U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Report On The Investigation Into Russian Interference In The 2016 Presidential Election Volume I of II Special Counsel Robert S. Mueller, III Submitted Pursuant to 28 C.F.R. § 600.8(c) Washington, D.C. March 2019 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) TABLE OF CONTENTS – VOLUME I INTRODUCTION TO VOLUME I .......................................................................................................... 1  EXECUTIVE SUMMARY TO VOLUME I............................................................................................... 4  I. THE SPECIAL COUNSEL’S INVESTIGATION ................................................................................. 11  II. RUSSIAN “ACTIVE MEASURES” SOCIAL MEDIA CAMPAIGN ..................................................... 14  A. Structure of the Internet Research Agency ................................................................. 15  B. Funding and Oversight from Concord and Prigozhin ................................................. 16  C. The IRA Targets U.S. Elections .................................................................................. 19  1.  The IRA Ramps Up U.S. Operations As Early As 2014 ...................................... 19  2.  U.S. Operations Through IRA-Controlled Social Media Accounts ..................... 22  3.  U.S. Operations Through Facebook...................................................................... 24  4.  U.S. Operations Through Twitter ......................................................................... 26  a. Individualized Accounts................................................................................... 26  b. IRA Botnet Activities ...................................................................................... 28  5.  U.S. Operations Involving Political Rallies .......................................................... 29  6.  Targeting and Recruitment of U.S. Persons.......................................................... 31  7.  Interactions and Contacts with the Trump Campaign........................................... 33  a. Trump Campaign Promotion of IRA Political Materials................................. 33  b. Contact with Trump Campaign Officials in Connection to Rallies ................. 35  III. RUSSIAN HACKING AND DUMPING OPERATIONS ..................................................................... 36  A. GRU Hacking Directed at the Clinton Campaign ....................................................... 36  1.  GRU Units Target the Clinton Campaign ............................................................. 36  2.  Intrusions into the DCCC and DNC Networks ..................................................... 38  a. Initial Access .................................................................................................... 38  b. Implantation of Malware on DCCC and DNC Networks ................................ 38  c. Theft of Documents from DNC and DCCC Networks .................................... 40  B. Dissemination of the Hacked Materials ...................................................................... 41  1.  DCLeaks ............................................................................................................... 41  2.  Guccifer 2.0........................................................................................................... 42  3.  Use of WikiLeaks ................................................................................................. 44  a. WikiLeaks’s Expressed Opposition Toward the Clinton Campaign ............... 44  b. WikiLeaks’s First Contact with Guccifer 2.0 and DCLeaks ........................... 45  i U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) c. The GRU’s Transfer of Stolen Materials to WikiLeaks .................................. 45  d. WikiLeaks Statements Dissembling About the Source of Stolen Materials ........................................................................................................ 48  C. Additional GRU Cyber Operations ............................................................................. 49  1.  Summer and Fall 2016 Operations Targeting Democrat-Linked Victims............ 49  2.  Intrusions Targeting the Administration of U.S. Elections................................... 50  D. Trump Campaign and the Dissemination of Hacked Materials .................................. 51  1.  Role of Roger Stone.............................................................................................. 51  a. Background ...................................................................................................... 51  b. Contacts with the Campaign about WikiLeaks................................................ 52  c. Roger Stone’s Known Efforts to Communicate with WikiLeaks .................... 54  d. WikiLeaks’s October 7, 2016 Release of Stolen Podesta Emails .................... 58  e. Donald Trump Jr. Interaction with WikiLeaks ................................................ 59  2.  Other Potential Campaign Interest in Russian Hacked Materials ......................... 61  a. Henry Oknyansky (a/k/a Henry Greenberg) .................................................... 61  b. Campaign Efforts to Obtain Deleted Clinton Emails ...................................... 62  IV. RUSSIAN GOVERNMENT LINKS TO AND CONTACTS WITH THE TRUMP CAMPAIGN ................ 66  A. Campaign Period (September 2015 – November 8, 2016) ......................................... 