Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 1 of 57 AO 93 (Rev. 12/09) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of Florida In the Matter of the Search of ) ) (Briefly describe the property to be searched or identifY the person by name and address) ) Case No. 19-6034-SNOW ) ) ) Oakland Park, Florida (further described in Attachment "A") SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of Florida (identifY the person or describe the property to be searched and give its location): Oakland Park, Florida (further described in Attachment "A") The person or property to be searched, described above, is believed to conceal (identifY the person or describe the property to be seized): See Attachment "8" I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before (not to exceed 14 days) ~ in the daytime 6:00 a.m. to 10 p.m. o at any time in the day or night as I find reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge Lurana S. Snow (name) o I find that immediate notification may have an adverse result listed in 18 U.S.c. § 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) 0 for days (not to exceed 30). o until, the facts justifying, the later specific date of Date and time issued: City and state: Fort Lauderdale, Florida I : :;).6 Lurana S. Snow, United States Magistrate Printed name and title Jud~ Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 2 of 57 ATTACHMENT A Oakland Park, Florida 33334. The Subject Premises is a commercial space with a glass front door and glass windows covered with a black fabric; a green awning bearing the letters "JVR" is above the door. A photograph of the exterior of the Subject Premises is attached below. Page 1 of1 - ., Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 3 of 57 ATTACHMENT B Property to be seized from the Subject Premises I. The items to be seized are fruits, evidence, information relating to, contraband, or instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, United States Code l512(b)(I) (witness tampering), those violations involving Roger Stone, for the time period June 2015 to the present, including: a. Documents and communications that discuss or are related to WikiLeaks, Julian Assange, and/or Russian interference in the 2016 U.S. presidential election; b. Documents reflecting communications between Stone and Jerome Corsi; c. Documents reflecting communications between Stone and Randy Credico; d. Documents reflecting communications between Stone and members of the Trump Campaign or Trump Campaign associates, including Steve Bannon, , Paul Manafort, Richard Gates, and Donald J. Trump; e. Documents related to or discussing the U.S . House of Representatives Permanent Select Committee on Intelligence, the Senate Select Committee on Intelligence, or the Federal Bureau of Investigation; f. Records and information relating to the e-mail accounts and ; g. Records and information relating to the WhatsApp account associated with telephone number ; h. Records and information relating to the Signal account associated with telephone number ; Page 1 of3 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 4 of 57 1. Records and infonnation relating to the Wickr account associated with telephone number ; J. Any computers, media storage devices, tablets/iPads, cellular telephones, smruiphones, personal data assistant devices, or other electronic devices used to commit the violations described above or to store records or documents described above; k. Records of personal and business activities relating to the operation and ownership of the computer systems, such as telephone records, notes, notebooks, diaries, and reference materials, in whatever fonn; I. Records pertaining to accounts held with Internet Service Providers or of Internet use, in whatever fonn; 2. For any computer or storage medium whose seizure is otherwise authorized by this warrant, and any computer or storage medium that contains or in which is stored records or information that is otherwise called for by this warrant (hereinafter, "COMPUTER"): a. evidence of who used, owned, or controlled the COMPUTER at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b. evidence of software that would allow others to control the COMPUTER, such as viruses, Trojan horses, and other fonns of malicious software, as well as evidence of the presence or absence of security software designed to detect malicious software; Page 2 of3 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 5 of 57 c. evidence of the lack of such malicious software; d. evidence indicating how and when the computer was accessed or used to determine the chronological context of computer access, use, and events relating to crime under investigation and to the computer user; e. evidence indicating the computer user's state of mind as it relates to the crime under investigation; f. evidence of the attachment to the COMPUTER of other storage devices or similar containers for electronic evidence; g. evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the COMPUTER; h. evidence of the times the COMPUTER was used; 1. passwords, encryption keys, and other access devices that may be necessary to access the COMPUTER; J. documentation and manuals that may be necessary to access the COMPUTER or to conduct a forensic examination of the COMPUTER; k. records of or information about Internet Protocol addresses used by the COMPUTER; I. records of or information about the COMPUTER's Internet activity, including firewall logs, caches, browser history and cookies, "bookrnarked" or "favorite" web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses; m. contextual information necessary to understand the evidence described in this attachment. Page 3 of3 , . . Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 6 of 57 AO 93 (ReI'. /2/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with: 19-6034-SNOW Inventory made in the presence of: Inventory ofthe property taken and name ofany person(s) seized: Certification I declare under penalty ofperjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. Date: Executing officer's signature Printed name and title Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 7 of 57 AO 106 (Rev 04110) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of Florida Jn the Matter of the Search of (Briefly describe the property to be searched or identify the person by name and address) Oakland Park. Florida in Attachment "A") (further described ) ) ) ) ) ) Case No. 19-6034-SNOW APPLICATION FOR A SEARCH WARRANT J, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that J have reason to bel ieve that on the following person or property (identify the person or describe the property to be searched and give its location): Oakland Park. Florida Southern located in the (further described in Attachment "A") District of person or describe the property /0 be seized): Florida , there is now concealed ------------------------ (identify the See Attachment "B" The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): ~ evidence of a crime; ~ contraband, fruits of crime, or other items illegally possessed; ~ property designed for use, intended for use, or used in committing a crime; o a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section 18 U.S.C. 1505 18U.S.C.1001 18 U.S.C. 1512(b)(1) Offense Description Obstruction of Proceeding False Statements Witness Tampering The application is based on these facts: See attached Affidavit. ri C ontinued on the attached sheet. o Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested under 18 U.S.c. § 31 03a, the basis of which is set forth on the a ached sheet. Curtis A. Heide, Special Agent, FBI Printed name and ti/le Sworn to before me and signed in my presence. Date rt it1 '-I City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge Printed name and /itle Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 8 of 57 ATTACHMENT A Oakland Park, Florida Page 1 of1 . Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 9 of 57 ATTACHMENT B Property to be seized from the Subject Premises 1. The items to be seized are fruits, evidence, information relating to, contraband, or instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for the time period June 2015 to the present, including: a. Documents and communications that discuss or are related to WikiLeaks, Julian Assange, and/or Russian interference in the 2016 U.S. presidential election; b. Documents reflecting communications between Stone and Jerome Corsi; c. Documents reflecting communications between Stone and Randy Credico; d. Documents reflecting communications between Stone and members of the Trump Campaign or Trump Campaign associates, including Steve Bannon, Paul Manafort, Richard Gates, and Donald J. Trump; e. Documents related to or discussing the U.S. House of Representatives Permanent Select Committee on Intelligence, the Senate Select Committee on Intelligence, or the Federal Bureau of Investigation; f. Records and information relating to the e-mail accounts and g. Records and information relating to the WhatsApp account associated with telephone number ; h. Records and information relating to the Signal account associated with telephone number ; Page 1 of3 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 10 of 57 I. Records and information relating to the Wickr account associated with telephone number ; J. Any computers, media storage devices, tabletsliPads, cellular telephones, smartphones, personal data assistant devices, or other electronic devices used to commit the violations described above or to store records or documents described above; k. Records of personal and business activities relating to the operation and ownership of the computer systems, such as telephone records, notes, notebooks, diaries, and reference materials, in whatever form; 1. Records pertaining to accounts held with Internet Service Providers or of Internet use, in whatever form; 2. For any computer or storage medium whose seizure is otherwise authorized by this warrant, and any computer or storage medium that contains or in which is stored records or information that is otherwise called for by this warrant (hereinafter, "COMPUTER"): a. evidence of who used, owned, or controlled the COMPUTER