
and related papers may also alert the targets to the scope of information known- to the FBI. Once
alerted to. this information, potential targets would be inunediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take I
steps to undermine the investigation and avoid future prosecution. I In particular, given that they.
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or digital evidence relating to their criminal activity.

8. Given the complex and sensitive nature of the criminal activity under investigation,
. and also given that-the criminal scheme may be ongoing, the Government anticipates that this
con?dential investigation will continue for the next year or longer. However, should
circumstances change such that court?ordered nondisclosure under Section 2705 becomes no
longer needed, the Government will notify the Court and seek appropriate relief.

9. There is, therefore, reason to believe that noti?cation of the existence of the

Warrant will seriouslyjeopardize the investigation, including by giving the targets an opportunity

Case Document 29-26 Filed 04/28/20 Page 71 of 71

to ?ee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
2705 Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in con?dentiality to justify the government?s sealing request.
See Robinson, 935 F.2d at 287~89.

10. Based on prior dealings with Facebook, the United States is aware that, absent a
court order under Section 2705 commanding Faceboolc not to notify anyone about a legal
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored Wire
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material-sought.

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above?captioned warrant, the application and affidavit in support thereof, and all. attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Facebook not to notify any other person of the existence or contents of the ab ove?captioned warrant
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year
or until further order Iof the Court. I

I Respectfully submitted,
ROBERT S. MUELLER, HI

. Special Gk
By 

Dated: - 5:121 . 
Kyle . reen
The Specral Counsel?s Of?ce

(202) 616?3812