66  1.  Trump Tower Moscow Project ............................................................................. 67  a. Trump Tower Moscow Venture with the Crocus Group (2013-2014) ............ 67  b. Communications with I.C. Expert Investment Company and Giorgi Rtskhiladze (Summer and Fall 2015) ............................................................ 69  c. Letter of Intent and Contacts to Russian Government (October 2015January 2016) ................................................................................................ 70  i. Trump Signs the Letter of Intent on behalf of the Trump Organization .... 70  ii. Post-LOI Contacts with Individuals in Russia ......................................... 72  d. Discussions about Russia Travel by Michael Cohen or Candidate Trump (December 2015-June 2016) ......................................................................... 76  i. Sater’s Overtures to Cohen to Travel to Russia ........................................ 76  ii. Candidate Trump’s Opportunities to Travel to Russia ............................ 78  2.  George Papadopoulos ........................................................................................... 80  a. Origins of Campaign Work .............................................................................. 81  b. Initial Russia-Related Contacts ........................................................................ 82  c. March 31 Foreign Policy Team Meeting ......................................................... 85  ii U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) d. George Papadopoulos Learns That Russia Has “Dirt” in the Form of Clinton Emails ............................................................................................... 86  e. Russia-Related Communications With The Campaign.................................... 89  f. Trump Campaign Knowledge of “Dirt” ........................................................... 93  g. Additional George Papadopoulos Contact ....................................................... 94  3.  Carter Page ............................................................................................................ 95  a. Background ...................................................................................................... 96  b. Origins of and Early Campaign Work ............................................................. 97  c. Carter Page’s July 2016 Trip To Moscow ........................................................ 98  d. Later Campaign Work and Removal from the Campaign ............................. 102  4.  Dimitri Simes and the Center for the National Interest ...................................... 103  a. CNI and Dimitri Simes Connect with the Trump Campaign ......................... 103  b. National Interest Hosts a Foreign Policy Speech at the Mayflower Hotel ..................................................................................................................... 105  c. Jeff Sessions’s Post-Speech Interactions with CNI ....................................... 107  d. Jared Kushner’s Continuing Contacts with Simes......................................... 108  5.  June 9, 2016 Meeting at Trump Tower ............................................................... 110  a. Setting Up the June 9 Meeting ....................................................................... 110  i. Outreach to Donald Trump Jr.................................................................. 110  ii. Awareness of the Meeting Within the Campaign ................................... 114  b. The Events of June 9, 2016 ............................................................................ 116  i. Arrangements for the Meeting ................................................................ 116  ii. Conduct of the Meeting .......................................................................... 117  c. Post-June 9 Events ......................................................................................... 120  6.  Events at the Republican National Convention .................................................. 123  a. Ambassador Kislyak’s Encounters with Senator Sessions and J.D. Gordon the Week of the RNC ..................................................................... 123  b. Change to Republican Party Platform............................................................ 124  7.  Post-Convention Contacts with Kislyak ............................................................. 127  a. Ambassador Kislyak Invites J.D. Gordon to Breakfast at the Ambassador’s Residence ............................................................................. 127  b. Senator Sessions’s September 2016 Meeting with Ambassador Kislyak ...... 127  8.  Paul Manafort...................................................................................................... 129  a. Paul Manafort’s Ties to Russia and Ukraine.................................................. 131  iii U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) i.  Oleg Deripaska Consulting Work ......................................................... 131  ii.  Political Consulting Work ..................................................................... 132  iii.  Konstantin Kilimnik .............................................................................. 132  b. Contacts during Paul Manafort’s Time with the Trump Campaign .............. 134  i. Paul Manafort Joins the Campaign ......................................................... 