at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, configuration files, saved usernames and passwords, documents, browsing history, user profiles, email, email contacts, "chat," instant messaging logs, photographs, and correspondence; b. evidence of software that would allow others to control the COMPUTER, such as viruses, Trojan horses, and other forms of malicious software, as well as evidence of the presence or absence of security software designed to detect malicious software; Page 2 of3 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 11 of 57 c. evidence of the lack of such malicious software; d. evidence indicating how and when the computer was accessed or used to determine the chronological context of computer access, use, and events relating to crime under investigation and to the computer user; e. evidence indicating the computer user's state of mind as it relates to the crime under investigation; f. evidence of the attachment to the COMPUTER of other storage devices or similar containers for electronic evidence; g. evidence of counter-forensic programs (and associated data) that are designed to eliminate data from the COMPUTER; h. evidence of the times the COMPUTER was used; I. passwords, encryption keys, and other access devices that may be necessary to access the COMPUTER; J. documentation and manuals that may be necessary to access the COMPUTER or to conduct a forensic examination of the COMPUTER; k. records of or information about Internet Protocol addresses used by the COMPUTER; I. records of or information about the COMPUTER's Internet activity, including firewall logs, caches, browser history and cookies, "bookmarked" or "favorite" web pages, search terms that the user entered into any Internet search engine, and records of user-typed web addresses; m. contextual information necessary to understand the evidence described in this attachment. Page 3 of3 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 12 of 57 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: fNTRODUCTION AND AGENT BACKGROUND 1. I make this affidavit in support of an application for a search warrant for the premises known and described as Oakland Park, Florida described in the following paragraphs and further in Attachment A. 2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have been since 2006. In the course of my duties, I have been responsible for investigating federal crimes and national security matters involving both counterintelligence and issues related to cy bersecuri ty. 3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger Stone") and others known and unknown to the government, for the commission of unlawful activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(l) (collectively the "Specified Federal Offenses"). 4. I have personally participated in this investigation and am aware of the facts contained herein based on my own investigation, as well as my review of documents, records, and information provided to me by other law enforcement officers and technical experts. 5. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. Unless specifically indicated, all conversations and statements in this affidavit are related in substance Page 1 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 13 of 57 and part. Where I assert that an event took place on a particular date, I am asserting that it took place on or about the date specified. 6. I make this affidavit in support of an application for a warrant to search the premises located at , Oakland Park, Florida (the "Subject Premises," as is more particularly described in Attachment A), in connection with the Specified Federal Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and instrumentalities of the Specified Federal Offenses. 7. For the reasons set forth in this Affidavit, there is probable cause to believe that one or more of the Specified Federal Offenses have been committed by Roger Stone and others known and unknown to the government. Further, there is probable cause to believe the Subject Premises have been used to facilitate the commission of one or more of the Specified Federal Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and instrumentalities of violations of the Specified Federal Offense may be present in the Subject Premises. PROBABLE CAUSE A. Background on Relevant Individuals 8. Roger Stone is a political consultant who has worked for decades in U.S . politics and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently maintained regular contact with and publicly supported the Trump Campaign through the 2016 election. Page 2 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 14 of 57 9. Julian is the founder and director of WikiLeaks, which is publicly as a non-profit organization that disseminates non-public provided by sources. government. At and classified posted numerous relevant times, was located at the Embassy in London, United Kingdom. 10. is a political commentator who worked with an online media Jerome publication during 2016 presidential As set forth with Stone throughout the campaign, including about the Corsi spoke stolen documents by WikiLeaks. Based on investigation to Randy Credico was a radio host who has known Stone for more than a decade. In testimony before the U.S. Selection Credico on Intelligence Representatives 26, 201 on or about naming him) as an "intennediary," " and "mutual to Assange. In a follow-up letter to HPSCI dated October 13, 201 name and .~_ ....,...,_, had '" [e]mails 13. Richard along with Paul was the who confirmed for identified Stone" that to Hillary Clinton which are pending publication.'" citizen as a political From in or around June 2016 until November as the deputy campaign chainnan of the Trump Campaign. On February Page 3 of 46 and 16, Gates 2018, Gates Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 15 of 57 guilty to one count conspiracy against statements to federal law officers. 14. Steve the 2016 chief executive officer 16. States v. Gates, 1: 1 presidential election, served for years as a political consultant. served as the presidential campaign, campaign ("Clinton Campaign"). Hillary Clinton C',",,,.<>rr,h email that receiving within the email a security in or around May his assistant (who andpMl.pr~.r1 (a partial a subsequent an interview with account Based on my which an actor would emails and documents spearphishing context refers to to be from a or trusted sender in in a desired manner, typically by clicking a 4 Podesta indicated prompt to be this Podesta's email account, allowing the actor to stolen emails, had access to the account) clicked on a link when prompted been a successful spearphishing operation, chairman of the On or about March 24, 2016, to appear as a copy of the email was recovered by the described below). served as the Election is a U.S. citizen John t'O(leS'ra received a 1 (D.D.C.). Campaign. During the 2016 the 2016 making false is a U.S. citizen who serves as a political consultant. Beginning in or around August B. Hacking States and one count 46 aotJears to gained access to that account. Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 16 of 57 17. The Democratic National Committee ("DNC") and Democratic Congressional Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their computer systems had been compromised by unauthorized intrusions and hired the cybersecurity company CrowdStrike to investigate the intrusions and remediate. IS. On or about June 14, 2016, CrowdStrike issued a public press release announcing that the DNC's computer network had been compromised. In the public statement, CrowdS trike indicated that it had identified "two sophisticated adversaries on the network," which it referred to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously seen these actors target other customers and that, based on their experience, "[b]oth adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government's powerful and highly capable intelligence services." 19. On or about July 13, 201S, a federal grand jury sitting in the District of Columbia returned an indictment against eleven Russian nationals, charging them with partaking in a conspiracy to hack into, among other things, the email account of John Podesta, as well as the DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, I: lS-cr-21S (D.D.C.). The indictment alleges that all of these individuals were military officers serving in the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military intelligence agency. Page 5 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 17 of 57 C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign 20. As alleged in the Netyksho indictment, after successfully hacking the DNC and DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks." (GRU officers separately used these personas to release some of the stolen documents). 21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents stolen from the DNC network. These stolen documents included communications by senior DNC officials about campaign strategy, financial and fundraising data, and other documents related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 22. Beginning in or around October 2016, WikiLeaks began to release tens of thousands of emails and documents stolen from Podesta's email account. Between on or about October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. D. Stone's Communications About WikiLeaks During the Campaign 23. In April 2018 interviews with the Special Counsel's Office, Richard Gates stated that starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone informed members of the Trump Campaign that WikiLeaks had emails from then­ candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed WikiLeaks and Stone's prediction of the release. Page 6 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 18 of 57 24. According to Gates, Manafort directed Gates to contact Stone about any additional releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates contacted Stone, who made statements claiming that there would be potential future releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's Office in or around October 2018, Gates recalled that at one point during the campaign he was with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 25. Emails recovered through a court-authorized search of Stone's email account show that shortly after the July 22, 2016 release of stolen DNC emails by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to obtain other emails damaging to the Clinton Campaign: a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject line, "Get to Assange." The body of the message read, "Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation, allegedly." On or about the same day, Corsi forwarded Stone's email to , who lived in the United Kingdom and who was a supporter of the Trump Campaign. A search of was authorized on or about September II, 2017 by the U.S. District Court for the District of Columbia. Case No.1 :17-mj-661 CD.D.C. Sept. 11,2017). A second search of was authorized on or about August 3, 2018 by the U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 CD.D.C. Aug. 3, 2018). On or about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.c. § 2703Cd) for records connected to . Case No. 1:18-sc-2911 CD.