Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 1 of 56

AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of New York
In the Matter of the Search of
(Briefly describe the property to be searched
or identify theperson by name and address)

the Premises Known and Described as

].~MAG847

)
)
)
)
)
)

Case No.

SEARCH AND SEIZURE WARRANT
To:

Any authorized law enforcement officer

An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the
Southern
District of
New York
(identify the person or describe the property to be searched and give its location):

See Attachment A
The person or property to be searched, described above, is believed to conceal (identify the person or describe the property
to be seized):

See Attachment A
The search and seizure are related to violation(s) of (insert statuto,y citations):

18 U.S.C. §§ 1001, 1505, 1512(b)(1)
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
·
February 6, 2019
YOU ARE COMMANDED to execute this warrant on or before
(not to exceed 14 days)

~ in the daytime 6:00 a.m. to 10 p.m.

0 at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the wmrnnt and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or l ei3-VC tpfcopy.a~d receipt at the
place where the property was taken.
. . : , , · . 1 • '. . . • , · •
1

.

.

.

The officer executing this warrant, or an officer present during the exeeu.tion.o(the warrant, rfmst prepare an
invento;y as required by law and promptly return this warrant and inventory t.ci..· the .Cf~rk ofth~ Cou.rt. _A,1
./'Upon its return, this warrant and inventory sho11ld be filed under seal by the ;Clerk of the Court~'~
...,_/·_::._-_-_-_:-_:-&SM.f Initials

0 I find that immediate notification may have an adverse result listed in 18,HS·'.C. § 2705 (except :for delay
of trial), and authorize the officer executing this warrant to delay notice to the p'ers9ri \\'.hO,: or whose prop(;)rty, will be
searched or seized (check the appropriate box) Ofor
days (not to exceed 30).
· ' '
,
·
·

I

J

Ountil, the facts justifying, the later specific. •dat,e:
Date and time issued:
City and state:

I

\

of, ·,

-------

/ -l-+l//Jo~·
I '-1- - 19~L~·:
0/.~
/LA
~
-_
'--1-"IIJ-'
~- a,1>-J,_ _ _ _
_
___
_
-/

7

New York, NY

-----------

Judge 's signature

Hon. Robert W. Lehrburger
Printed name and title

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 2 of 56

AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant (Page 2)

Return

Case No.:

Date and time warrant executed:

Copy of warrant and inventory left with:

Inventory made in the presence of :
Inventory of the property taken and name of any person(s) seized:

Certification

I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant
to the Court.

Date:
Executing officer's signature

Printed name and title

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 3 of 56

ATTACHMENT A

I. Premises to be Searched - Subject Premises

The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described as

II. Items to Be Seized
A.

Evidence, Fruits, and Instrumentalities of the Subject Offenses

The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WildLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;

1

 .

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 4 of 56

c. Documents that reflect communications between Roger Stone and Jerome Corsi
that concern the Subject Offenses;
d. Documents reflecting communications between Roger Stone and Randy Credico
that concern the Subject Offenses;
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
f.

Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;

g. Records and information relating to the use, ownership, or control of e-mail
accounts

;

h. Records and information demonstrating who uses, owns, or controls the WhatsApp
account associated with telephone numbe
1.

Records and information demonstrating who uses, owns, or controls the Signal
account associated with telephone number

J.

;

;

Records and information demonstrating who uses, owns, or controls the Wickr
account associated with telephone numbe

;

k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 5 of 56

1.

Computers and media storage devices, including tablets/iPads, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form; and

m. Cellular telephones, smartphones, or personal data assistant devices, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, _diaries, and reference materials, in whatever
form.

B.

Search and Seizure of Electronically Stored Information

The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1.
Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2.
Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3.
Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.

3

 I

P

\.

'I

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 6 of 56

In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
•

surveying various file "directories" and the individual files they contain (analogous to
looldng at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

opening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;

•

scanning storage areas to discover and possibly recover recently deleted files or
.deliberately hidden files;

•

performing key word searches through all electronic storage areas to determine whether
occuITences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and

•

reviewing metadata, system inf01mation, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.

Law enforcement personnel will make reasonable effo1is to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.

4

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 7 of 56
AO 106 (SDNY Rev. 01/17) Application for a Search Warrant

UNITED STATES DISTRICT COURT
for the
Southern District of New York
In the Matter of the Search of

)
)
)
)
)
)

(Briefly describe the property to be searched
or identify the person by name and address)

See Attachment A

7

CaseNl 9

APPLICATION FOR A SEARCH AND SEIZURE WARRANT
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):

the Premises Known and Described as
located in the

Southern

--------

District of

New York

, there is now concealed (identify the

------------

person or describe the property to be seized):

See Attached Affidavit and its Attachment A

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~vidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
~roperty designed for use, intended for use, or used in committing a crime;
0 a person to be· arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section(s)

Offense Description(s)

18 U.S.C. §§ 1001, 1505, .False statements, witness tampering, obstruction of proceedings
before departments, agencies, and committees
1512(b)(1)
The application is based on these facts:
See Attached Affidavit and its Attachment A

i'lf Continued on the attached sheet.
0 Delayed notice of

EZ.

days (give exact ending date if more than 30 days:

under I 8 U.S.C. § 3103a, the basis of which is set forth

~ C / } 1 f . 's.,
) '.

