... , .- . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 1 of 53 AO 93 (Rev 12/09) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of Florida In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) , Fort Lauderdale, Florida described in Attachment "A") (further ) ) ) Case No. ) ) ) 19-6033-SNOW SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of Florida (identify the person or describe the property to be searched and give its location): Fort Lauderdale, Florida (further described in Allachmenl nAn) The person or property to be searched, described above, is believed to conceal (identify the person or describe the property to be seized): See Attachment "8." I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before F~ . l ~f1 (nottJ exceed f 4 days) ~ in the daytime 6:00 a.m. to 10 p.m. o at any time in the day or night as I find reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken . The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge Lurana S. Snow (name) o I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this warran~ to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) 0 for days (not to exceed 30). J,.SS Date and time issued: City and state: j,jf}.yl fCj Fort Lauderdale, Florida 0 until, the facts justifying, the later specific date of 1~· d.6 Ph ~.JJ ~ ~ Judge's signatllre Lurana S . Snow, United States Magistrate Judge Printed name and title . . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 2 of 53 ATTACHMENT A The address of the , Fort Lauderdale, Florida Two photographs of the exterior of the Subject Premises are attached below. Page 1 of1 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 3 of 53 .' ATTACHMENT B Property to be seized from the Subject Premises 1. The items to be seized are fruits, evidence, information relating to, contraband, or instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for the time period June 2015 to the present, including: a. Documents and communications that discuss or are related to WikiLeaks, Julian Assange, and/or Russian interference in the 2016 U.S. presidential election; b. Documents reflecting communications between Stone and Jerome Corsi; c. Documents reflecting communications between Stone and Randy Credico; d. Documents reflecting communications between Stone and members of the Trump Campaign or Trump Campaign associates, including Steve Bannon, , Paul Manafort, Richard Gates, and Donald J. Trump; e. Documents related to or discussing the U.S. House of Representatives Permanent Select Committee on Intelligence, the Senate Select Committee on Intelligence, or the Federal Bureau ofInvestigation; f. Records and information relating to the e-mail accounts and g. Records and information relating to the WhatsApp account associated with telephone number ; h. Records and information relating to the Signal account associated with telephone number ; Page 1 of3 . . ... , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 4 of 53 1. Records and infonnation relating to the Wic1er account associated with telephone number ; J. Any computers, media storage devices, tablets/iPads, cellular telephones, smartphones, personal data assistant devices, or other electronic devices used to commit the violations described above or to store records or documents described above; k. Records of personal and business activities relating to the operation and ownership of the computer systems, such as telephone records, notes, notebooks, diaries, and reference materials, in whatever fonn; 1. Records pertaining to accounts held with Internet Service Providers or of Internet use, in whatever fonn; 2. For any computer or storage medium whose seizure is otherwise authorized by this warrant, and any computer or storage medium that contains or in which is stored records or infonnation that is otherwise called for by this warrant (hereinafter, "COMPUTER"): a. evidence of who used, owned, or controlled the COMPUTER at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b. evidence of software that would allow others to control the COMPUTER, such as viruses, Trojan horses, and other fonns of malicious software, as well as evidence of the presence or absence of security software designed to detect malicious software; Page 2 of3 .. . . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 5 of 53 c. evidence of the lack of such malicious software; d. evidence indicating how and when the computer was accessed or used to determine the chronological context of computer access, use, and events relating to crime under investigation and to the computer user; e. evidence indicating the computer user's state of mind as it relates to the crime under investigation; f. evidence of the attachment to the COMPUTER of other storage devices or similar containers for electronic evidence; g. evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the COMPUTER; h. evidence of the times the COMPUTER was used; 1. passwords, encryption keys, and other access devices that may be necessary to access the COMPUTER; J. documentation and manuals that may be necessary to access the COMPUTER or to conduct a forensic examination of the COMPUTER; k. records of or information about Internet Protocol addresses used by the COMPUTER; l. records of or information about the COMPUTER's Internet activity, including firewall logs, caches, browser history and cookies, "bookmarked" or "favorite" web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses; m. contextual information necessary to understand the evidence described in this attachment. Page 3 of3 · Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 6 of 53 " AO 93 (Rev. 12/ 09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with: 19-6033-SNOW InventOlY made in the presence of: Inventory ofthe property taken and name ofany person(s) seized: Certification I declare under penalty ofperjury that this inventory is correct and was returned along with the original warrant to the designated judge. Date: Executing officer 's signature Printed name and title ... Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 7 of 53 AD 106 (R ev 04 / 10) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of Florida In the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) . , Fort Lauderdale, Florida Attachment nAn) (further described in ) ) ) ) ) ) Case No. 19-6033-SNOW APPLICATlON FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): Fort Lauderdale, Florida (further described in Attachment nAn) Southern District of Florida , there is now concealed located in the --------------- ----------------------- (identify the person or describe the property to be seized): See Attachment "B." The basis for the search under Fed . R. Crim. P. 41 (c) is (check one or more): ~ evidence of a crime; ~ contraband, fruits of crime, or other items illegally possessed ; f'i property designed for use, intended for use, or used in committing a crime; o a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section 18U.S.C.1505 18 U.S.C. 1001 18 U.S.C. 1512(b)(1) Offense Description Obstruction of Proceeding False Statements Witness Tampering The application is based on these facts : see attached affidavit. Ii Continued on the attached sheet. o Delayed notice of days (give exact ending date if more than 30 days : under 18 U.S.c. § 3103a, the basis of which is set forth on the attached sheet. ) is requested &, ~p:fL ,;;::!:'~ Curtis A. Heide, Special Agent, FBI Printed name and title Sworn to before me and signed in my presence. Date I ji9-'1}/j ~.~.A. ~ Judge 's signature City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge Printed name and title Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 8 of 53 ATTACHMENT A The address of the Subject Premises is Fort Lauderdale, Florida Two photographs of the exterior of the Subject Premises are attached below. Page 1 of 1 t '>t' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 9 of 53 ATTACHMENT B Property to be seized from the Subject Premises 1. The items to be seized are fruits, evidence, information relating to, contraband, or instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for the time period June 2015 to the present, including: a. Documents and communications that discuss or are related to WikiLeaks, Julian Assange, and/or Russian interference in the 2016 U.S. presidential election; b. Documents reflecting communications between Stone and Jerome Corsi; c. Documents reflecting communications between Stone and Randy Credico; d. Documents reflecting communications between Stone and members of the Trump Campaign or Trump Campaign associates, including Steve Bannon, , Paul Manafort, Richard Gates, and Donald J. Trump; e. Documents related to or discussing the U.S. House of Representatives Permanent Select Committee on Intelligence, the Senate Select Committee on Intelligence, or the Federal Bureau of Investigation; f. Records and information relating to the and e~mail accounts ; g. Records and information relating to the WhatsApp account associated with telephone number ; h. Records and information relating to the Signal account associated with telephone number ; Page 1 of3 f .. I Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 10 of 53 1. Records and information relating to the Wickr account associated with telephone number ; J. Any computers, media storage devices, tablets/iPads, cellular telephones, smartphones, personal data assistant devices, or other electronic devices used to commit the violations described above or to store records or documents described above; k. Records of personal and business activities relating to the operation and ownership of the computer systems, such as telephone records, notes, notebooks, diaries, and reference materials, in whatever form; 1. Records pertaining to accounts held with Internet Service Providers or of Internet use, in whatever form; 2. For