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that the account was still active and that the relevant emails described in this affidavit were not deleted from the account. 2 Page 7 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 19 of 57 b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me MON." The body of the email read in part that "should see Assange." c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he was currently in Europe and planned to return in mid-August. Corsi stated, "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging." In a law enforcement interview, Corsi stated that the phrase "friend in embassy" referred to Assange. Corsi added in the same email, "Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke ­ neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle." 26. According to recorded public statements recovered by the FBI, starting in early August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated statements about information he claimed to have learned from Assange: a. According to a public video posted to YouTube, on or about August 8, 2016, Stone attended a public event in Broward County, Florida. During the event, Stone stated, "I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation, but there's no telling what the October surprise may be." b. According to a public video posted to YouTube, on or about August 12, 2016, Stone was interviewed for a video segment on the show InfoWars, hosted by Alex Page 8 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 20 of 57 Jones. During the interview, Stone stated that he was "in communication with Assange" but was "not at liberty to discuss what I have." c. According to a public video posted to YouTube, on or about August 16, 2016, Stone stated during another interview with Alex Jones that "it became known on this program that I have had some back-chatmel communications with WikiLeaks and Assange." In a second interview on or about the same day with Dana Loesch of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that they had a "mutual acquaintance who is a fine gentleman." d. According to a video posted to the public website of the TV station C-SPAN, during a C-SP AN television interview on or about August 18, 2016, Stone stated that he had communicated with Assange through an "intermediary, somebody who is a mutual friend." e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio interview he did with Stone on or about August 23, 2016 during which the two discussed Stone's prior claims to be in contact with Assange. At one point during the interview, Credico asked Stone, "You've been in touch indirectly with Assange. Can you give us any kind of insight? Is there an October surprise happening?" Stone responded, "Well, first of all, I don't want to intimate in any way that I control or have influence with Assange because I do not. ... We have a mutual friend, somebody we both trust and therefore I am a recipient of pretty good information." 27. In or around November 2018, , Stone produced a series of text messages between Stone and Credico during the 2016 presidential Page 9 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 21 of 57 campaign. 3 text on or about 19, WikiLeaks do. 6, Stone planned to recovered through a court-authorized search of Stone's email account show about WikiLeaks in or around a. or about written communications between and Credico 2016. Credico sent a text message to part, "I'm going to have Julian about August 21, part, "I have Julian b. On or about that read in on my show next Thursday." On or 16, Credico sent writing in text message to on Thursday so completely on that day." 2016, Assange was a on radio show for the first time. On or about August 26, 2016, Credico sent a text that stated, 'UU~.",",_ talk[ed] about you Assange said, to which Credico responded, about how is trying to " Stone replied and asked what we were didn't say it look like you and he are in cahoots." c. On or about August are working on a of the that said, "We 2016, Credico sent text messages to Assange was "in " and that he In a text sent later that Credico added, "Julian Assange has kryptonite on Hillary." d. On or about "I am e-mailing u a 18, 2016, Stone sent a text message to to pass on to " Credico As below, Stone had previously released some these text the media, who had written about and published them in part. 3 10 46 "''''''''''F>'''''' that said, "Ok," and to members of Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 22 of 57 added in a later text message, "Just remember do not name me as your connection to Assange you had one before that you referred to." e. Later on or about September 18, 2016, Stone emailed Credico an article with allegations against then-candidate Clinton related to her service as Secretary of State. Stone stated, "Please ask Assange for any State or HRC e-mail from August 10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the article] or confirm this narrative." f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my message ... to Assange." Credico responded, "I did." On or about September 20, 2016, Credico forwarded the request to a close friend who was an attorney with the ability to contact the Assange. Credico blind-copied Stone on the forwarded email. g. On or about September 30, 2016, Credico sent Stone via text message a photograph of Credico standing outside the Ecuadorian Embassy in London where Assange was located. h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text messages that stated, "big news Wednesday ... now pretend u don't know me ... Hillary's campaign will die this week." In the days preceding these messages, the press had reported that Assange planned to make a public announcement on or about Tuesday, October 4, 2016, which was reported to be the lO-year anniversary of the founding of WikiLeaks. Page 11 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 23 of 57 1. On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?" and a link to an article at the website http://heatst.com/politics/october­ surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement­ due-to-security-concerns. Credico responded to Stone, "head fake." J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did Assange back off." Credico initially responded, "I can't tal[k] about it." After further exchanges with Stone, Credico responded, "I think it[']s on for tomorrow." Credico added, "Off the Record Hillary and her people are doing a full-court press they [sic] keep Assange from making the next dump ... That's all I can tell you on this line ... Please leave my name out of it." 28. Emails and text messages recovered by the FBI show that, in or around October 2016, Stone made statements about Assange's future releases that were similar to prior statements made by Credico to him. For example: a. In a court-authorized search of Stone's email accountp FBI recovered an email from Stone to the sent on or about October 3, 2016, which stated in part, "Spoke to my friend in London last night. The payload is still coming." b. In a court-authorized search of , the FBI also recovered an email exchange from on or about October 3, 2016 between Stone and a reporter who had connections to Bannon. In the exchange, the reporter asked, "Assange ­ 4 A search of was authorized on or about October 17, 2017 by the U.S. District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A was authorized on or about August 3, 2018 by the U.S. second search of District Court for the District of Columbia. Case No.1: 18-sc-2583 (D.D.C. Aug. 3,2018). Page 12 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 24 of 57 what's he got? it's good," responded, I'd tell Bannon but he doesn't call me back." c. On or about 4,2016, held a conference but new materials pertaining to the Clinton Campaign. search , the FBI and Steve JJUl'HV an email Bannon .~~~...~_ responded, are going to do[wn]. However - a load Serious security London police are standing forward." week recovered text d. In a court-authorized search of Stone's iCloud account,S the on or about October 4, 201 and text confirmed that Whatsapp." In an - want to talk on a secure line Counsel's interview with the and Stone more material to In one if he had "hear[d] anymore from London." asked replied, press "What was that this morning???" s press conference. concern. He thinks In a court-authorized on or about October 4,2016 that occurred In referring to not release in or around May 2018, and that and told him WikiLeaks had material was related to people associated with Clinton. 29. or about 7, 201 WikiLeaks 1..""""";)""\..1 the first set Podesta. According to text messages recovered the r"'''ArC1<' the an associate Bannon sent a text message to stolen Stone's iCloud account, shortly after that read done." Similarly, iCloud account was authorized on or about March 14, 2018 by the U.S. District Columbia. Case 1: 18-sc-662 Mar. 1 18). The for Stone's iCloud account contained some, but not all, of Stone's communications period. Page 13 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 25 of 57 during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, Stone said, "I told you this was coming." E. Stone's Communications with the House Permanent Select Committee on Intelligence 30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating allegations of Russian interference in the 2016 presidential election and possible links to individuals associated with political campaigns. 