,(

) is requested

s/gl1ati~re

/ '\ i 11:' '·

'11 ''}

(

., '$A rylic~ei_
J,
'Robi1?Js0h ~ - - - - - -------,,--.,, )
! ,, .
-\......--.---,
0

Sworn to before me and signed in my presence.
Date:

J~r/;/J/2
I
-------------

Prinzed ,iame
and titleI
'

f

JI!

'

,

I

,

J

'

\

;."'J
• I./;;

I

'

'

'

.

'

I'

.Yi;'i '.-r'~..--·--···,··
..I

,··,

. /'

*'~/\LY<

I..

J

!

\

I

•

I

•

r

,

,

~

/I
·,, '
- - - - - ~ - ~ - ' , , ·~--.-;..,--'+'~

)
·-'------

' .. ' J~dge 's sig,!atuta '
.

City and state: New York, NY

'·

.I

I

I

)

j

'

·,\

'

_______H_o_·n~.·'1-~obert
+yy. 'p&_h.,..,tb_8_r~g_er_ _~ - - Prihted,11'nne al,dtitle

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 8 of 56

IN THE UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF NEW YORK

----------------------------------------------------------------,
''
In the Matter of the Application of the United
States Of America for a Search and Seizure
Warrant for the Premises Known and Described
a

TO BE FILED UNDER SEAL

Agent Affidavit in Support of
Application for Search and Seizure
Warrant

-----------J'

SOUTHERN DISTRICT OF NEW YORK:
Mickey J. Robinson, being duly sworn, deposes says:

I.

Introduction
A.

Affiant

1.

I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have

been since September 2012. I successfully completed New Agent Training at Quantico, Virginia,
where I received extensive instruction on criminal investigations.
2.

I make this affidavit in support of an application pursuant to Rule 41 of the Federal

Rules of Criminal Procedure for a warrant to search the premises specified below (the "Subject
Premises") for, and to seize, the items and informatiQn described in Attachment A. This affidavit
is based upon my personal knowledge; my review of documents and other evidence; my
conversations with other law enforcement personnel; and my training, experience and advice
received concerning the use of computers in criminal activity and the forensic analysis of
electronically stored information ("ESI"). Because this affidavit is being submitted for the limited
purpose of establishing probable cause, it does not include all the facts that I have learned during
the course of my investigation. Where the contents of documents and the actions, statements, and
conversations of others are reported herein, they are reported in substance and in part, except where
otherwise indicated.

1

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 9 of 56

B.

The Subject Premises

3.

The Subject Premises are particularly described as

C.

The Subject Offenses

4.

For the reasons detailed below, I believe that there is probable cause to believe that

the Subject Premises contain evidence, fmits, and instrumentalities of violations of (i) Title 18,
United States Code, Section 1505 (obstruction of proceedings before departments, agencies, and
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code, Section l 512(b)(1) (witness tampering); (collectively the "Subject Offenses").

II.

Probable Cause
A.

Probable Cause Regarding Commission of the Subject Offenses

5.

I have personally participated in this investigation and am aware of the facts

contained herein based on my own investigation, as well as my review of documents, records, and
information provided to me by other law enforcement officers and technical experts.
6.

This affidavit is intended to show merely that there is sufficient probable cause for

the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I asse1i that an event took place on a particular date, I am asserting that it took
place on or about the date specified.

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 10 of 56

7.

For the reasons set forth in this Affidavit, there is probable cause to believe that one

or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., ("Roger Stone")
and others known and unknown to the government. Further, there is probable cause to believe the
Subject Premises have been used to facilitate the commission of one or more of the Subject
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises.
Background on Relevant Individuals
8.

Based on publicly available information and information obtained m the

investigation, I know the following:
a. Roger Stone is a political consultant who has worked for decades in U.S. politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential
campaign of Donald J. Trump ("Trump Campaign") until in or around August
2015, and subsequently maintained regular contact with and publicly supported the
Trump Campaign through the 2016 election.
b. Julian Assange is the founder and director of 'YikiLeaks, which is publicly
described as a non-profit organization that disseminates non-public information and
classified media provided by anonymized sources. WikiLeaks has posted numerous
documents stolen from the U.S. government. At all relevant times, Assange was
located at the Ecuadorian Embassy in London, United Kingdom.
c. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi
spoke regularly with Stone throughout the campaign, including about the release of
stolen documents by WikiLeaks.

3

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 11 of 56

e. ,Randy Credico was a radio host who has lmown Stone for more than a decade. In
testimony before U.S. House of Representatives Permanent Select Committee on
Intelligence ("HPSCI") on or about September 26, 2017, Stone described Credico
(without naming him) as an "intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr.
Stone" that Assange, had "' [e] mails related to Hillary Clinton which are pending
publication.'"
f.

Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November
2016, Gates served as the deputy campaign chairman of the Trump Campaign. On
February 23, 2018, Gates pled guilty to one count of conspiracy against the United
States and one count of making false statements to federal law enforcement officers.

United States v. Gates, l: 17-cr-201 (D.D.C.).
g. Stephen K. Bannon is a U.S. citizen who serves as a political consultant. Beginning
in or around August 2016 and through the 2016 U.S. presidential election, Bannon
served as the chief executive officer of the Trump Campaign.

4

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 12 of 56

Hacking Activity During the 2016 Presidential Election
9.

John Podesta is a U.S. citizen who served for years as a political consultant. During

the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation through which an actor would have gained access to Podesta' s email
account allowing the actor to steal emails and documents from that account.
10.

The Democratic National Committee ("DNC") and Democratic Congressional

Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity ·
company CrowdStrike to investigate the intrusions and remediate.