134  ii. Paul Manafort’s Campaign-Period Contacts .......................................... 135  iii. Paul Manafort’s Two Campaign-Period Meetings with Konstantin Kilimnik in the United States ................................................................ 138  c. Post-Resignation Activities ............................................................................ 141  B. Post-Election and Transition-Period Contacts .......................................................... 144  1.  Immediate Post-Election Activity ....................................................................... 144  a. Outreach from the Russian Government ........................................................ 145  b. High-Level Encouragement of Contacts through Alternative Channels ....... 146  2.  Kirill Dmitriev’s Transition-Era Outreach to the Incoming Administration ...... 147  a. Background .................................................................................................... 147  b. Kirill Dmitriev’s Post-Election Contacts With the Incoming Administration ............................................................................................. 149  c. Erik Prince and Kirill Dmitriev Meet in the Seychelles ................................ 151  i. George Nader and Erik Prince Arrange Seychelles Meeting with Dmitriev ................................................................................................. 151  ii. The Seychelles Meetings........................................................................ 153  iii. Erik Prince’s Meeting with Steve Bannon after the Seychelles Trip .... 155  d. Kirill Dmitriev’s Post-Election Contact with Rick Gerson Regarding U.S.-Russia Relations .................................................................................. 156  3.  Ambassador Kislyak’s Meeting with Jared Kushner and Michael Flynn in Trump Tower Following the Election................................................................. 159  4.  Jared Kushner’s Meeting with Sergey Gorkov ................................................... 161  5.  Petr Aven’s Outreach Efforts to the Transition Team ........................................ 163  6.  Carter Page Contact with Deputy Prime Minister Arkady Dvorkovich ............. 166  7.  Contacts With and Through Michael T. Flynn ................................................... 167  a. United Nations Vote on Israeli Settlements ................................................... 167  b. U.S. Sanctions Against Russia ....................................................................... 168  V. PROSECUTION AND DECLINATION DECISIONS ........................................................................ 174  A. Russian “Active Measures” Social Media Campaign ............................................... 174  iv U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) B. Russian Hacking and Dumping Operations .............................................................. 175  1. Section 1030 Computer-Intrusion Conspiracy.................................................... 175  a. Background .................................................................................................... 175  ....... 176  (b)(5)-2 b. Charging Decision As to (b)(5) (b)(5)-2 2. Potential Section 1030 Violation By (b) (5), (b) (6), (b) (7)(C) .............................. 179  (b)(6)/(b)(7)(C)-2 C. Russian Government Outreach and Contacts ............................................................. 180  1. Potential Coordination: Conspiracy and Collusion............................................. 180  2. Potential Coordination: Foreign Agent Statutes (FARA and 18 U.S.C. § 951) . 181 a. Governing Law............................................................................................... 181  b. Application..................................................................................................... 182  3. Campaign Finance .............................................................................................. 183  a. Overview Of Governing Law......................................................................... 184  b. Application to June 9 Trump Tower Meeting................................................ 185  i. Thing-of-Value Element ......................................................................... 186  ii. Willfulness ............................................................................................. 187  iii. Difficulties in Valuing Promised Information ...................................... 188  c. Application to WikiLeaks (b)(5) i. Questions Over (b)(5) ................................................... 188  ....................................................................... 189  (b)(5)-2 (b)(5)-2 ii. Willfulness ............................................................................................. 190  iii. Constitutional Considerations ................................................................ 190  iv. Analysis (b)(5) .................................................................... 190  (b)(5)-2 4. False Statements and Obstruction of the Investigation ....................................... 191  a. Overview Of Governing Law......................................................................... 191  b. Application to Certain Individuals ................................................................. 192  i. George Papadopoulos .............................................................................. 