6 During a public HPSCI hearing on or about March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public statements about having communications with Assange (particularly those from August 2016) were of interest to the committee. 31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was recovered by the FBI from a court-authorized search of Stone's email account ). The letter requested Stone produce: Any documents, records, electronically stored information including e-mail, communication, recordings, data and tangible things (including, but not limited to, graphs, charts, photographs, images and other documents) regardless of form, other than those widely available (e.g., newspaper articles) that reasonably could lead to the discovery of any facts within the investigation's publicly-announced parameters. 32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and stated that "Mr. Stone has no documents, records, or electronically stored information, regardless of form, other than those widely available that reasonably could lead to the discovery of any 6 On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee on Intelligence ("SSCI") announced the committee would conduct an inquiry that would investigate, among other things, any intelligence regarding links between Russia and individuals associated with political campaigns, as well as Russian cyber activity and other "active measures" directed against the United States in connection with the 2016 election. Page 14 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 26 of 57 facts within the investigation's publicly-arulOunced parameters." (A copy of the letter was recovered from a court-authorized search of Stone's email account ). F. Stone's Testimony Before HPSCI 33. On or about September 26, 2017, Stone provided HPSCI with an "opening statement" that his counsel requested be included as part of the record of proceedings before HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone stated, "These hearings are largely based on a yet unproven allegation that the Russian state is responsible for the hacking of the DNC and John Podesta and the transfer of that information to WikiLeaks." 34. Also on or about September 26, 2017, Stone provided testimony in a closed session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a copy of the transcript was obtained by the Special Counsel ' s Office from HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he would tell the truth. At the beginning of the hearing, Stone was admonished that "it is unlawful to deliberately provide false information to Members of Congress or staff' and that "providing false information to this committee or concealing material information from this committee is a crime punishable by law." Stone's Testimony About Documents He Possessed Related to WikiLeaks 35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document request and whether Stone had any documents or written communications that 7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of Stone's interview with HPSCI, as well as any written submissions and/or correspondence from Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 interview of Roger Stone, a copy of Stone's written opening statement, and various correspondence from Stone's counsel to members of HPSCI. Page 15 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 27 of 57 discussed Julian Assange, Russian interference, or other relevant documents: Q: The committee wrote to you on May 9th requesting no later than May 22 any documents, records, electronically stored information, including email communication, recordings, data, and other tangible things relevant to our investigation. You wrote back through counsel that you had no documents, records, or electronically stored information regardless of form responsive to our requests. Was that a false statement? A: That is not a false statement. That's what -- I believe that to be true. [ ... ] 36. Q: So you have no emails to anyone concerning the allegations of hacked documents or your conversations with the Guccifer 2[.0] or any discussions you have had with third parties about Julian Assange? You have no emails, no texts, no documents whatsoever, any kind of that nature? A: That is correct. Not to my knowledge. I think we met, again, the precise criteria of your request, and we complied. Again, if you have a more specific request, I'm happy to go back and look .... Q: I just want to ask you under oath- A: We did an extensive search consistent with the direction of my attorneys, and we found nothing that met the criteria that you asked for. Q: I just want to be certain because you are under oath, where your letter was not under oath, that you have no documents, no emails, no texts, no tweets that refer to Julian Assange or Guccifer 2[.0] or Paul Manafort or the allegations concerning Russian connections with the campaign. You have had no discussions in any written form. You've written no documents yourself. A: In connection with Russian collusion, consistent with your exact and precise request, yes. In fact, and as described above, Stone had sent and received numerous emails and text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and Page 16 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 28 of 57 WikiLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts and his iCloud account show that, at the time of his testimony, Stone was still in possession of many of these emails and text messages at the time he testified on or about September 22, 2017. 8 These written communications included (a) Stone's email to Corsi on or about July 25, 2016 that read in part, "Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails . .. they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that "should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated in part, "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a load every week going forward." Stone's Testimony About His Early August 2016 Statements 37. During his HPSCI testimony on or about September 26,2017, Stone was asked to explain his statements in early August 2016 about being in contact with Assange. Stone was specifically asked about his statement on or about August 8, 2016 that "I've actually The warrant for Stone's email account was obtained on or about September 11, 2017 and executed shortly thereafter. Records provided in or around September 2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account was active and the emails in question were not deleted from the account. The warrant for Stone's email account was obtained on or about October 17,2017 and executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text messages described above) was obtained on or about March 14, 2018 and executed shortly thereafter. 8 Page 17 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 29 of 57 communicated with Assange," as well as his statement on or about August 12, 2016 that he was "in communication with Assange" but was "not at liberty to discuss what I have." 38. Stone testified that these public references to having a means of contacting WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "gobetween, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the name of this "intermediary," but he provided a description in his testimony that was largely consistent with Credico. (On or about October 13,2017, Stone caused a letter to be submitted to HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that Assange had '" [e]mails related to Hillary Clinton which are pending pUblication. "'). 39. In fact, documents recovered during the investigation (including those obtained ) show that Stone did not begin via search warrant returns communicating with Credico about Assange or WikiLeaks until on or about August 19,2016 9­ approximately eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated with Assange" and a week after his August 12, 2016 statements of being "in communication with Assange" and "not at liberty to discuss what I have." 40. When interviewed by the FBI, Credico stated that the first time he ever spoke with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico also provided the FBI with partially redacted emails that he claimed were between he and another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the As described above, on or about August 19, 2016, Credico informed Stone by text message that Credico intended to interview Assange the following week. On or about August 25, 2016, Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted Stone that "Assange has kryptonite on Hillary." 9 Credico was first interviewed by the FBI in or around August 2018. He has subsequently participated in multiple voluntary interviews. 10 Page 18 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 30 of 57 technical logistics for the interview later that day. During the exchange, Credico offered biographical information about himself, apparently as a means of introduction. 41. The FBI has not identified any communications between Stone and Credico from August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks. 42. In contrast, and as described above, the FBI has identified written communications prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [aJt Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation, allegedly." Similarly, on or about August 2, 2016, Corsi-not Credico-sent an email to Stone in which Corsi wrote that "[w Jord is friend in embassy plans 2 more dumps," including one in October. These communications occurred days before Stone's first public statement on or about August 8, 2016 claiming to be in communication with Assange. However, at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other source for information from WikiLeaks. Similarly, Stone also never disclosed his written communications with Corsi to HPSCI when answering HPSCI's questioning about the August 8, 2016 and August 12, 2016 statements about being in communication with Assange. Stone's Testimony About Communications to Assange 43. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary J to communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked, Page 19 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 31 of 57 "Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did not." 44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass on a request to Assange for documents that Stone believed would be damaging to the Clinton Campaign. a. According to text messages , on or about September 18, 2016, Stone sent a text message to Credico that said, "I am e­ mailing u a request to pass on to Assange." On or about the same day, Stone emailed Credico an article with allegations against then-candidate Clinton related to her service as Secretary of State. Stone added, "Please ask Assange for any State or HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that mention [the subject of the article] or confirm this narrative." (A copy of this email was obtained through a search of Stone's email account ). b. According to text messages , on or about September 19, 2016, Stone texted Credico again, writing "Pass my message ... to Assange." Credico responded, "I did." An email obtained from the account shows that on or about September 20, 2016, Credico forwarded the request to an attorney who had the ability to contact Assange; Credico blind copied Stone on the same email. Stone's Testimony About Written Communications with Credico 45. During his HPSCI testimony, Stone was asked repeatedly about his communications with the person he identified as his intermediary. Stone stated that he had never Page 20 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 32 of 57 communicated with his intermediary in writing in any way. During one exchange, Stone claimed only to have spoken with the intermediary telephonically: Q: [H]ow did you communicate the intermediary? A: Over the phone. Q: And did you have any other means of communicating with the intermediary? A: No. Q: No text messages, no - none of the list, right? A: No. Later during his testimony, Stone again denied ever communicating with his intermediary in writing: 46. Q: So you never communicated with your intermediary writing in any way? A: No. Q: Never emailed him or texted him? A: He's not an email guy. Q: So all your conversations with him were in person or over the phone. A: Correct. In As described above, Stone and Credico (whom Stone identified as his intermediary) engaged in frequent written communication by email and text message. Beginning on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico engaged in dozens of communications by email or text message in which they discussed WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton Campaign. Page 21 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 33 of 57 47. Written communications between Stone and Credico continued up until Stone's HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that Stone testified before HPSCI and denied having ever sent or received emails or text messages from his identified intermediary-Stone and Credico exchanged over thirty text messages. 48. Certain of the electronic messages between Stone and Credico (which Stone denied ever taking place or possessing) would have been material to HPSCI, including Stone's messages in or around September 2016 directing Credico to pass a request for documents to Assange, and other relevant written communications with Credico. For example, on or about January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together timelines[] and you [] said you have a back-channel way back a month before I had Assange on my show ... I have never had a conversation with Julian Assange other than my radio show ... I have pieced it all together ... so you may as well tell the truth that you had no back-channel or there's the guy you were talking about early August." (A copy of this email was obtained through a search of Stone's email account ). Stone's Testimonv About Communications with the Trump Campaign 49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your conversations with the intermediary with anyone involved in the Trump campaign?" Stone answered, "I did not." As described above, Stone spoke to multiple individuals involved in the Trump campaign about what he claimed to have learned from his intermediary to Assange, including the following: Page 22 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 34 of 57 a. As described above, Gates confirmed to investigators that Stone spoke with senior Trump Campaign officials by telephone to inform them about materials possessed by Assange and the timing of future releases. b. According to text messages October 3, 2016, Stone wrote to , on or about , "Spoke to my friend in London last night. The payload is still coming." c. As described above, on or about October 4, 2016, after receiving information from Credico about the delay in WikiLeaks's release of stolen materials, Stone emailed Bannon that Assange had a "[s]erious security concern" but would release "a load every week going forward." G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI 50. According to an email recovered through a court-authorized search of Stone's email accountp . on or about October 19, 2017, Stone sent Credico an excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to HPSCI. 51. In or around November 2017, Credico received a request from HPSCI to testify voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted repeatedly with Stone. Page 23 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 35 of 57 a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the plan' .. . Richard Nixon." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). On or about November 20, 2017, Credico informed HPSCI that he declined HPSCl's request for a voluntary interview. b. On or about November 21, 2017, Credico texted Stone, "1 was told that the house committee lawyer told my lawyer that I will be getting a subpoena." Stone responded, "That was the point at which your lawyers should have told them you would assert your 5th Amendment rights if compelled to appear." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). c. On or about November 28, 2017, Credico received a subpoena compelling his testimony before HPSCI. Credico informed Stone of the subpoena. d. According to emails recovered from Stone's email account , on or about November 30, 2017, Stone asked Corsi to write publicly about Credico. Corsi responded, "Are you sure you want to make something out of this now? Why not wait to see what [Credico] does? You may be defending yourself too much - raising new questions that will fuel new inquiries. This may be a time to say less, not more." Stone responded by telling Corsi that Credico "will take the 5th-but let's hold a day." Page 24 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 36 of 57 e. According to text messages recovered from Stone's iCloud account, on multiple occasions, starting on or about November 17, 2017, Stone and Credico discussed Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part II, who falsely claims not to know critical information before a congressional committee that he does in fact know. On or about December 1, 2017, Stone told Credico in a text message to "Start practicing your Pentagele." When interviewed by the FBI, Credico confirmed that he understood Stone's references to Frank Pentangeli to be Stone's way of suggesting Credico withhold relevant information from investigators. f. On or about December 1, 2017, Stone texted Credico, "And if you turned over anything to the FBI you're a fool." Later that day, Credico texted Stone, "You need to amend your testimony before I testify on the 15th." Stone responded, "If you testify you're a fool. Because of tromp I could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee you you are the one who gets indicted for perjury if you're stupid enough to testify." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). 52. On or about December 12, 2017, Credico informed HPSCI that he intended to assert his Fifth Amendment privilege against self-incrimination if required to appear by sUbpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing evidence that would show Stone's previous testimony to Congress was false. 53. Following Credico's invocation of his Fifth Amendment privilege not to testify before HPSCI, Stone and Credico continued to have discussions about the various investigations Page 25 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 37 of 57 into Russian interference in the 2016 election and what infonnation Credico would provide to investigators. During these conversations, Stone repeatedly made aggressive statements intended to prevent Credico from cooperating with the investigations. For example: a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi ... there was no back channel ... be honest." Stone replied approximately two minutes later, "I'm not talking to the FBI and if your smart you won't either." (A copy of these text messages was recovered through a court-authorized search of Stone's iCloud account). b. On or about April 9,2018, Stone wrote in an email to Credico, "You are a rat. You are a stoolie. You backstab your friends-run your mouth my lawyers are dying Rip you to shreds." Stone also said he would "take that dog away from you," referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email exchange was recovered through a court-authorized search of Stone's email account ). c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have just been honest with the house Intel committee ... you've opened yourself up to perjury charges like an idiot." Stone responded, "You are so full of [expletive]. You got nothing. Keep running your mouth and I'll file a bar complaint against your friend [the attorney who had the ability to contact the head of Assange]." (A copy of this email exchange was recovered through a court-authorized search of Stone's email account ). Credico believed Stone knew Page 26 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 38 of 57 that Credico was sensitive to having this friend's name publicly disclosed. H. Missing Electronic Communications and Stone's Use of Encrypted Communications 54. As described above, the government has recovered the content of many of Stone's electronic communications from summer and fall of 2016 (during the period of the U.S. presidential election) and afterward (during the period of pending congressional investigations into Russian interference in the U.S. election). However, the government is aware of the existence of numerous other relevant electronic communications, the content of which it has not yet been able to recover. 