any computer or storage medium whose seizure is otherwise authorized by this warrant, and any computer or storage medium that contains or in which is stored records or information that is otherwise called for by this warrant (hereinafter, "COMPUTER"): a. evidence of who used, owned, or controlled the COMPUTER at the time the things described in this wan'ant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b. evidence of software that would allow others to control the COMPUTER, such as viruses, Trojan horses, and other forms of malicious software, as well as evidence of the presence or absence of security software designed to detect malicious software; Page 2 of3 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 11 of 53 c. evidence of the lack of such malicious software; d. evidence indicating how and when the computer was accessed or used to determine the chronological context of computer access, use, and events relating to crime under investigation and to the computer user; e. evidence indicating the computer user's state of mind as it relates to the crime under investigation; f. evidence of the attachment to the COMPUTER of other storage devices or similar containers for electronic evidence; g. evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the COMPUTER; h. evidence of the times the COMPUTER was used; I. passwords, encryption keys, and other access devices that may be necessary to access the COMPUTER; J. documentation and manuals that may be necessary to access the COMPUTER or to conduct a forensic examination of the COMPUTER; k. records of or information about Internet Protocol addresses used by the COMPUTER; 1. records of or information about the COMPUTER's Internet activity, including firewall logs, caches, browser history and cookies, "bookmarked" or "favorite" web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses; m. contextual information necessary to understand the evidence described in this attachment. Page 3 of3 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 12 of 53 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant for the premises known and described as Fort Lauderdale, Florida, described in the following paragraphs and further in Attachment A. 2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have been since 2006. In the course of my duties, I have been responsible for investigating federal crimes and national security matters involving both counterintelligence and issues related to cybersecurity. 3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger Stone") and others known and unknown to the government, for the commission of unlawful activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(1 ) (collectively the "Specified Federal Offenses") . 4. I have personally participated in this investigation and am aware of the facts contained herein based on my own investigation, as well as my review of documents, records, and information provided to me by other law enforcement officers and technical experts. 5. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. Unless specifically indicated, all conversations and statements in this affidavit are related in substance Page 1 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 13 of 53 and part. Where I assert that an event took place on a particular date, I am asserting it took place on or about the date specified. 6. I make this affidavit premises located at In support of an application for a warrant to search the , Fort Lauderdale, FL (the "Subject Premises," as is more particularly described in Attachment A), in connection with the Specified Federal Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and instrumentalities of the Specified Federal Offenses. 7. For the reasons set forth in this Affidavit, there is probable cause to believe that one or more of the Specified Federal Offenses have been committed by Roger Stone and others known and unknown to the government. Further, there is probable cause to believe the Subject Premises have been used to facilitate the commission of one or more of the Specified Federal Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and instrumentalities of violations of the Specified Federal Offense may be present in the Subject Premises. PROBABLE CAUSE A. Background on Relevant Individuals 8. Roger Stone is a political consultant who has worked for decades in U.S. politics and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently maintained regular contact with and publicly supported the Trump Campaign through the 2016 election. 9. Julian Assange is the founder and director of WikiLeaks, which is publicly described as a non-profit organization that disseminates non-pUblic information and classified Page 2 of42 ,. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 14 of 53 media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in London, United Kingdom. 10. Jerome Corsi is a political commentator who worked with an online media publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly with Stone throughout the campaign, including about the release of stolen documents by WikiLeaks. 12. Based on the investigation to date, Randy Credico was a radio host who has known Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent Selection Committee on Intelligence (" HPSCI") on or about September 26, 2017, Stone described Credico (without naming him) as an "intermediary," "go-between," and "mutual friend" to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that Assange, had '" [e ]mails related to Hillary Clinton which are pending publication. '" 13 . Richard Gates is a U.S. citizen who served for years as a political consultant and lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates pled guilty to one count of conspiracy against the United States and one count of making false statements to federal law enforcement officers. United States v. Gales, 1: 17-cr-20 1 (D .D.C.). Page 3 of42 • Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 15 of 53 14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief executive officer of the Trump Campaign. B. Hacking Activity During the 2016 Presidential Election 16. John Podesta is a U.S. citizen who served for years as a political consultant. During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta received a spearphishingl email designed to appear as a security notification (a partial copy of the email was recovered by the FBI from a subsequent release of stolen emails, described below). During an interview with the FBI in or around May 2018, Podesta indicated that after receiving the email, his assistant (who also had access to the account) clicked on a link within the email and entered the account password when prompted (believing this prompt to be part of a security protocol). Based on my training and experience, this activity appears to have been a successful spearphishing operation through which an actor would have gained access to Podesta's email account allowing the actor to steal emails and documents from that account. 17. The Democratic National Committee ("DNC") and Democratic Congressional Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal I In my training and experience, spearphishing in this context refers to the fraudulent practice of sending an email that purports to be from a known or trusted sender in order to induce the targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. Page 4 of 42 , < Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 16 of 53 elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their computer systems had been compromised by unauthorized intrusions and hired the cybersecurity company CrowdS trike to investigate the intrusions and remediate. IS. On or about June 14,2016, CrowdStrike issued a public press release announcing that the DNC's computer network had been compromised. In the public statement, CrowdStrike indicated that it had identified "two sophisticated adversaries on the network," which it referred to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously seen these actors target other customers and that, based on their experience, "[bloth adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government's powerful and highly capable intelligence services." 19. On or about July 13, 20 IS, a federal grand jury sitting in the District of Columbia returned an indictment against eleven Russian nationals, charging them with partaking in a conspiracy to hack into, among other things, the email account of Jolm Podesta, as well as the DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: IS-cr-215 (D.D.C.). The indictment alleges that all of these individuals were military officers serving in the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military intelligence agency. C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign 20. As alleged in the Netyksho indictment, after successfully hacking the DNC and DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the Page 5 of 42 f. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 17 of 53 stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks." CGRU officers separately used these personas to release some of the stolen documents). 21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents stolen from the DNC network. These stolen documents included communications by senior DNC officials about campaign strategy, financial and fundraising data, and other documents related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 22. Beginning in or around October 2016, WikiLeaks began to release tens of thousands of emails and documents stolen from Podesta's email account. Between on or about October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. D. Stone's Communications About WikiLeaks During the Campaign 23. In April 2018 interviews with the Special Counsel's Office, Gates stated that starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed WikiLeaks and Stone's prediction of the release. 