1

In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known ot trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicldng a malicious link or URL.
5

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 13 of 56

11.

On or about June 14, 2016, CrowdStrike issued a public press release announcing

that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bJoth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
12.

On or about July 13, 2018, a federal grand jury sitting in the District of Columbia

returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, l:18-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
13.

As alleged in the Netyksho indictment, after successfully hacking the DNC and

DCCC networks, as well as Podesta' s email account, GRU officers transmitted some of the stolen
documents to WikiLeaks.

GRU officers communicated with WikiLeaks members about the

transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
14.

On or about July 22, 2016, WildLeaks released tens of thousands of documents

stolen from the DNC network. These stolen documents included communications by senior DNC

6

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 14 of 56

officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
15.

Beginning in or around October 2016, WikiLeaks began to release tens of

thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from. John Podesta, releasing a total of over 50,000 stolen
documents.
Stone's Communications About WikiLeaks During the Campaign
f

16.

In April 2018 interviews with the Special Counsel's Office, Gates stated that

starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
WildLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed
WikiLeaks and Stone's prediction of the release.
17.

According to Gates, Manafort directed Gates to contact Stone about any additional

releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel's Office in or
around October 2018, Gates recalled that at one point during the campaign he was with thencandidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.

7

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 15 of 56

18.

Emails recovered through a court-authorized search of Stone's email account
2

show that shortly after the July 22, 2016 releas~ of stolen DNC emails

by WikiLeak:s, Stone coffesponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a. On or about July 25, 20~6, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to

who lived in the United Kingdom and was a supporter of

the Trump Campaign.
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that

"should see Assange."

c. On or about August 2, 2016, Corsi emailed Stone and wrote that he was cuffently
in Europe and planned to retum in mid-August. Corsi stated, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging." In a law enforcement interview, Corsi stated that
the phrase "friend in embassy" refeffed to Assange. Corsi added in the same email,
"Time to let more than Podesta to be exposed as in bed w enemy if they are not

2

A search of
was authorized on or about September 11, 2017 by the U.S.
District Cour
umbia. Case No. 1:l 7-mj-661 (D.D.C. Sept. 11, 2017). A
second search o
was authorized on or about August 3, 2018 by the U.S.
District Court fo
a. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 27 03 (d) for records connected to
Case No. 1:18-sc-2911 (D .D. C. Sept.
26, 2018). Records provided in r
rporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
8

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 16 of 56

ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
19.

According to recorded public statements recovered by the FBI, starting in early

August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a. According to a public video posted to YouTube, on or about August 8, 2016, Stone
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
During the interview, Stone stated that he was "in communication with Assange"
but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communication with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN teleyision interview on or about August 18, 2016, Stone stated that he

9

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 17 of 56

had communicated with Assange through an "intermediary, somebody who is a
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
or have influence with Assange because I do not. . . . We have a mutual friend,
somebody we both trust and therefore I am a recipient of pretty good information."
20.

In or around November 2018

, Stone

produced a series of text messages between Stone and Credico during the 2016 presidential
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeak~ and Assange planned to
do.

Emails recovered through a court-authorized search of Stone's email account
show additional written communications between Stone and Credico

about WikiLeaks in or around September 2016.
a. On or about August 19, 2016, Credico sent a text message to Stone that read in part,
"I'm going to have Julian Assange on my show next Thursday." On or about
August 21, 2016, Credico sent another text message to Stone, writing in part, "I
have Julian Assange on Thursday so I'm completely tied up on that day."

3

As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
10

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 18 of 56

b. On or about August 25, 2016, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Julian Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
am e-mailing u a request to pass on to assange." Credico responded "Ok," and
added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e. Later on or about September 18, 2016, Stone emailed Credico an article with
allegations against then-candidate Clinton related to her service as Secretary of
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
article] or confinn this narrative."
f.

On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.

11

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 19 of 56

g. On or about September 30, 2016, Credico sent Stone via text message a photograph
of Credico standing outside the Ecuadorian Embassy in London where Assange
was located.
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
press had reported that Assange planned to make a public announcement on or
about Tuesday, October 4, 2016, which was rep01ied to be the 10-year anniversary
of the founding ofWikiLeaks.
1.

On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
and a link to an article at the website http://heatst.com/politics/october-surprisethwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-tosecurity-concerns. Credico responded to Stone, "head fake."

J.

On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it['Js on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
this line ... Please leave my name out of it."

21.

Emails and text messages recovered by the FBI show that, in or around October

2016, Stone made statements about Assange's future releases, including statements that were
similar to statement that Credico made to him. For example:

12

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 20 of 56

a. In a court-authorized search of Stone's email accoun

the

sent on or about October 3, 2016,

FBI recovered an email from Stone t

which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
b. In a comi-authorized search o

, the FBI also recovered an

email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Steve Bannon.

In the exchange, the reporter asked,

"Assange - what's he got? Hope it's good." Stone responded, "It is. I'd tell
Bannon but he doesn't call me back."
c. On or about October 4, 2016, Assange held a press conference but did not release
any new materials pertaining to the Clinton Campaign. In a court-authorized search
o

the FBI recovered an email exchange between Stone and

Bannon on or about October 4, 2016 that occurred after the press conference. In
the exchange, Bannon asked, "What was that this morning???," referring to
Assange's press conference. Stone responded, "Fear. Serious security concern. He
thinks they are going to kill him and the London police are standing do[wn].
However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account, 5 the FBI recovered text
messages between Stone and

from on or about October 4, 2016. In one text

4

A search of
was authorized on or about October 17, 2017 by the U.S.
District Court
umbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
was authorized on or about August 3, 2018 by the U.S.
second search of
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018).
5

A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Comi for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). · The
13

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 21 of 56

message,

asked Stone if he had "hear[d] anymore from London." Stone

replied, "Yes -want to talk on a secure line- got Whatsapp." In an interview with
the Special Counsel's Office in or around May 2018,

confirmed that he and

Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
22.