55. As described above, during his HPSCI testimony, Stone falsely denied having emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy Credico). In fact, emails and text messages recovered in this investigation show the two communicated frequently by email and text messages; court-authorized searches of Stone's email and iCloud accounts confirm that Stone still had those communications at the time he testified in or around September 2017. In numerous communications, Stone and Credico discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone never disclosed them. 56. In addition to these emails and text messages in the FBI's possession, the FBI has reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017, and they show text message communications whose content that the government to date has not been able to obtain. For example, these records indicate that Stone and Credico alone exchanged thousands of text messages (including over 1,500 text messages between the period November 2016 and December 2017) the substance of which the government to date has not recovered or Page 27 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 39 of 57 reviewed. The government has only recently obtained text messages between Stone and Credico during some period of the campaign in 2016 from Stone's subpoena production, issued after media reports in November 2018 stated that Stone's attorneys were able to extract text messages between Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, for the same time period, many of Stone's other text messages. The government seeks these text messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to corruptly persuade Credico not to cooperate with pending investigations. 57. Additionally, the FBI has interviewed mUltiple associates of Stone, who confirmed that Stone has used encrypted applications to communicate with others. Similarly, records obtained in this investigation indicate Stone uses multiple applications designed for encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d) II According to open sources, WhatsApp is an application that allows the user to send text messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and stores its messages separately from those text messages used on a mobile device's default message application. 12 According to open sources, Signal is an encrypted communications application allowing the user to send one-to-one and group messages, which can include files, voice notes, images and videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as identifiers, and uses end-to-end encryption to secure all communications to other Signal users. Signal also allows users to set timers to messages, after which the messages will be deleted from both the sender's and the receivers' devices. According to open sources, Wickr is an instant messaging application that allows users to exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows users to set an expiration time for their encrypted communications. In addition to encrypting user data and conversations, Wickr claims that its application strips metadata from all content transmitted through the network. 13 Page 28 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 40 of 57 ProtonMail. 14 To date, the FBI has not obtained any of Stone's communications conducted through these applications. a. According to records from Stone's iCloud account, a copy of the WhatsApp application was downloaded to an iPhone registered to Stone on or about October 5,2016. As described above, on or about October 4,2016, Stone suggested in an email to that they "talk on a secure line" and proposed using WhatsApp. b. According to records from Stone's iCloud account, a copy of the Signal application was downloaded to an iPhone registered to Stone on or about August 18,2016. Additionally, text messages recovered from Stone's iCloud account revealed that on or about November 15, 2016, Stone sent an attorney with the ability to contact Julian Assange a link to download the Signal application. IS Approximately fifteen minutes after sending the link, Stone texted the attorney, "I'm on signal just dial my number." The attorney responded, "I'll call you." c. According to records from Stone's iCloud account, a copy of the ProtonMail application was downloaded to an iPad registered to Stone on or about August 18, 2016. 14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-side encryption to protect email contents and user data before they are sent to ProtonMail servers. According to its website, ProtonMail is run by Proton Technologies AG, a company based in the Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and EU jurisdiction. This attorney was a close friend of Credico's and was the same friend Credico em ailed on or about September 20, 2016 to pass along Stone's request to Assange for emails connected to the allegations against then-candidate Clinton related to her service as Secretary of State. IS Page 29 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 41 of 57 d. According to records from Stone's iCloud account, a copy of the Wickr application was downloaded to an iPhone to Stone on or about August 201 58. Based on training electronic applications such as WhatsApp, using encrypted ProtonMail, and Wickr are sometimes maintained on the used to send and receive communications. Communications from applications can be obtained by law enforcement by searching the device either manually or via a data extraction device (such as Cellebrite). including text messages Wickr, messages, up to cloud accounts (such as an iCloud account). of the downloaded application can reveal to seek The evidence logs and contact lists. encrypted communications, such as communications and contacts 1...,.""1",, of during the period of the 2016 U.S. presidential and through the The communications may contain evidence of additional communications concerning believes "",,,,11""''-', physical device can messages exchanged over WhatsApp, Signal, ProtonMail, that have not been Additionally, of of WikiLeaks, and the documents damaging to the Clinton Campaign. Such communications could constitute additional evidence of Stone's HPSCI's investigation showing additional contacts and communications to obstruct and WikiLeaks that Stone failed to disclose. I. Other Relevant Records 60. On or about May 8, 2018, a law was conducted. interview of was an employee of Stone's from approximately June 2016 through approximately December 16 and resided 30 Stone's New York apartment for Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 42 of 57 a period of time. trained to do so. provided infonnation technology support for Stone but was not fonnally was aware that Stone communicated with Trump during the 2016 presidential campaign, and afterward, both in person and by telephone. provided infonnation about a meeting at Trump Tower between Trump and Stone during the time worked for him, to which Stone carried a "file booklet" with him. booklet was important and that no one should touch it. Stone told the file also said Stone maintained the file booklet in his closet. 61. On or about December 3,2018, law enforcement conducted an interview of an individual ("Person 2") who previously had a professional relationship with a reporter who provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or around January and February 2016, Stone and Trump were in constant communication and that Stone kept contemporaneous notes of the conversations. Stone's purpose in keeping notes was to later provide a "post mortem of what went wrong." J. The Subject Premises 62. Your affiant is aware through the investigation that Stone maintains the Subject Premises as his personal office and has done so since at least the 2016 Campaign. Public reporting indicates that Stone occupied SUbject Premises as his office during the 2016 Campaign. 16 An April 17,2017 news article also described Stone's "personal office" at a location matching the description of the Subject Premises. 17 16 See Roger Stone.' Inside The World Of A Political Hitman, CBS Miami, April 17, 2016, available at https:llmiami.cbslocal.comJ20 16/04117lroger-stone-inside-the-world-of-a-political­ hitmanl ("CBS4's Jim DeFede has known Stone for years and visited him recently at his office in a nondescript building in an industrial section of Oakland Park that houses his collection of Nixon memorabilia."). 17 See Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself, Washington Post, April 19, 2017, available at https:llwww.washingtonpost.comJlifestyle/style/ Page 31 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 43 of 57 to 63. iCloud recovered above), court-authorized search on or about 31, 2014 lease for your signature," (The recovered contained no further content). sent another individual address of Subject On or about November 27, 2017, Stone address of the Subject Premises while arranging a meeting. 