24. According to Gates, Manafort directed Gates to contact Stone about any additional releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates contacted Stone, who made statements claiming that there would be potential future releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's Page 6 of42 ., ~ Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 18 of 53 Office in or around October 2018, Gates recalled that at one point during the campaign he was with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 25. Emails recovered through a court-authorized search of Stone's email account show that shortly after the July 22, 2016 release of stolen DNC emails by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to obtain other emails damaging to the Clinton Campaign: a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation, allegedly." On or about the same day, Corsi forwarded Stone's email to , who lived in the United Kingdom and was a supporter of the Trump Campaign. b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me MON." The body of the email read in part that " should see Assange." c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he was currently in Europe and planned to return in mid-August. Corsi stated, "Word A search of was authorized on or about September 11, 2017 by the U.s. District Court for the District of Columbia. Case No.1 :17-mj-661 (D.D.C. Sept. 11,2017). A second search of was authorized on or about August 3, 2018 by the U.S. District Court for the District of Columbia. Case No.1: 18-sc-2582 (D.D.C . Aug. 3,2018). On or about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S .c. § 2703(d) for records connected to . Case No.1 : 18-sc-2911 (D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that the account was still active and that the relevant emails described in this affidavit were not deleted from the account. 2 Page 7 of 42 • Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 19 of 53 is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging." In a law enforcement interview, Corsi stated that the phrase "friend in embassy" referred to Assange. Corsi added in the same email, "Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke ­ neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle." 26. According to recorded public statements recovered by the FBI, starting in early August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated statements about information he claimed to have learned from Assange: a. According to a public video posted to YouTube, on or about August 8, 2016, Stone attended a public event in Broward County, Florida. During the event, Stone stated, "I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation, but there's no telling what the October surprise may be." b. According to a public video posted to YouTube, on or about August 12, 2016, Stone was interviewed for a video segment on the show Info Wars, hosted by Alex Jones. During the interview, Stone stated that he was "in communication with Assange" but was "not at liberty to discuss what I have." c. According to a public video posted to YouTube, on or about August 16, 2016, Stone stated during another interview with Alex Jones that "it became known on this program that I have had some back-channel communication with WikiLeaks Page 8 of 42 ., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 20 of 53 and Assange." In a second interview on or about the same day with Dana Loesch of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that they had a "mutual acquaintance who is a fine gentleman." d. According to a video posted to the public website of the TV station C-SPAN, during a C-SP AN television interview on or about August 18, 2016, Stone stated that he had communicated with Assange through an "intermediary, somebody who is a mutual friend ." e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio interview he did with Stone on or about August 23, 2016 during which the two discussed Stone's prior claims to be in contact with Assange. At one point during the interview, Credico asked Stone, "You ' ve been in touch indirectly with Assange. Can you give us any kind of insight? Is there an October surprise happening?" Stone responded, "Well, first of all, I don't want to intimate in any way that I control or have influence with Assange because I do not. ... We have a mutual friend , somebody we both trust and therefore I am a recipient of pretty good information." 27. In or around November 2018, , Stone produced a series of text messages between Stone and Credico during the 2016 presidential campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone exchanged written communications with Credico about what WikiLeaks and Assange planned to do. Emails recovered through a court-authorized search of Stone' s email account As discussed below, Stone had previously released some of these text messages to members of the media, who had written about them and published them in part. 3 Page 9 of 42 '. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 21 of 53 show additional written communications between Stone and Credico about WikiLeaks in or around September 2016, a. On or about August 19, 2016, Credico sent a text message to Stone that read in part, "I'm going to have Julian Assange on my show next Thursday." On or about August 21, 2016, Credico sent another text message to Stone, writing in part, "I have Julian Assange on Thursday so I'm completely tied up on that day." b. On or about August 25, 2016, Assange was a guest on Credico's radio show for the first time. On or about August 26,2016, Credico sent a text message to Stone that stated, "Assange talk[ed] about you last night." Stone replied and asked what Assange said, to which Credico responded, "He didn't say anything bad we were talking about how the Press is trying to make it look like you and he are in cahoots." c. On or about August 27,2016, Credico sent text messages to Stone that said, "We are working on a Julian Assange radio show," and that he (Credico) was "in charge" of the project. In a text message sent later that day, Credico added, "Julian Assange has kryptonite on Hillary." d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing u a request to pass on to assange." Credico responded "Ok," and added in a later text message, "Just remember do not name me as your connection to Assange you had one before that you referred to." e. Later on or about September 18, 2016, Stone emailed Credico an article with allegations against then-candidate Clinton related to her service as Secretary of State. Stone stated, "Please ask Assange for any State or HRC e-mail from Page 10 of 42 "j Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 22 of 53 August 10 to August 30 -- particularly on August 20, 2011 that mention subject of the article] or " this f. On or about September 19, 2016, responded, "1 did." " 20,2016, forwarded my texted Credico request to a close or about who was an attorney with the ability to contact Stone on the forwarded email. g. On or about 30, 201 Credico sent Stone via text photograph of Credico standing outside the a Embassy In London where Assange was located. h. On or messages October 1, 2016, which was a text stated, "big news Wednesday ... now pretend u don't know me ... " In the will die this had reported that Assange planned to October 4, about anniversary of the 1. Credico sent On or about October 2, preceding these the a public announcement on or 16, which was reported to be the 1 of WikiLeaks. 16, Stone emailed Credico, with the subject line and a link to an article at the website http://heatst.com/politics/october­ surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement­ due-to-security-concerns. responded to Stone, "head fake." J. On or about Monday, October 2016, wrote Credico and ac""""u, "Did Assange back off." Credico initially responded, "I can't tal[k] about it." After further exchanges with Stone, Credico responded, II 42 think on , I ", Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 23 of 53 tomorrow." Credico added, "Off the Record Hillary and her people are doing a full-court press they [sic] keep Assange from making the next dump ... That's all I can tell you on this line ... Please leave my name out of it." 28. Emails and text messages recovered by the FBI show that, in or around October 2016, Stone made statements about Assange's future releases that were similar to prior statements Credico made to him. For example: a. In a court-authorized search of Stone's email account FBI recovered an email from Stone to the sent on or about October 3, 2016, which stated in part, "Spoke to my friend in London last night. The payload is still coming." b. In a court-authorized search of , the FBI also recovered an email exchange from on or about October 3, 2016 between Stone and a reporter who had connections to Bannon. In the exchange, the reporter asked, "Assange ­ what's he got? Hope it's good." Stone responded, "It is. I'd tell Bannon but he doesn't call me back." c. On or about October 4, 2016, Assange held a press conference but did not release any new materials pertaining to the Clinton Campaign. search of In a court-authorized , the FBI recovered an email exchange between Stone and Steve Bannon on or about October 4, 2016 that occurred after the press conference. In the exchange, Bannon asked, "What was that this morning???," referring to Assange's press conference. Stone responded, "Fear. Serious security A search of was authorized on or about October 17, 2017 by the U.S. District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A was authorized on or about August 3, 2018 by the U.S. second search of District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3,2018). 