On or about October 7, 2016, WikiLeaks released the first set of emails stolen from

Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read, "well done." Similarly,
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
Stone said, "I told you this was coming."
Stone's Communications with the House Permanent Select Committee on Intelligence
23.

On or about January 25, 2017, HPSCI publicly disclosed that it was investigating

allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HP SCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (paiiicularly those from August 2016)
were of interest to the committee.

records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
6

On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.
14

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 22 of 56

24.

In or around May 2017, HP SCI ~ent a letter requesting that Stone voluntarily appear

before the committee and produce relevant documents to HP SCI (a copy of the HPSCI letter was
recovered by the FBI from a court-authorized search of Stone's email account
). The letter requested Stone produce:
Any documents, records, electronically stored information
including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's publiclyannounced parameters.
25.

On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and .

stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone's email accoun

).

Stone's Testimony Before HPSCI
26.

On or about September 26, 2017, Stone provided HPSCI with an "opening

statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is

7

On or about December 14, 2018, the U.S. Depaiiment of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Depaiiment of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members ofHPSCI.
15

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 23 of 56

responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
27.

Also on or about September 26, 2017, Stone provided testimony in a closed session

before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Department of Justice from HPSCI in or around
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearin~, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
Stone's Testimony About Documents He Possessed Related to WikiLeaks
28.

During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document

request and whether Stone had any documents or written communications that discussed Julian
Assange, Russian interference,_ or other relevant documents:

Q:

The committee wrote to you on May 9th requesting no later
than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no documents,
records, or electronically stored information regardless of
form responsive to our requests. Was that a false statement?

A:

That is not a false statement. That's what -- I believe that to
be true.

[...]
Q:

So you have no emails to anyone concerning the allegations
of hacked documents or your conversations with the
Guccifer 2[.0J or any discussions you have had with third
parties about Julian Assange? You have no emails, no texts,
no documents whatsoever, any kind of that nature?

16

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 24 of 56

29.

A:

That is correct. Not· to my knowledge. I think we met, again,
the precise criteria of your request, and we complied. Again,
if you have a more specific request, I'm happy to go back and
look. ...

Q:

I just want to ask you under oath -

A:

We did an extensive search consistent with the direction of
my attorneys, and we found nothing that met the criteria that
you asked for.

Q:

I just want to be certain because you are under oath, where
your letter was not under oath, that you have no documents,
no emails, no texts, no tweets that refer to Julian Assange or
Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've written
no documents yourself.

A:

In connection with Russian collusion, consistent with your
exact and precise request, yes.

In fact, and as described above, Stone had sent and received numerous emails and

text messages during the 2016 campaign in which he discussed WildLeaks, Assange, and
WildLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
(including

) and his iCloud account show that,

at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017. 8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016, that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WildLeaks emails . . . they deal with

8

The warrant for Stone's email account
was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to acourtorderissued pursuant to 18 U.S.C. § 2703(d) confrrmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account
was obtained on or about October 17, 2017 and executed
shortly thereaf
tone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
17

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 25 of 56

Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that

"should

see Assange"; (c) Corsi' s email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to

on or about October 3, 2016

that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
load every week going forward."
Stone's TestimonyAbout His Early August 2016 Statements
30.

During his HPSCI testimony on or about September 26, 2017, Stone was asked to

explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at libe1iy to discuss what I have."
31.

Stone testified that these public references to having a means of contacting

WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentlem:an who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
32.

In fact, documents recovered during the investigation

18

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 26 of 56

a) show that Stone did not begin communicating
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9-approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after to his August 12, 2016 statements of being "in communication
with Assange" and "not at liberty to discuss what I have."
33.

When interviewed by the FBI, Credico stated that the first time he ever spoke with

°

Assange was on or about August 25, 2016, when ~redico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between lie and another
member of WildLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
info1mation about himself, apparently as a means of introduction.
34.

The FBI has not identified any communications between Stone and Credico from

August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
35.

In contrast, and as described above, the FBI has identified written communications

prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WildLeaks emails ... they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico-sent an email to Stone in which Corsi

9

As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."

°

1

Credico was first interviewed by the FBI in or around August 2018. He has subsequently
paiiicipated in multiple voluntary interviews.

19

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 27 of 56

wrote that "[w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other
source for information from WikiLeaks. Stone also.never disclosed his written communications
with Corsi to HPSCI when answering HPSCI's questioning about the August 8, 2016_ and August
12, 2016 statements about being in communication with Assange.
Stone 's Testimony About Communications to Assange

36.

During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to

communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
37.

In fact, starting on or.about September 18, 2016, Stone directed Credico to pass on

a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages

, on or about

September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
u a request to pass on to Assange." On or about the same day, Stone emailed
Credico an article with allegations against then-candidate Clinton related to her
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
was obtained through a search of Stone's email account

20

).

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 28 of 56

b. According to text messages

, on or about

September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Assange." Credico responded, "I did." An email obtained from the account
shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.
Stone's Testimony About Written Communications with Credico

38.