64. text Premises as with the show that has repeatedly identified the office. a. On or "to March 30, 201 Stone directed another individual to send a reporter , Stone ..",<,,,,,,,,,,1'1,:.1'1 office." When the other individual asked " which corresponds to the address of the in "Oakland Premises. with an individual who b. On or about April 8,2017, Stone exchanged " a freelance photographer as identified Washington In the exchange, the photographer wrote he "would like to photograph you morning ... April 11 if that is convenient." Stone responded, first thing "Yes - let me figure out your " The photographer then wrote that "[t]he that would a good location which is me." replied, ofthe Subject Premises. roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth ("The and broadcast studio calls for locating a "door next part of the directions to his personal marked ' " which helpful, the crucial that there is no "A" at the new next to a supplies There is, discreetly shorts, a blacked-out door with no markings, and the man who emerges behind it, loafers with no socks, a loosened tie and an untucked dress shirt, is unmistakably "). Page 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 44 of 57 In text from Stone's Premises as a "warehouse." or about July 25, "Warehouse has very high cable if u want to use ' refers to the Subject 15, wrote another individual, office. '" November 10,2017, Stone wrote an individual, "U don't need an our warehouse avail 66. On or about speed [inter] net at " On or about May 18, 2018, investigators interviewed an individual ("Person 1") described himself as m summer 1 stated that as of May 2018, he worked at hours a week for Stone. Communications recovered from Stone's account communicated with Campaign and afterwards through May 18. Those communications included matters related to the 2016 Campaign and 67. Person 1 told home in Florida or at that Stone 68. During 2019, the FBI observed individuals believed to host a button-down shirt and tie) duration of the media presence. that as of May 2018, he Fort Lauderdale (the out of Stone's ....p ..,"£'on 1 further in the Subject on or about January 17, of the Subject enter the Subject Premises. Stone was accompanied by two The following photographs Subject Premises was taken on 33 of 46 (wearing a light Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 45 of 57 K. Computer Devices at the Subject Premises 69. and uses Based on law enforcement interviews, your affiant is aware that Stone has used cellular telephones, desktop, and laptop computers to conduct electronic communications. Stone also configures his computers to create regulars backups. 70. As described above, in text messages recovered from Stone's iCloud account, Stone indicated the Subject Premises has high-speed internet service (referred to as having "very high speed cable" and "high speed net"). 71. As described above, on or about April 8, 2017, Stone and a photographer hired by the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order Page 34 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 46 of 57 for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post published a lengthy article about Stone that featured the following two photographs 18: "Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself," Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.comllifestyle/style/ roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worthl2017/ 041l81l518184e-236f-lle7-b503-9d616bd5a305 _story.html?utm_term=. 7576648d5cel. 18 Page 35 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 47 of 57 Both photographs were credited to the photographer with the first name " ," and the caption of the latter photograph read in part, "Stone in his memorabilia-overrun office." The photographs depict, among other things, multiple computer accessories, including a monitor, microphone, and printer. 72. In addition, messages recovered from the court-authorized search of Stone's iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from his office, further indicating he likely has a computer present there. 19 For example, on or about December 13, 2017, Stone coordinated an upcoming interview with another individual by text message. Stone confirmed the interview, writing that he would participate via "Skype from our Florida studio with green screen." 73. In or around May 2018, as discussed above, the FBI interviewed Person 1, who worked for Stone. Person 1 told the FBI that Stone maintained a computer at the Subject Premises. 74. In or around May 2018, the FBI interviewed an individual (Person 2) who provided information technology services to Stone. Person 2 stated that Stone used the Apple Time Machine ("Time Machine") application to facilitate backups of his computers. According to publicly available information, Time Machine is the built-in backup feature of Apple computers and can create copies of files on a computer, including applications, music, photos, email,documents, and system files. A Time Machine backup allows users to restore files from a specific point in time if the original files are ever deleted, or if the hard drive is erased or According to publicly available information, Skype is a telecommunications application software that specializes in providing video chat and voice calls between computers, tablets, mobile devices, and similar devices via the internet. 19 Page 36 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 48 of 57 replaced. In order to create backups with Time Machine, a user connects an external storage device to the computer and selects that external storage device as the backup disk,zo 75. show that, Records produced by AT&T since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone number (ending in . According to AT&T, between approximately January 1, 2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI On or about September 28, 2018, Stone's cellular telephone number was 310410930460769). transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814). 76. Records produced by Uber Technologies, Inc., show that the account associated with Stone's telephone number and email address has the Uber application on multiple devices, including a device identified as iPhone11,2, UDID - 668EDC66­ 29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier "iPhonel1,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns identified a device DE08401 EDA 74. identified as iPhone9,4, UDID - 7161 CF59-6Fl 0-41 C8-984B­ Publicly available information indicates that the identifier iPhone9,4 correlates to an Apple iPhone model iPhone 7 Plus. 77. Records obtained from a court-authorized pen register/trap & trace ("PRTT") monitoring of Stone's personal cellular telephone number 21 shows recent activity 20 When the external is plugged in, the Time Machine will automatically make hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. The oldest backups are deleted when the external storage device selected as the backup disk is full. The external device can be as small as a USB thumb drive. Page 37 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 49 of 57 indicating Stone continues to use the number and its associated device. records show that between January 1, 19 to make or receive over 150 Likewise, a court-authorized number 2 13 WhatsApp For January 10, 2019, telephone number calls and send or receive over was text WhatsApp account (which is WhatsApp account was two WhatsApp voice calls to or on or January 1,2019 and January 10,2019. 78. Statements attributed to in recent media articles also indicate that retains computer devices that he no longer uses and keeps relevant electronic communications on those devices. In or around November messages between Stone and Randy 18, media reports began to publish excerpts that occurred during the 2016 U.S. messages to the According to these news "a cell phone he stopped using in were 23 to AT &T records (which records indicate 21 Installation and use of PRTT District of Columbia on or about 2018). Installation and use of PRTT devices District Court for the District (D.D.C. Dec. 11,2018). 16." the cellular telephone referenced in the iPhone 5s documented 22 23 from Stone text messages subsequently were on these statements, your text was authorized by the U.S. District Court 18. Case No.1: 18-pr-l WhatsApp account was authorized on or about December 11, 2018. e.g., "Bombshell Stone's Claims About Backchannel," Daily 14, 2018, available https:lldailycaller.coml20 18/11 114/roger-stone-wikileaks-randy-credico-mueller. 38 at Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 50 of 57 stopped using on or about November 14, 2016).24 Further, your affiant believes Stone maintains other devices he is no longer actively using. COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 79. As described above and in Attachment B, this application seeks permission to search for records that might be found in the Subject Premises, in whatever form they are found. One form in which the records might be found is data stored on a computer device's hard drive or other storage media. Thus, the warrant applied for would authorize the seizure of electronic storage media or, potentially, the copying of electronically stored information, all under Rule 41 (e)(2)(B). 80. Probable cause. I submit that if a computer or storage medium is found on the Subject Premises, there is probable cause to believe those records will be stored on that computer or storage medium, for at least the following reasons: a. Based on my knowledge, training, and experience, I know that computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic files downloaded to a storage mediwn can be stored for years at little or no cost. Even when files have been deleted, they can be recovered months or years later using forensic tools. This is so because when a person "deletes" a file on a computer, the data contained in the file does not actually disappear; rather, that data remains on the storage medium until it is overwritten by new data. 24 , Stone produced some text messages between he and Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 2016. The government believes copies of later-in-time text messages from late 2016 and early 2017 could be located on another device, such as the iPhone 7 described above, or on backup storage media. Page 39 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 51 of 57 b. Therefore, deleted files, or remnants of deleted files, may reside in free space or slack space-that is, in space on the storage medium that is not currently being used by an active file-for long periods of time before they are overwritten. In addition, a computer's operating system may also keep a record of deleted data in a "swap" or "recovery" file. c. Wholly apart from user-generated files, computer storage media-in particular, computers' internal hard drives-contain electronic evidence of how a computer has been used, what it has been used for, and who has used it. To give a few examples, this forensic evidence can take the form of operating system configurations, artifacts from operating system or application operation, file system data structures, and virtual memory "swap" or paging files. Computer users typically do not erase or delete this evidence, because special software is typically required for that task. However, it is technically possible to delete this information. d. Similarly, files that have been viewed via the Internet are sometimes automatically downloaded into a temporary Internet directory or "cache." 