4 Page 12 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 24 of 53 concern. He thinks they are going to kill him and the London police are standing do[wn]. However - a load every week going forward." d. In a court-authorized search of Stone's iCloud account,S the FBI recovered text messages between Stone and text message, from on or about October 4, 2016. In one asked Stone if he had "hear[d] anymore from London." Stone replied, "Yes - want to talk on a secure line - got Whatsapp." In an interview with the Special Counsel's Office in or around May 2018, confirmed that he and Stone spoke and that Stone had told him WikiLeaks had more material to release, and that the material was related to senior people associated with Clinton. 29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from Podesta. According to text messages recovered from Stone's iCloud account, shortly after the release, an associate of Bannon sent a text message to Stone that read, "well done." Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, Stone said, "I told you this was coming." E. Stone's Communications with Intelligence 30. the House Permanent Select Committee on On or about January 25, 2017, HPSCI publicly disclosed that it was investigating allegations of Russian interference in the 2016 presidential election and possible links to individuals associated with political campaigns. 6 During a public HPSCI hearing on or about S A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S. District Court for the District of Columbia. Case No.1: 18-sc-662 (D.D.C. Mar. 14, 2018). The records for Stone's iCloud account contained some, but not all, of Stone's communications from the campaign period. On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee on Intelligence ("SSCI") announced the committee would conduct an inquiry that would 6 Page 13 of 42 ., .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 25 of 53 March 20, 2017, multiple HPSCI committee members indicated that Stone's pnor public statements about having communications with Assange (particularly those from August 2016) were of interest to the committee. 31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was recovered by the FBI from a court-authorized search of Stone's email account ). The letter requested Stone produce: Any documents, records, electronically stored information including e-mail, communication, recordings, data and tangible things (including, but not limited to, graphs, charts, photographs, images and other documents) regardless of form, other than those widely available (e.g., newspaper articles) that reasonably could lead to the discovery of any facts within the investigation's publicly-announced parameters. 32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and stated, "Mr. Stone has no documents, records, or electronically stored information, regardless of form, other than those widely available that reasonably could lead to the discovery of any facts within the investigation'S publicly-announced parameters." (A copy of the letter was recovered from a court-authorized search of Stone's email accountp ). F. Stone's Testimony Before HPSCI 33. On or about September 26, 2017, Stone provided HPSCI with an "opening statement" that his counsel requested be included as part of the record of proceedings before HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone investigate, among other things, any intelligence regarding links between Russia and individuals associated with political campaigns, as well as Russian cyber activity and other "active measures" directed against the United States in connection wi ththe 2016 election. 7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of Stone's interview with HPSCI, as well as any written submissions and/or correspondence from Page 14 of 42 , I " , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 26 of 53 stated, "These hearings are largely based on a yet unproven allegation that the Russian state is responsible for the hacking of the DNC and John Podesta and the transfer of that information to WikiLeaks." 34. Also on or about September 26, 2017, Stone provided testimony session before HPSCI, at the U.S. Capitol in Washington, D.C. In a closed Stone's testimony was transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he would tell the truth. At the beginning of the hearing, Stone was admonished that "it is unlawful to deliberately provide false information to Members of Congress or staff' and that "providing false information to this committee or concealing material information from this committee is a crime punishable by law." Stone's Testimony About Documents He Possessed Related to WikiLeaks 35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document request and whether Stone had any documents or written communications that discussed Julian Assange, Russian interference, or other relevant documents: Q: The committee wrote to you on May 9th requesting no later than May 22 any documents, records, electronically stored information, including email communication, recordings, data, and other tangible things relevant to our investigation. You wrote back through counsel that you had no documents, records, or electronically stored information regardless of form responsive to our requests. Was that a false statement? A: That is not a false statement. That's what -- I believe that to be true. Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 interview of Roger Stone, a copy of Stone's written opening statement, and various correspondence from Stone's counsel to members of HPSCI. Page 15 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 27 of 53 , i [... ] Q: So you no to anyone the hacked documents or your conversations with the Guccifer 2[.0] or any discussions you have with third about Julian You no emails.no no documents whatsoever, any kind of that nature? A: That is correct. Not to my knowledge. I think we met, again, the precise criteria of your request, and we complied. if you have a more specific I'm happy to back and look .... Q: I just want to ask you under oath- A: We did an my attorneys, that you asked for. Q: I just want to be because you are under oath, where your letter was not under that you have no no no texts, no tweets that to Julian or Guccifer 2[.0] or Paul Manafort or the allegations concerning Russian connections with the campaign. You have had no discussions in any written form. You've written no documents yourself. with direction of criteria nothing that met In connection with Russian collusion, consistent with your exact and precise request, 36. In fact, as described sent and text messages during the 2016 campaign he In and WikiLeaks, Assange, and of possession of 11"',,,,,,,,, emails. Court-authorized (including numerous email accounts ) and his iCloud account show that, at the time of his testimony, Stone was still in at the he vv,",,,,,-,,, on or about September 8 many these 2017. 8 and text These written warrant for Stone's email account was obtained on or about September 11, 17 and executed shortly Records provided in or around September 18 in response to a court order issued pursuant to 18 § 2703(d) confinned that the account was and emails question were not from account. The warrant Page 16 42 " . , . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 28 of 53 communications included (a) Stone's email to Corsi on or about July 25, 2016, that read in part, "Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that Malloch "should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated in part: "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a load every week going forward." Stone's Testimony About His Early August 2016 Statements 37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to explain his statements in early August 2016 about being in contact with Assange. Stone was specifically asked about his statement on or about August 8, 2016 that "I've actually communicated with Assange," as well as his statement on or about August 12, 2016 that he was "in communication with Assange" but was "not at liberty to discuss what I have." 38. Stone testified that these public references to having a means of contacting WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the name of this "intermediary," but he provided a description in his testimony that was largely for Stone's email account was obtained on or about October 17,2017 and executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text messages described above) was obtained on or about March 14, 2018 and executed shortly thereafter. Page 17 of42 , I ., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 29 of 53 consistent with Credico. (On or about October I 2017, Stone caused a letter to be to HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. that to Hillary Clinton which are pending publication. '''). had '" [e] mails 39. In fact, documents recovered during the investigation (including those obtained via search warrant returns show that Stone did not communicating with Credico about .~~.~u ..,~ or WikiLeaks until on or about August 19, 2016 9 approximately Stone first claimed on or about August 8, 2016 to "actually have days communicated with communication 40. 6 statements of a week after his Assange" and "not at liberty to discuss what I " When interviewed by the FBI, Credico stated that the with Assange was on or about 2016, when another member WikiLeaks from on or about August 25, technical for the that day. time he ever spoke interviewed also provided the FBI with partially redacted emails that During "in 10 Credico were between he which the two discuss the Credico biographical information about himself, apparently as a means 41. The FBI 2016 in which Stone interviewed by the Credico not identified to contact Credico claimed he was never or WikiLeaks. When Stone in August 16 to contact WikiLeaks. 