During his HPSCI testimony, Stone was asked repeatedly about· his

communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intermediary telephonically:
Q:

[H]ow did you communicate the intermediary?

A:

Over the phone.

Q:

And did you have any other means of communicating with
the intermediary?

A:

No.

Q:

No text messages, no-none of the list, right?

A:

No.

Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
Q:

So you never communicated with your intermediary in
writing in any way?

A:

No.

Q:

Never emailed him or texted him?

A:

He's not an email guy.

21

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 29 of 56

39.

Q:

So all your conversations with him were in person or over
the phone.

A:

Correct.

As described above, Stone and Credico (who Stone identified as his intermediary)

engaged in :frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
engaged in dozens of communications by email or text message in which they discussed
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
40.

Written communications between Stone and Credico continued up until Stone's

HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HP SCI and denied having ever sent or received emails or text messages :from
his identified intermediary, Stone and Credico exchanged over thirty text messages.
41.

Certain of the electronic messages between Stone and Credico (which Stone denied

ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or a!ound September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HP SCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you[] said you have a back-channel way back a month before I had Assange on
my show . . . I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together ... so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this email was obtained through.
a search of Stone's email account

.

22

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 30 of 56

Stone 's Testimony About Communications with the Trump Campaign
42.

During his HPSCI testimony, Stone was asked, "[d]id you discuss your

conversations with the inteimediary with anyone involved in the Trump campaign?"

Stone

answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:
a. As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials to infmm them about materials possessed by Assange
and the timing of future releases.
b.

, on or about October
3, 2016, Stone wrote to

, "Spoke to my friend in London last night. The

payload is still coming."
c.

As described above, on or about October 4, 2016, after receiving information from
Credi co about the delay in WikiLeaks' s release of stolen materials, Stone emailed
Bannon that Assange had a "[sJerious security concern" but would release "a load
every week going forward."

Stone's Attempts to Influence Credico RegardingHPSCI and the FBI
4 3.
account

According to an email recovered through a court-authorized search of Stone's email
on or about October 19, 2017, Stone sent Credico an excerpt of

his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HP SCI, but Stone did not do so. Stone then engaged in a prolonged
effort to prevent Credico from contradicting Stone's false statements to HPSCI.

23

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 31 of 56

44.

In or around November 2017, Credico received a request from HPSCI to testify

voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.

a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, "' Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
committee lawyer told my lawyer that I will be getting a subpoena."

Stone

responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
c. On or about November 28, 2017, ,Credico received a subpoena compelling his
testimony before HPSCI. Credico informed Stone of the subpoena.
d. According to emails recovered from Stone's email accoun
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, ''Are you sure you want to make something out of this now? Why

24

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 32 of 56

not wait to see what [Credico] does? You may be defending yourself too muchraising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
let's hold a day."
e. According to text messages recovered from Stone's iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
11, who falsely claims not to lmow critical information before a congressional

committee that he does in fact lmow. On or about December 1, 2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information
from investigators.
f.

On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you're a fool. Because of tromp I could never get away with a ce1iain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you're stupid enough to testify." (A copy of these text
messages was recovered through a court-authorized search of Stone's iCloud
account).

45.

On or about December 12, 2017, Credico informed HPS CI that he intended to assert

his Fifth Amendment privilege against self-incrimination if required to appear by subpoena.

25

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 33 of 56

According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
46.

Following Credico's invocation of his Fifth Amendment privilege not to testify

before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made statements intended to prevent
Credico from cooperating with the investigations. For example:
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi . . .
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
copy of these text messages was recovered through a court-authorized search of
I

Stone's iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip you
to shreds." Stone also said he would "take that dog away from you," referring to
Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready.
Let's get it on. Prepare to die [expletive]." (A copy ofthis email exchange was
recovered through a court-authorized search of Stone's email account
).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
pe1jury charges like an idiot." Stone responded, "You are so full of [expletive].

26

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 34 of 56

You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact Assange]." (A copy of this
email exchange was recovered through a court-authorized search of Stone's email
accoun

). Credico believed Stone knew that Credico was

sensitive to having this friend's name publicly disclosed.
Missing Electronic Communications and Stone's Use of Encrypted Communications
47.

As described above, the government has recovered the content of many of Stone's

electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
numerous other relevant electronic communications that it has not yet been able to recover the
content.
48.

As described above, during his HPSCI testimony, Stone falsely denied having

emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico).

In fact, emails and text messages recovered in this investigation show the two

communicated :frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone
never disclosed them.
49.

In addition to these emails and text messages in the FBI's possession, the FBI has

reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017 and

27

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 35 of 56

they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
;

for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations.
50.

Additionally, the FBI has interviewed multiple associates of Stone, who confirmed

that Stone has used encrypted applications to communicate with others.

Similarly, records

obtained in this investigation indicate Stone uses multiple applications designed for encrypted

28

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 36 of 56

communic~tion, including (a) WhatsApp, 11 (b) Signal, 12 ( c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
a. According to records from Stone's iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an
email to

that they "talk on a secure line" and proposed using WhatsApp.

b. According to records from Stone's iCloud account, a copy of the Signal application
was downloaded to an iPhone registered to Stone on or about August 18, 2016.
Additionally, text messages recovered from Stone's iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact

11

According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default message
application.
12

According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender's and the receivers' devices.
13

According to open sources, Wicla is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmi_tted through the network.
14

According to open sources, ProtonMail is an end-to-end encrypted email service that uses clientside encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
29

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 37 of 56

Julian Assange a link to download the Signal application. 15 Approximately fifteen
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
my number." The attorney responded, "I'll call you."
c. According to records from Stone's iCloud account, a copy of the ProtonMail
application was downloaded to an iPad registered to Stone on or about August 18,
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
was downloaded to an iPhone registered to Stone on or about August 5, 2017.
51.