192  ii. (b)(5), (b)(6), (b)(7)(C) ............................................................................. 194  iii. Michael Flynn ....................................................................................... 194  iv. Michael Cohen ...................................................................................... 195  v. Roger Stone ............................................................................................ 196  vi. Jeff Sessions ........................................................................................... 197  vii. Others Interviewed During the Investigation ....................................... 198  v (b)(5)-2 (b)(6)/(b)(7)(C)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) INTRODUCTION TO VOLUME I This report is submitted to the Attorney General pursuant to 28 C.F.R. § 600.8(c), which states that, “[a]t the conclusion of the Special Counsel’s work, he . . . shall provide the Attorney General a confidential report explaining the prosecution or declination decisions [the Special Counsel] reached.” The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion. Evidence of Russian government operations began to surface in mid-2016. In June, the Democratic National Committee and its cyber response team publicly announced that Russian hackers had compromised its computer network. Releases of hacked materials—hacks that public reporting soon attributed to the Russian government—began that same month. Additional releases followed in July through the organization WikiLeaks, with further releases in October and November. In late July 2016, soon after WikiLeaks’s first release of stolen documents, a foreign government contacted the FBI about a May 2016 encounter with Trump Campaign foreign policy advisor George Papadopoulos. Papadopoulos had suggested to a representative of that foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information damaging to Democratic presidential candidate Hillary Clinton. That information prompted the FBI on July 31, 2016, to open an investigation into whether individuals associated with the Trump Campaign were coordinating with the Russian government in its interference activities. That fall, two federal agencies jointly announced that the Russian government “directed recent compromises of e-mails from US persons and institutions, including US political organizations,” and, “[t]hese thefts and disclosures are intended to interfere with the US election process.” After the election, in late December 2016, the United States imposed sanctions on Russia for having interfered in the election. By early 2017, several congressional committees were examining Russia’s interference in the election. Within the Executive Branch, these investigatory efforts ultimately led to the May 2017 appointment of Special Counsel Robert S. Mueller, III. The order appointing the Special Counsel authorized him to investigate “the Russian government’s efforts to interfere in the 2016 presidential election,” including any links or coordination between the Russian government and individuals associated with the Trump Campaign. As set forth in detail in this report, the Special Counsel’s investigation established that Russia interfered in the 2016 presidential election principally through two operations. First, a Russian entity carried out a social media campaign that favored presidential candidate Donald J. Trump and disparaged presidential candidate Hillary Clinton. Second, a Russian intelligence service conducted computer-intrusion operations against entities, employees, and volunteers working on the Clinton Campaign and then released stolen documents. The investigation also identified numerous links between the Russian government and the Trump Campaign. Although the investigation established that the Russian government perceived it would benefit from a Trump presidency and worked to secure that outcome, and that the Campaign expected it would benefit 1 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) electorally from information stolen and released through Russian efforts, the investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities. * * * Below we describe the evidentiary considerations underpinning statements about the results of our investigation and the Special Counsel’s charging decisions, and we then provide an overview of the two volumes of our report. The report describes actions and events that the Special Counsel’s Office found to be supported by the evidence collected in our investigation. In some instances, the report points out the absence of evidence or conflicts in the evidence about a particular fact or event. In other instances, when substantial, credible evidence enabled the Office to reach a conclusion with confidence, the report states that the investigation established that certain actions or events occurred. A statement that the investigation did not establish particular facts does not mean there was no evidence of those facts. In evaluating whether evidence about collective action of multiple individuals constituted a crime, we applied the framework of conspiracy law, not the concept of “collusion.” In so doing, the Office recognized that the word “collud[e]” was used in communications with the Acting Attorney General confirming certain aspects of the investigation’s scope and that the term has frequently been invoked in public reporting about the investigation. But collusion is not a specific offense or theory of liability found in the United States Code, nor is it a term of art in federal criminal law. For those