9 described on or about August 19, Credico intended to interview Assange the the first time, Credico interviewed Julian "Assange has kryptonite on Hillary." Stone by text message that or about August 25, 2016, on or about 1 10 Credico was first interviewed by in or around August participated in multiple voluntary interviews. 18 of 42 18. He has subsequently '. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 30 of 53 42. In and communications prior to as described 8, 2016 above, which Stone Assange. On or about July Ecuadorian In the identified Corsi-not Credico--to contact Stone wrote to Corsi, London the to Assange WikiLeaks with co--sem an Foundation, allegedly." Similarly, on or about August 2, 2016, email to wrote that "[w lord is friend in embassy plans 2 more dumps," in which including one in October. communications statement on or about August at no time did 2016 claiming to identify days before first public in communication with However, to HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other source for information Stone also never disclosed HPSCI's written WikiLeaks. written communications with Corsi to about the August Similarly, when answering 2016 and August 12, 2016 statements about communication with 43. During his HPSCI testimony, Stone was asked, "Did you ask [the intennediaryJ to communicate anything "Did you did not." Stone was then asked, Stone to on your own behalf?" Stone responded, [the intermediary] to do did not." 44. on a In fact, to .~~,~.. ,.,~ 18, 201 on or about for documents that Stone directed Credico to believed would be a. According to text to Clinton , on or about September 18, 2016, Stone sent a text Page 19 of 42 v"''''''''~v to Credico said, "I am e- " . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 31 of 53 mailing u a request to pass on to Assange." On or about the same day, Stone emailed Credico an article with allegations against then-candidate Clinton related to her service as Secretary of State. Stone added, "Please ask Assange for any State or HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that mention [the subject of the article] or confinn this narrative." (A copy of this email was obtained through a search of Stone's email account ). b. According to text messages , on or about September 19,2016, Stone texted Credico again, writing "Pass my message ... to Assange." Credico responded, "I did." An email obtained from the account shows that on or about September 20, 2016, Credico forwarded the request to an attorney who had the ability to contact Assange; Credico blind copied Stone on the same email. Stone's Testimonv About Written Communications with Credico 45. During his HPSCI testimony, Stone was asked repeatedly about his communications with the person he identified as his intennediary. Stone stated that he had never communicated with his intennediary in writing in any way. During one exchange, Stone claimed only to have spoken with the intennediary telephonically: Q: [H]ow did you communicate the intennediary? A: Over the phone. Q: And did you have any other means of communicating with the intennediary? A: No. Q: No text messages, no - none of the list, right? Page 20 of 42 '. . Case 1:19-mc-00029-CRC A: Document 29-33 Filed 04/28/20 Page 32 of 53 No. Later during his testimony, Stone again denied ever communicating with his intermediary in writing: 46. Q: So you never communicated with your intermediary writing in any way? A: No. Q: Never emailed him or texted him? A: He's not an email guy. Q: So all your conversations with him were in person or over the phone. A: Correct. In As described above, Stone and Credico (whom Stone identified as his intermediary) engaged in frequent written communication by email and text message. Beginning on or about August 19,2016, and continuing through the 2016 U.S. presidential election, Stone and Credico engaged in dozens of communications by email or text message in which they discussed WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton Campaign. 47. Written communications between Stone and Credico continued up until Stone's HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that Stone testified before HPSCI and denied having ever sent or received emails or text messages from his identified intermediary, Stone and Credico exchanged over thirty text messages. 48. Certain of the electronic messages between Stone and Credico (which Stone denied ever taking place or possessing) would have been material to HPSCI, including Stone's messages in or around September 2016 directing Credico to pass a request for documents to Assange, and other relevant written communications with Credico. For example, on or about Page 21 of 42 '. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 33 of 53 January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together timelines[] and you [] said you have a back-channel way back a month before I had Assange on my show ... I have never had a conversation with Julian Assange other than my radio show ... I have pieced it all together ... so you may as well tell the truth that you had no back-channel or there's the guy you were talking about early August." (A copy of this email was obtained through a search of Stone's email account ). Stone's Testimony About Communications with the Trump Campaign 49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your conversations with the intermediary with anyone involved in the Trump campaign?" Stone answered, "I did not." As described above, Stone spoke to multiple individuals involved in the Trump campaign about what he claimed to have learned from his intermediary to Assange, including the following: a. As described above, Gates confirmed to investigators that Stone spoke with senior Trump Campaign officials to inform them about materials possessed by Assange and the timing of future releases. b. According to text messages October 3,2016, Stone wrote to , on or about "Spoke to my friend in London last night. The payload is still coming." c. As described above, on or about October 4, 2016, after receiving information from Credico about the delay in WikiLeaks's release of stolen materials, Stone emailed Bannon that Assange had a "[s]erious security concern" but would release "a load every week going forward." Page 22 of 42 ,, Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 34 of 53 G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI 50. According to an email recovered through a court-authorized search of Stone's email accountp . on or about October 19, 2017, Stone sent Credico an excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to HPSCI. 51. In or around November 2017, Credico received a request from HPSCI to testify voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted repeatedly with Stone. a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the plan' ... Richard Nixon." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). On or about November 20, 2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary interview. b. On or about November 21, 2017, Credico texted Stone, "I was told that the house committee lawyer told my lawyer that I will be getting a subpoena." Stone responded, "That was the point at which your lawyers should have told them you Page 23 of 42 , . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 35 of 53 would assert your 5th Amendment rights if compelled to appear." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). c. On or about November 28, 2017, Credico received a subpoena compelling his testimony before HPSCI. Credico informed Stone of the subpoena. d. According to emails recovered from Stone's email account , on or about November 30, 2017, Stone asked Corsi to write publicly about Credico. Corsi responded, "Are you sure you want to make something out of this now? Why not wait to see what [Credico] does? You may be defending yourself too much - raising new questions that will fuel new inquiries. This may be a time to say less, not more." Stone responded by telling Corsi that Credico "will take the 5th-but let's hold a day." e. According to text messages recovered from Stone' s iCloud account, on multiple occasions, starting on or about November 17, 2017, Stone and Credico discussed Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part II, who falsely claims not to know critical information before a congressional committee that he does in fact know. On or about December 1,2017, Stone told Credico in a text message to "Start practicing your Pentagele." When interviewed by the FBI, Credico confirmed that he understood Stone's references to Frank Pentangeli to be Stone's way of suggesting Credico withhold relevant information from investigators. f On or about December 1, 2017, Stone texted Credico, "And if you turned over anything to the FBI you're a fool." Later that day, Credico texted Stone, "You Page 24 of 42 , , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 36 of 53 need to amend your testimony before I testify on the 15th." Stone responded, "If you testify you're a fool. Because of tromp I could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee you you are the one who gets indicted for perjury if you're stupid enough to testify." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). 52. On or about December 12, 2017, Credico informed HPSCI that he intended to assert his Fifth Amendment privilege against self-incrimination if required to appear by subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing evidence that would show Stone's previous testimony to Congress was false. 