Based on my training and experience, electronic communications using encrypted

applications such as WhatsApp, Signal, ProtonMail, and Wicla are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
communications, such as call logs and contact lists.
52.

The FBI continues to seek evidence of Stone's communications and contacts dming

the period of the 2016 U.S. presidential election and through the present. The FBI believes these
communications may contain evidence of additional communications concerning Assange,
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign.

15

Such

This attorney was a close friend of Credico' s and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
·30

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 38 of 56

communications could constitute additional evidence of Stone's efforts to obstruct HPSCI's
investigation by showing additional contacts and communications about Assange and WikiLeaks
that Stone failed to disclose.
Other Relevant Communications
53.
conducted.

On May 8, 2018, a law enforcement interview o

was

was an employee of Stone's from approximately June 2016 through

approximately December 2016 and resided in Stone's previous New York apartment for a period
of time.

provided information technology support for Stone, but was not f01mally trained to

do so.

was aware that Stone communicated with Trump during the 2016 presidential

campaign, and afterward, both in person and by telephone.
meeting at Trump Tower between Trump and Stone during the time
Sterne carried a "file booklet" with him. Stone tol
no one should touch it.
54.

provided information about c\.
worked for him, to which

the file booklet was important and that

also said Stone maintained the file booklet in his closet.

On December 3, 2018, law enforcement conducted an interview of an individual

("Person 1") who previously had a professional relationship with a reporter who provided Person

1 with info1mation about Stone. The reporter relayed to Person 1 that in or around January and
February 2016, Stone and Trump were in constant communication and that Stone kept
contemporaneous notes of the conversations. Stone's purpose in keeping notes was to later provide
a "post mortem of what went wrong."

31

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 39 of 56

B.

Probable Cause Justifying Search of the Subject Premises

55.

Your affiant is aware through the investigation that Stone maintains the Subject

Premises as his secondary residence. 16 Associates of Stone's have confirmed that Stone maintains
the Subject Premises as his residence when he visits New York, New York. 17
56.

Billing records provided by Charter Com.munications
determined that the subscriber of services at the Subject Premises i

In a law enforcement interview,

stated he worked as Stone's assistant. The interview of

in addition to a review of public source records, determined
Your affiant believes

lives in Florida.

established the Charter Com.munications account at the Subject

Premises on behalf of Stone.

58.

Stone participated in an on camera interview that was aired on or about November

2018 at the Subject Prem.ises 18 . Your affiant observed an Apple MacBook Pro computer and an
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the
apartment building that houses the Subject Premises.

16

Stone's primary residence is

17

Public real estate listing indicates the Subject Premises has been listed since December 5, 2018
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing
stated it was not available for viewing until February 1, 2019 because it was still occupied by the
tenant.
18
https://www.washingtonpost.com./p~litics/2018/11/08/roger-stone-has-rule-deny-everythinghe-does/?utm. term=.5ab41ac5df22
32

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 40 of 56

59.

A review of records produced by Uber Technologies, Inc.,
determined that on or about December 2018, the user of the account associated with

Stone's telephone number and email address used Uber services at addresses at or close to the
Subject Premises. Your affiant is aware that users of Uber's services do not always use their
precise address when arranging for transportation, and believes the addresses close to the Subject
Premises are consistent with an individual whose destination is the Subject Premises.
60.

Based on law enforcement interviews, your affiant is aware that Stone has used and

uses cellular telephones, desktop, and laptop computers to conduct electronic communications.
Stone also configures his computers to create regulars backups of his computers and maintains one
of these devices at the Subject Premises, which preserves documents and communications.
61.

In or around May 2018, the FBI interviewed an individual ("Person 2") who

provided information technology services to Stone. According to Person 2, Stone maintains at
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
computer at one point in time.

Person 2 revealed billing receipts

and invoices issued to Nydia Bertran-Stone for information technology ("IT") services dated
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for
IT services in connection with three different Apple computers. Specifically, the billing receipts
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name
"Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number D25TC077GQ17) configured
with the name "Stone-Roger-iMac-NYC"; and (3) an Apple MacBookPro 10 (serial number
C02KL05EFFT4) configured with the name "Stone-Nydia-MBPR."

According to publicly

available information, the iMac is one of Apple's desktop models (i.e., a computer designed to be
stationary).

The naming convention of the computer "Stone-Roger-iMac-NYC" therefore

33

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 41 of 56

suggests it is a stationary computer used by Stone and located at the Subject Premises. 19 According
to the billing records, Person 2 was requested to perfo1m remote support services on or about
March 21, 2018 on the computer named "Stone-Roger-iMac-NYC."
62.

In the aforementioned Washington Post interview of Stone, at least two electronic

devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop
computer.
63.

Person 2 also told law enforcement that Stone used the Apple Time Machine

("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences. According to publicly available information,
Time Machine is the built-in backup feature of Apple computers and can create copies of files on
a computer, including applications, music, photos, email, documents, and system files. A Time
Machine backup allows users to restore files from a specific point in time if the original files are
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time
Machine, a user connects an external storage device to the computer and selects that external
storage device as the backup disk. 20
64.