81. Forensic evidence. As further described in Attaclunent B, this application seeks permission to locate not only computer files that might serve as direct evidence of the crimes described on the warrant, but also for forensic electronic evidence that establishes how computers were used, the purpose of their use, who used them, and when. There is probable cause to believe that this forensic electronic evidence will be on any storage medium in the Subject Premises because: Page 40 of46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 52 of 57 a. Data on the storage medium can provide evidence of a file that was once on the storage medium but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). Virtual memory paging systems can leave traces of information on the storage medium that show what tasks and processes were recently active. Web browsers, e-mail programs, and chat programs store configuration information on the storage medium that can reveal information such as online nicknames and passwords. Operating systems can record additional information, such as the attachment of peripherals, the attachment of USB flash storage devices or other external storage media, and the times the computer was in use. Computer file systems can record information about the dates files were created and the sequence in which they were created, although this information can later be falsified. b. As explained herein, information stored within a computer and other electronic storage media may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, information stored within a computer or storage media (e.g., registry information, communications, images and movies, transactional information, records of session times and durations, internet history, and anti-virus, spyware, and malware detection programs) can indicate who has used or controlled the computer or storage media. This "user attribution" evidence is analogous to the Page 41 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 53 of 57 search for "indicia of occupancy" while executing a search warrant at a residence. The existence or absence of anti-virus, spyware, and malware detection programs may indicate whether the computer was remotely accessed, thus inculpating or exculpating the computer owner. Further, computer and storage media activity can indicate how and when the computer or storage media was accessed or used. For example, as described herein, computers typically contains information that log: computer user account session times and durations, computer activity associated with user accounts, electronic storage media that connected with the computer, and the IP addresses through which the computer accessed networks and the internet. Such information allows investigators to understand the chronological context of computer or electronic storage media access, use, and events relating to the crime under investigation. Additionally, some information stored within a computer or electronic storage media may provide crucial evidence relating to the physical location of other evidence and the suspect. For example, images stored on a computer may both show a particular location and have geolocation information incorporated into its file data. Such file data typically also contains information indicating when the file or image was created. The existence of such image files, along with external device connection logs, may also indicate the presence of additional electronic storage media (e.g., a digital camera or cellular phone with an incorporated camera). The geographic and timeline information described herein may either inculpate or exculpate the computer user. Last, information stored within a computer may provide relevant insight into the computer user's state of mind as it relates to the offense under Page 42 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 54 of 57 investigation. For example, information within the computer may indicate the owner's motive and intent to commit a crime (e.g., internet searches indicating criminal planning), or consciousness of guilt (e.g., running a "wiping" program to destroy evidence on the computer or password protecting/encrypting such evidence in an effort to conceal it from law enforcement). c. A person with appropriate familiarity with how a computer works can, after examining this forensic evidence in its proper context, draw conclusions about how computers were used, the purpose of their use, who used them, and when. d. The process of identifying the exact files, blocks, registry entries, logs, or other forms of forensic evidence on a storage medium that are necessary to draw an accurate conclusion is a dynamic process. While it is possible to specify in advance the records to be sought, computer evidence is not always data that can be merely reviewed by a review team and passed along to investigators. Whether data stored on a computer is evidence may depend on other information stored on the computer and the application of knowledge about how a computer behaves. Therefore, contextual information necessary to understand other evidence also falls within the scope of the warrant. e. Further, in finding evidence of how a computer was used, the purpose of its use, who used it, and when, sometimes it is necessary to establish that a particular thing is not present on a storage medium. For example, the presence or absence of counter-forensic programs or anti-virus programs (and associated data) may be relevant to establishing the user's intent. Page 43 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 55 of 57 82. Necessity ofseizing or copying entire computers or storage media. In most cases, a thorough search of a premises for information that might be stored on storage media often requires the seizure of the physical storage media and later off-site review consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes possible to make an image copy of storage media. Generally speaking, imaging is the taking of a complete electronic picture of the computer's data, including all hidden sectors and deleted files. Either seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded on the storage media, and to prevent the loss of the data either from accidental or intentional destruction. This is true because of the following: a. The time required for an examination. As noted above, not all evidence takes the form of documents and files that can be easily viewed on site. Analyzing evidence of how a computer has been used, what it has been used for, and who has used it requires considerable time, and taking that much time on premises could be unreasonable. As explained above, because the warrant calls for forensic electronic evidence, it is exceedingly likely that it will be necessary to thoroughly examine storage media to obtain evidence. Storage media can store a large volume of information. Reviewing that information for things described in the warrant can take weeks or months, depending on the volume of data stored, and would be impractical and invasive to attempt on-site. b. Technical requirements. Computers can be configured in several different ways, featuring a variety of different operating systems, application software, and configurations. Therefore, searching them sometimes requires tools or knowledge that might not be present on the search site. The vast array of computer hardware Page 44 of 46 9 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 56 of 57 I' and software available makes it difficult to know before a search what tools or knowledge will be required to analyze the system and its data on the Premises. However, taking the storage media off-site and reviewing it in a controlled environment will allow its examination with the proper tools and knowledge. c. Variety of forms of electronic media. Records sought under this warrant could be stored in a variety of storage media formats that may require off-site reviewing with specialized forensic tools. 83. Nature of examination. Based on the foregoing, and consistent with Rule 41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying storage media that reasonably appear to contain some or all of the evidence described in the warrant, and would authorize a later review of the media or information consistent with the warrant. The later review may require techniques, including but not limited to computer-assisted scans of the entire medium, that might expose many parts of a hard drive to human inspection in order to determine whether it is evidence described by the warrant. 84. Because multiple people share the Subject Premises as a residence, it is possible that the Subject Premises will contain storage media that are predominantly used, and perhaps owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is possible that the things described in this warrant could be found on any of those computers or storage media, the warrant applied for would permit the seizure and review of those items as well. Page 45 of 46 Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 57 of 57 FILTER REVIEW PROCEDURES 85. Review of the items described in Attachment B will be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other operative privileges. The procedures include use of a designated "filter team," separate and apart from the investigative team, in order to address potential privileges. CONCLUSION 86. Based on the foregoing, your affiant respectfully requests that this Court issue a search warrant for the Subject Premises, more particularly described in Attachment A, authorizing the seizure of the items described in Attachment B. Respectfully submitted, . A. Heide Special Agent Federal Bureau of Investigation Sworn and subscribed before me on thisJ.-Y day of January, 2019. )f~J, ~ L.4tfRANA S. SNOW UNITED STATES MAGISTRATE JUDGE Page 46 of46