53. Following Credico's invocation of his Fifth Amendment privilege not to testify before HPSCI, Stone and Credico continued to have discussions about the various investigations into Russian interference in the 2016 election and what information Credico would provide to investigators. During these conversations, Stone repeatedly made aggressive statements intended to prevent Credico from cooperating with the investigations. For example: a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst time this yea[ r] sept 7 ... docs prove that ... You should be honest w fbi ... there was no back channel ... be honest." Stone replied approximately two minutes later, "I'm not talking to the FBI and if your smart you won't either." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A stoolie. You backstab your friends-run your mouth my lawyers are dying Rip Page 25 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 37 of 53 you to shreds." Stone also said he would "take that dog away from you," referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email exchange was recovered through a court-authorized search of Stone's email account ). c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have just been honest with the house Intel committee ... you've opened yourself up to perjury charges like an idiot." Stone responded, "You are so full of [expletive]. You got nothing. Keep running your mouth and I'll file a bar complaint against your friend [the attorney who had the ability to contact Assange]." (A copy of this email exchange was recovered through a court-authorized search of Stone's email accountp ). Credico believed Stone knew that Credico was sensitive to having this friend's name publicly disclosed. H. Missing Electronic Communications and Stone's Use of Encrypted Communications 54. As described above, the government has recovered the content of many of Stone's electronic communications from summer and fall of 2016 (during the period of the U.S. presidential election) and afterward (during the period of pending congressional investigations into Russian interference in the U.S. election). However, the government is aware of the existence of numerous other relevant electronic communications, the content of which it has not yet been able to recover. 55. As described above, during his HPSCI testimony, Stone falsely denied having emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy Credico). In fact, emails and text messages recovered in this investigation show the two Page 26 of 42 " Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 38 of 53 communicated frequently by email and text messages; court-authorized searches of Stone's email and iCloud accounts confirm that Stone still had those communications at the time he testified in or around September 2017. In numerous communications, Stone and Credico discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone never disclosed them. 56. In addition to these emails and text messages in the FBI's possession, the FBI has reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017, and they show text message communications whose content that the government to date has not been able to obtain. For example, these records indicate that Stone and Credico alone exchanged thousands of text messages (including over 1,500 text messages between the period November 2016 and December 2017) the substance of which the government to date has not recovered or reviewed. The government has only recently obtained text messages between Stone and Credico during some period of the campaign in 2016 from Stone's subpoena production, issued after media reports in November 2018 stated that Stone's attorneys were able to extract text messages between Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, for the same time period, many of Stone's other text messages. The government seeks these text messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to corruptly persuade Credico not to cooperate with pending investigations. 57. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed that Stone has used encrypted applications to communicate with others. Similarly, records obtained in this investigation indicate Stone uses mUltiple applications designed for Page 27 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 39 of 53 encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d) ProtonMail. 14 To date, the FBI has not obtained any of Stone's communications conducted through these applications. a. According to records from Stone's iCloud account, a copy of the WhatsApp application was downloaded to an iPhone registered to Stone on or about October 5,2016. As described above, on or about October 4,2016, Stone suggested in an email to that they "talk on a secure line" and proposed using WhatsApp. b. According to records from Stone's iCloud account, a copy of the Signal application was downloaded to an iPhone registered to Stone on or about August 18, 2016. Additionally, text messages recovered from Stone's iCloud account II According to open sources, WhatsApp is an application that allows the user to send text messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and stores its messages separately from those text messages used on a mobile device's default message application. 12 According to open sources, Signal is an encrypted communications application allowing the user to send one-to-one and group messages, which can include files, voice notes, images and videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as identifiers, and uses end-to-end encryption to secure all communications to other Signal users. Signal also allows users to set timers to messages, after which the messages will be deleted from both the sender's and the receivers' devices. 13 According to open sources, Wickr is an instant messaging application that allows users to exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows users to set an expiration time for their encrypted communications. In addition to encrypting user data and conversations, Wickr claims that its application strips metadata from all content transmitted through the network. According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-side encryption to protect email contents and user data before they are sent to ProtonMail servers. According to its website, ProtonMail is run by Proton Technologies AG, a company based in the Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and EU jurisdiction. 14 Page 28 of42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 40 of 53 revealed that on or about November 15, 2016, Stone sent an attorney with the ability to contact Julian Assange a link to download the Signal application. ls Approximately fifteen minutes sending the link, Stone texted the attorney, "I'm on signal just dial my number." attorney responded, "I'll call you." Stone's iCloud account, a c. According to records of the ProtonMail application was downloaded to an iPad registered to Stone on or about August 18, 2016. d. According to from iCloud account, a copy the Wickr application was downloaded to an iPhone registered to Stone on or about August 5, 58. 17. electronic communications Based on my training and encrypted applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the device used to communications. and receive the applications can be obtained by law enforcement by data extraction device (such as Cellebrite). including text Wickr, that have not Communications from those manually or a of the physical device can reveal messages, and messages exchanged over WhatsApp, Signal, ProtonMail, and backed to cloud accounts (such as an iCloud account). Additionally, review of the device and the downloaded application can reveal other evidence encrypted communications, such as call logs and contact lists. continues to seek evidence of Stone's communications and contacts during period of the 2016 U.S. presidential election 15 through The attorney was a close friend of Credico's and was the same friend Credico emailed on or about September 2016 to Stone's request to emails connected to the against then-candidate Clinton to of Page 29 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 41 of 53 believes communications may contain evidence of additional communications concerning WikiLeaks, and the of stolen documents damaging to the Clinton Such communications could constitute additional evidence HPSCI's Stone's by showing additional contacts and to obstruct about and that Stone failed to I. Other Relevant 60. On or about May 8, 2018, a law enforcement interview was conducted. through approximately a approximately June 2016 resided in Stone's previous 2016 .lJ"-"v'-'H Stone's so. was aware that Stone communicated presidential campaign, and afterward, both in person information about a worked for Tower at to which UI..,'VVI..,,,,, the 2016 by telephone. provided Trump Stone it. time told the file maintained said file closet. 61. or about individual ("Person provided Trump carried a "file booklet" with him. booklet was important and that no one should booklet in York apartment for provided information technology support for Stone but was not formally of time. trained to was an employee IJ""'<'A~ 2018, law who conducted an interview relationship with a reporter who had a 2 with information about Stone. reporter around January and February 2016, Stone and Trump were Stone later provide a notes of " 300f42 to Person 2 that in or constant communication conversations. Stone's mortem of what went an m that notes was to Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 42 of 53 J. The Subject Premises 62. Your affiant is aware through the investigation that Stone maintains the Subject Premises as his primary residence. 16 During physical surveillance of the Subject Premises on or about January 14, 2019, the FBI observed Stone at the residence. 63. Records produced by Comcast on August 23, 2018 show that the subscriber of high-speed internet service and digital voice services at the Subject Premises was Nydia Stone. According to public reporting and law enforcement interviews, Nydia Stone is the spouse of Stone. 