Records produced by AT&T

show that, since

2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone
number (ending in

According to AT&T, as of January 1, 2015 through approximately

November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s

19

According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
20

When the external is plugged in, 'the Time Machine will automatically make hourly backups for
the past 24 hours, daily backups for the past month, and weekly backups for all previous months.
The oldest backups are deleted when the external storage device selected as the backup disk is full.
The external device can be as small as a USB thumb drive.
34

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 42 of 56

("iPhone 5s") (IMSI 310410657061814). On or about November 14, 2016, Stone's cellular
telephone number was transferred to an Apple iPhone model 7 ("iPhone T') (IMSI
310410930460769).

On or about September 28, 2018, Stone's cellular telephone number was

transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814).
65.

Records produced by Uber Technologies, Inc.,

show that the account associated with Stone's telephone number and email address has the Uber
~pplic_~ti(?ll on multiple d~vic~s~ including a_device ide1!-tified as iPha.nel 1/, UDID - 668EDC?629BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier
"iPhonell,2" con-elates to an Apple iPhone model XS. Additionally, the subpoena returns
identified

a

device

identified

as

iPhone9,4,

UDID

-

716JCF59-6Fl0-41C8-984B-

DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 correlates
to an Apple iPhone model iPhone 7 Plus.

35

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 43 of 56

67.

Statements attributed to Stone in recent media articles also indicate that Stone

retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media repo1is began to publish excerpts of text
messages between Stone and Randy Credico that occuned during the 2016 U.S. election (copies
o_f these tex_t 11?-~s.s~ges su~sequ~11tly ~~re obtained from Sto!_l~

23

).

According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements, your affiant believes the cellular telephone referenced in the article to be the
iPhone 5s documented in the aforementioned AT&T records (which records indicate he stopped
using on or about November 14, 2016).24 Further, your affiant believes Stone maintains other
devices he is no longer actively using.

C.

Probable Cause Justifying Search of ESI

68.

I submit that if a computer or storage medium is found on the Subject Premises,

there is probable cause to believe those records will be stored on that computer or storage medium,
for at least the following reasons:

See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/rogerstone-wildleaks-randy-credico-mueller.
23

Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occuned on or about November 14,
201 6. The government believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.

24

36

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 44 of 56

a. Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person "deletes" a file on a
computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data.
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer's operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
c. Wholly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file system
data structures, and viliual memory "swap" or paging files.

Computer users

typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or "cache."

37

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 45 of 56

69.

As further described in Attachment A, this application seeks permission to locate

not only computer files that might serve as direct evidence of the crimes described on the warrant,
but also for forensic electronic evidence that establishes how computers were used, the purpose of
their use, who used them, and when. There is probable cause to believe that this forensic electronic
evidence will be on any storage medium in the Subject Premises because:
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or. of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active.

Web browsers, e-mail

programs, and chat programs store configuration information on the storage
medium that can reveal inf01mation such as online nicknames and passwords.
Operating systems can record additional info1mation, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. As explained herein, info1mation stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the crilninal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent
from further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and

38

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 46 of 56

movies, transactional information, records of session times and durations, internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a
search wanant at a residence. The existence or absence of anti-virus, spyware, and
malware detection programs may indicate whether the computer was remotely
accessed, thus inculpating or exculpating the computer owner. Further, computer
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains infmmation that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
accessed networks and the internet.

Such information allows investigators to

understand the chronological context of computer or electronic storage media
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media (e.g., a digital camera
or cellular phone with an incorporated camera).

39

The geographic and timeline

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 47 of 56

information described herein may either inculpate or exculpate the computer user.
Last, information stored within a computer may provide relevant insight into the
computer user's state of mind as it relates to the offense under investigation. For
example, information within the computer may indicate the owner's motive and
intent to commit a crime (e.g., internet searches indicating criminal planning), or
consciousness of guilt (e.g., running a "wiping" program to destroy evidence on the
computer or password protecting/encrypting such evidence in an effort to conceal
it from law enforcement).
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process. While it is possible to specify in advance
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
on a computer is evidence may depend on other inf01mation stored on the computer
and the application of knowledge about how a computer behaves. Therefore,
contextual information necessary to understand other evidence also falls within the
scope of the warrant.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a paiiicular thing·
is not present on a storage medium. For example, the presence or absence of

40

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 48 of 56

counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.

III.

Procedures for Searching ESI
A.

Execution of Warrant for ESI

70.

Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search

for and seize property "may authorize the seizure of electronic storage media or the seizure or
copying of electronically stored information ... for later review." Consistent with Rule 41, this
application requests authorization to seize any computer devices and storage media and transport
them to an appropriate law enforcement facility for review. This is typically necessary for a number
of reasons:
•

First, the volume of data on computer devices and storage media is often impractical
for law enforcement personnel to review in its entirety at the search location.

•

Second, because computer data is particularly vulnerable to inadvertent or intentional
modification or destruction, computer devices are ideally examined in a controlled
environment, such as a law enforcement laboratory, where trained personnel, using
specialized software, can make a forensic copy of the storage media that can be
subsequently reviewed in a manner that does not change the underlying data.

•

Third, there are so many types of computer hardware and software in use today that it
can be impossible to bring to the search site all of the necessary technical manuals and
specialized personnel and equipment potentially required to safely access the
underlying computer data.

•

Fourth, many factors can complicate and prolong recovery of data from a computer
device, including the increasingly common use of passwords, encryption, or other
features.or configurations designed to protect or conceal data on the computer, which
often take considerable time and resources for forensic personnel to detect and resolve.

71.

In most cases, a thorough search of a premises for information that might be stored

on storage media often requires the seizure of the physical storage media and later off-site review
consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a
41

 (

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 49 of 56

complete electronic picture of the computer's data, including all hidden sectors and deleted files.
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data
recorded on the storage media, and to prevent the loss of the data either from accidental or
intentional destruction. This is true because of the following:
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing evidence
of how a computer has been used, what it has been used for, and who has used it
requires considerable time, and taking that much time on premises could be
unreasonable. As explained above, because the warrant calls for forensic electronic
evidence, it is exceedingly likely that it will be necessary to thoroughly examine
storage media to obtain evidence. Storage media can store a large volume of
information. Reviewing that information for things described in the warrant can
take weeks or months, depending on the volume of data stored, and would be
impractical and invasive to attempt on-site.
b. Technical requirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application software, and
configurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its examination with the proper tools and lmowledge.

42

 ,

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 50 of 56

c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing with
specialized forensic tools.
72.

Because multiple people share the Subject Premises as a residence, it is possible

that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as well.
· B.

73.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation

of forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) will review the ESI contained therein for information responsive to the
warrant.
74.

In conducting this review, law enforcement personnel may use various techniques

to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such
techniques may include, for example:
•

surveying directories or folders and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

conducting a file-by-file review by "opening" or reading the first few "pages" of such
files in order to determine their precise contents (analogous to performing a cursory
examination of each document in a file cabinet to detennine its relevance);

•

"scanning" storage areas to discover and possibly recover recently deleted data or
deliberately hidden files; and

43

 I

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 51 of 56

•

performing electronic keyword searches through all electronic storage areas to
determine the existence and location of data potentially related to the subject matter of
the investigation25 ; and

•

reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, wl).en, and by whom the computer was used.

75.

Law enforcement personnel will make reasonable efforts to restrict their search to

data falling within the cate~ories of evidence specified in the warrant.

Depending on the

circumstances, however, law enforcement personnel may need to conduct a complete review of all
the ESI from seized devices or storage media to evaluate its contents and to locate all data
responsive to the warrant.
76.

Review of the items described in Attachment A will be conducted pursuant to

established procedures designed to collect evidence in a manner consistent with professional
responsibility requirements concerning the maintenance of attorney-client and ot.p.er operative
privileges. The procedures include use of a designated "filter team," separate and apart from the
investigative team, in order to address potential privileges.

C.

Return of ESI

77.

If the Government determines that the electronic devices are no longer necessary

to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request.
Computer data that is encrypted or unreadable will not be returned unless law enforcement
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of

25

Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover,
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword
search because the information does not contain the keywords being searched.

44

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 52 of 56

the ·criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the
Subject Offenses.

IV.

Conclusion and Ancillary Provisions
78.

Based on the foregoing, I respectfully request the court to issue a warrant to seize

the items and information specified in Attachment A to this affidavit and to the Search and Seizure
Warrant.
79.

In light of the confidential nature of the continuing investigation, I respectfully

request that this affidavit and all papers submitted herewith be maintained under seal until the
Court orders otherwise. Sealing is necessary because items and information to be seized are
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and
related documents may have a negative impact on this continuing investigation and may jeopardize
its effectiveness.

Respectfully submitted,

Special Agent
Federal Bureau of Investigation
I

i)

Subscribed and sworn to before

\

I

\

,

,.1/

me q1\ tbis~Y'fl.:day,;f faJ?-uary, 2019.
)

)

I

,.
\

1' , ' ~

'

iYU_;f~·
'

'

I

J

1.'

,, . /

/ ' - -..............
• . . . ; . _ , . . . . ._ _ __
\II

- ' - - - -

THE HONORABI.:E, ;R.OBERT W. LEHRBURGER
!

'••I •

•

United States Magistrate Judge

45

 I

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 53 of 56

ATTACHMENT A

I. Premises to be Searched - Subject Premises
The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described a

II. Items to Be Seized
A.

Evidence, Fruits, and Instrumentalities of the Subject Offenses

The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;

1

 /

'

Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 54 of 56

c. Documents that reflect communications between Roger Stone and Jerome Corsi
that concern the Subject Offenses;
d. Documents reflecting communications between Roger Stone and Randy Credico
that concern the Subject Offenses;
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
, Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;

f.

Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;

g. Records and information relating to the use, ownership, or control of e-mail
accounts

;

h. Records and information demonstrating who uses, owns, or controls the WhatsApp
account associated with telephone numbe
i.

Records and information demonstrating who uses, owns, or controls the Signal
account associated with telephone numbe

J.

;

;

Records and information demonstrating who uses, owns, or controls the Wickr
account associated with telephone numbe

;

k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;

2

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 55 of 56

1.

Computers and media storage devices, including tablets/iPads, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form; and

m. Cellular telephones, smartphones, or personal data assistant devices, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form.

B.

Search and Seizure of Electronically Stored Information

The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones·,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1.
Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2.
Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3.
Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.

C.

Review of ESI

Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.

3

 Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 56 of 56

In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
•

surveying various file "directories" and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);

•

op-ening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;
·

•

scanning storage areas to discover and possibly recover recently deleted files or
deliberately hidden files;

•

performing key word searches through all electronic storage areas to determine whether
occunences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and

•

reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.

Law enforcement personnel will make reasonable efforts to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.

4