64. According to emails obtained through a court-authorized search of Stone's email account , Stone sent an email on or about January 2, 2018 requesting the recipient "update your files with my new address"; Stone identified the Subject Premises as his new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the Subject Premises as his shipping address. K. Computer Devices at the Subject Residence 65. and uses Based on law enforcement interviews, your affiant is aware that Stone has used cellular telephones, desktop, and laptop computers to conduct electronic communications. Stone also configures his computers to create regulars backups of his computers and maintains one of these devices at the Subject Premises, which preserves documents and communications. Stone also maintains a residence at York. New York, New 16 Page 31 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 43 of 53 66. In or around May 2018, the FBI interviewed an individual ("Person 2") who provided infonnation technology services to Stone. According to Person 2, Stone maintains at least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop computer at one point in time. Person 2 revealed billing receipts and invoices issued to Nydia Bertran-Stone for infonnation technology ("IT") services dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for IT services in connection with three different Apple computers. Specifically, the billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQ 17) configured with the name "Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number D25TC077GQ 17) configured with the name "Stone-Roger-iMac-NYC"; and (3) an Apple MacBookPro 10 (serial number C02KL05EFFT4) configured with the name "Stone-NydiaMBPR." According to publicly available infonnation, the iMac is one of Apple's desktop models (i.e., a computer designed to be stationary). The naming convention of the computer "Stone-Roger-iMac-FL" therefore suggests it is a stationary computer used by Stone and located at the Subject Premises. I7 According to the billing records, the computer was serviced on or about May 26,2018. 67. Person 2 also told law enforcement that Stone used the Apple Time Machine ("Time Machine") application to facilitate backups of his computers and that he believed Stone used Time Machine on computers in his residences. According to publicly available information, Time Machine is the built-in backup feature of Apple computers and can create copies of files on a computer, including applications, music, photos, email, documents, and system files. A Time Machine backup allows users to restore files from a specific point in time 17 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in the Subject Residence and conducts most of his work from the office when he is in Florida. Page 32 of42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 44 of 53 if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time Machine, a user connects an external storage device to the computer and selects that external storage device as the backup disk.18 68. Records produced by AT&T show that, since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone number (ending in ). According to AT&T, between approximately January 1, 2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI 310410930460769). On or about September 28, 2018, Stone's cellular telephone number was transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814). 69. Records produced by Uber Teclmologies, Inc., show that the account associated with Stone's telephone number and email address has the Uber application on multiple devices, including a device identified as iPhonell ,2, UDID - 668EDC66­ 29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier "iPhone 11,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns identified a device DE0840 1EOA 74. identified as iPhone9,4, UDID 7161 CF59-6Fl 0-41 C8-984B­ Publicly available information indicates that the identifier iPhone9,4 correlates to an Apple iPhone model iPhone 7 Plus. 70. Records obtained from a court-authorized pen register/trap & trace ("PRTT") monitoring of Stone's personal cellular telephone number 19 shows recent activity 18 When the external is plugged in, the Time Machine will automatically make hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. The oldest backups are deleted when the external storage device selected as the backup disk is full. The external device can be as small as a USB thumb drive. Page 33 of42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 45 of 53 indicating Stone continues to use the number and its associated device. For example, these records show that between January 1, 2019 and January 10, 2019, telephone number was used to make or receive over 150 telephone calls and send or receive over 750 text messages. Likewise, a court-authorized PRTT of Stone's WhatsApp account (which is registered to Stone's telephone number 20 showed the WhatsApp account was used to send or receive approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about January 1,2019 and January 10,2019. 71. Statements attributed to Stone in recent media articles also indicate that Stone retains computer devices that he no longer uses and keeps relevant electronic communications on those devices. In or around November 2018, media reports began to publish excerpts of text messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies of these text messages subsequently were obtained from Stone 21 According to these news articles, Stone released these messages to the media outlets, which Stone claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on these statements, your affiant believes the cellular telephone referenced in the article to be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he 19 Installation and use of PRTT devices for was authorized by the U.S. District Court for the District of Columbia on or about November 28, 2018. Case No.1: 18-pr-l72 (D.D.C. Nov. 28,2018). 20 Installation and use of PRTT devices for Stone's WhatsApp account was authorized by the U.S. District Court for the District of Columbia on or about December 11, 2018. Case No.1: 18­ pr-250 (D.D.C. Dec. 11,2018). See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks Backchannel," Daily Caller, Nov. 14, 2018, available at https:lldailycaller.coml20 18/11 I 14/roger-stone-wikileaks-randy-credico-mueller. 21 Page 34 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 46 of 53 stopped using on or about November 14, 2016)?2 Further, your affiant believes Stone maintains other devices he is no longer actively using. COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 72. As described above and in Attachment B, this application seeks permission to search for records that might be found in the Subject Premises, in whatever form they are found. One form in which the records might be found is data stored on a computer device's hard drive or other storage media. Thus, the warrant applied for would authorize the seizure of electronic storage media or, potentially, the copying of electronically stored information, all under Rule 41 (e )(2)(B). 73. Probable cause. I submit that if a computer or storage medium is found on the Subject Premises, there is probable cause to believe those records will be stored on that computer or storage medium, for at least the following reasons: a. Based on my knowledge, training, and experience, I know that computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic files downloaded to a storage medium can be stored for years at little or no cost. Even when files have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person "deletes" a file on a computer, the data contained in the file does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data. Stone produced some text messages between he and Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 2016. The govenunent believes copies of later-in-time text messages from late 2016 and early 2017 could be located on another device, such as the iPhone 7 described above, or on backup storage media. 22 Page 35 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 47 of 53 b. Therefore, deleted files, or remnants of deleted files, may reside in free space or slack space-that is, in space on the storage medium that is not currently being used by an active file-for long periods of time before they are overwritten. In addition, a computer's operating system may also keep a record of deleted data in a "swap" or "recovery" file. c. Wholly apart from user-generated files, computer storage media-in particular, computers' internal hard drives-contain electronic evidence of how a computer has been used, what it has been used for, and who has used it. To give a few examples, this forensic evidence can take the form of operating system configurations, artifacts from operating system or application operation, file system data structures, and virtual memory "swap" or paging files. Computer users typically do not erase or delete this evidence, because special software is typically required for that task. However, it is technically possible to delete this information. d. Similarly, files that have been viewed via the Internet are sometimes automatically downloaded into a temporary Internet directory or "cache." 74. Forensic evidence. As further described in Attaclunent B, this application seeks permission to locate not only computer files that might serve as direct evidence of the crimes described on the warrant, but also for forensic electronic evidence that establishes how computers were used, the purpose of their use, who used them, and when. There is probable cause to believe that this forensic electronic evidence will be on any storage medium in the Subject Premises because: Page 36 of 42 . , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 48 of 53 a. Data on the storage medium can provide evidence of a file that was once on the storage medium but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). Virtual memory paging systems can leave traces of information on the storage medium that show what tasks and processes were recently active. Web browsers, e-mail programs, and chat programs store configuration information on the storage mediwn that can reveal information such as online nicknames and passwords. Operating systems can record additional information, such as the attaclunent of peripherals, the attachment of USB flash storage devices or other external storage media, and the times the computer was in use. Computer file systems can record information about the dates files were created and the sequence in which they were created, although this information can later be falsified. b. As explained herein, information stored within a computer and other electronic storage media may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, information stored within a computer or storage media (e.g., registry information, communications, images and movies, transactional information, records of session times and durations, internet history, and anti-virus, spyware, and malware detection programs) can indicate who has used or controlled the computer or storage media. This "user attribution" evidence is analogous to the Page 37 of 42 I \ • Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 49 of 53 search for "indicia of occupancy" while executing a search warrant at a residence. The existence or absence of anti-virus, spyware, and mal ware detection programs may indicate whether the computer was remotely accessed, thus inculpating or exculpating the computer owner. Further, computer and storage media activity can indicate how and when the computer or storage media was accessed or used. For example, as described herein, computers typically contains information that log: computer user account session times and durations, computer activity associated with user accounts, electronic storage media that connected with the computer, and the IP addresses through which the computer accessed networks and the internet. Such information allows investigators to understand the chronological context of computer or electronic storage media access, use, and events relating to the crime under investigation. Additionally, some information stored within a computer or electronic storage media may provide crucial evidence relating to the physical location of other evidence and the suspect. For example, images stored on a computer may both show a particular location and have geolocation information incorporated into its file data. Such file data typically also contains information indicating when the file or image was created. The existence of such image files, along with external device connection logs, may also indicate the presence of additional electronic storage media (e.g., a digital camera or cellular phone with an incorporated camera). The geographic and timeline information described herein may either inculpate or exculpate the computer user. Last, information stored within a computer may provide relevant insight into the computer user's state of mind as it relates to the offense under Page 38 of 42 . r' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 50 of 53 investigation. For example, infonnation within the computer may indicate the owner's motive and intent to commit a crime (e.g., internet searches indicating criminal plaIll1ing), or consciousness of guilt (e.g., ruIll1ing a "wiping" program to destroy evidence on the computer or password protecting/encrypting such evidence in an effort to conceal it from law enforcement). c. A person with appropriate familiarity with how a computer works can, after examining this forensic evidence in its proper context, draw conclusions about how computers were used, the purpose of their use, who used them, and when. d. The process of identifying the exact files, blocks, registry entries, logs, or other fonns of forensic evidence on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. While it is possible to specify in advance the records to be sought, computer evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a computer is evidence may depend on other infonnation stored on the computer and the application of knowledge about how a computer behaves. Therefore, contextual infonnation necessary to understand other evidence also falls within the scope of the warrant. e. Further, in finding evidence of how a computer was used, the purpose of its use, who used it, and when, sometimes it is necessary to establish that a particular thing is not present on a storage medium. For example, the presence or absence of counter-forensic programs or anti-virus programs (and associated data) may be relevant to establishing the user's intent. Page 39 of42 • • r , I' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 51 of 53 75. Necessity ofseizing or copying entire computers or storage media. In most cases, a thorough search of a premises for information that might be stored on storage media often requires the seizure of the physical storage media and later off-site review consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes possible to make an image copy of storage media. Generally speaking, imaging is the taking of a complete electronic picture of the computer's data, including all hidden sectors and deleted files. Either seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded on the storage media, and to prevent the loss of the data either from accidental or intentional destruction. This is true because of the following: a. The time required for an examination. As noted above, not all evidence takes the form of documents and files that can be easily viewed on site. Analyzing evidence of how a computer has been used, what it has been used for, and who has used it requires considerable time, and taking that much time on premises could be unreasonable. As explained above, because the warrant calls for forensic electronic evidence, it is exceedingly likely that it will be necessary to thoroughly examine storage media to obtain evidence. Storage media can store a large volume of information. Reviewing that information for things described in the warrant can take weeks or months, depending on the volume of data stored, and would be impractical and invasive to attempt on-site. b. Technical requirements. Computers can be configured in several different ways, featuring a variety of different operating systems, application software, and configurations. Therefore, searching them sometimes requires tools or knowledge that might not be present on the search site. The vast array of computer hardware Page 40 of 42 Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 52 of 53 and software available makes it difficult to know before a search what tools or knowledge will be required to analyze the system and its data on the Premises. However, taking the storage media off-site and reviewing it in a controlled environment will allow its examination with the proper tools and knowledge. c. Variety of forms of electronic media. Records sought under this warrant could be stored in a variety of storage media formats that may require off-site reviewing with specialized forensic tools. 76. Nature of examination. Based on the foregoing, and consistent with Rule 41 (e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying storage media that reasonably appear to contain some or all of the evidence described in the warrant, and would authorize a later review of the media or information consistent with the warrant. The later review may require techniques, including but not limited to computer-assisted scans of the entire medium, that might expose many parts of a hard drive to human inspection in order to determine whether it is evidence described by the warrant. 77. Because multiple people share the Subject Premises as a residence, it is possible that the Subject Premises will contain storage media that are predominantly used, and perhaps owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is possible that the things described in this warrant could be found on any of those computers or storage media, the warrant applied for would permit the seizure and review of those items as well. FILTER REVIEW PROCEDURES Review of the items described in Attachment B will be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility Page 41 of 42 .. .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 53 of 53 requirements concerning the maintenance of attorney-client and other operative privileges. The procedures include use of a designated "filter team," separate and apart from the investigative team, in order to address potential privileges. SEALING ORDER REQUESTED 78. It is further respectfully requested that this Court issue an Order sealing, until further order of this Court, all papers submitted in support of this application, including the application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary because items and information to be seized are relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and related documents may have a negative impact on this continuing investigation and may jeopardize its effectiveness. CONCLUSION 79. Based on the foregoing, your affiant respectfully requests that this Court issue a search warrant for the Subject Premises, more particularly described in Attachment A, authorizing the seizure of the items described in Attachment B. Respectfl By submitted, v/I~ ') . ~~ Curtis A. Heide pecial Agent Federal Bureau of Investigation Sworn to and subscribed before me on this 1~~A-J_~~~_ ~ ;Zy day of January, 2019. J. ~ UNITED STATES MAGISTRATE JUDGE Page 42 of 42