reasons, the Office’s focus in analyzing questions of joint criminal liability was on conspiracy as defined in federal law. In connection with that analysis, we addressed the factual question whether members of the Trump Campaign “coordinat[ed]”—a term that appears in the appointment order—with Russian election interference activities. Like collusion, “coordination” does not have a settled definition in federal criminal law. We understood coordination to require an agreement—tacit or express—between the Trump Campaign and the Russian government on election interference. That requires more than the two parties taking actions that were informed by or responsive to the other’s actions or interests. We applied the term coordination in that sense when stating in the report that the investigation did not establish that the Trump Campaign coordinated with the Russian government in its election interference activities. * * * The report on our investigation consists of two volumes: Volume I describes the factual results of the Special Counsel’s investigation of Russia’s interference in the 2016 presidential election and its interactions with the Trump Campaign. Section I describes the scope of the investigation. Sections II and III describe the principal ways Russia interfered in the 2016 presidential election. Section IV describes links between the Russian 2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) government and individuals associated with the Trump Campaign. Section V sets forth the Special Counsel’s charging decisions. Volume II addresses the President’s actions towards the FBI’s investigation into Russia’s interference in the 2016 presidential election and related matters, and his actions towards the Special Counsel’s investigation. Volume II separately states its framework and the considerations that guided that investigation. 3 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) EXECUTIVE SUMMARY TO VOLUME I RUSSIAN SOCIAL MEDIA CAMPAIGN The Internet Research Agency (IRA) c~mied out the earliest Russian interference operations identified by the investigation-a social media campaign designed to provoke and amplify political and social discord in the United States. The IRA was based in St. Petersburg, Russia, and received funding from Russian oligarch Y evgeniy Prigozhin and companies he controlled. Pri ozhin is widel re 01ted to have ties to Russian President Vladi1nir Putin (b)(7)(E)-2 In Inid-2014, the IRA sent em lo Inission with inst111ctions (b)(7)(E)-2 The IRA later used social media accounts and interest groups to sow discord in the U.S. political system through what it tenned "infonnation warfare." The campaign evolved from a generalized program designed in 2014 and 2015 to undennine the U.S. electoral system, to a targeted operation that by early 2016 favored candidate Tnnnp and disparaged can didate Clinton. The IRA's operation also included the purchase of political adve1tisements on social media in the names of U.S . persons and entities, as well as the staging of political rallies inside the United States. To organize those rallies, IRA employees posed as U.S . grassroots entities and persons and made contact with Tnnnp suppo1ters and T111mp Campaign officials in the United States. The investigation did not identify evidence that any U.S . persons conspired or coordinated with the IRA. Section II of this repo1t details the Office's investigation of the Russian social media campaign. RUSSIAN HACKING OPERATIONS At the same time that the IRA operation began to focus on suppo1ting can didate T111mp in early 2016, the Russian government employed a second fo1m of interference: cyber intrusions (hacking) and releases of hacked materials damaging to the Clinton Campaign. The Russian intelligence service known as the Main Intelligence Directorate of the General Staff of the Russian Anny (GRU) caiTied out these operations. In March 2016, the GRU began hacking the email accounts of Clinton Campaign volunteers and employees, including campaign chai1man John Podesta. In April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Cominittee (DCCC) and the Democratic National Committee (DNC). The GRU stole hundreds of thousands of documents from the comproinised email accounts and networks. Around the time that the DNC announced in Inid-June 2016 the Russian government's role in hacking its network, the GRU began disseminating stolen materials through the fictitious online personas "DCLeaks" and "Guccifer 2.0. " The GRU later released additional materials through the organization WikiLeaks. 4 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) The presidential campaign of Donald J. Trump (“Trump Campaign” or “Campaign”) showed interest in WikiLeaks’s releases of documents and welcomed their potential to damage candidate Clinton. Beginning in June 2016, former Campaign member Roger Stone forecast to senior Campaign officials that WikiLeaks would release information damaging to candidate Clinton. WikiLeaks’s first release came in July 2016. Around the same time, candidate Trump announced that he hoped Russia would recover emails described as missing from a private server used by Clinton when she was Secretary of State (he later said that he was speaking sarcastically). Stone stayed in regular contact with the Campaign claiming to have information about future releases by WikiLeaks, while privately asking his own associates to contact WikiLeaks founder Julian Assange and publicly boasting of his access to Assange. WikiLeaks began releasing Podesta’s stolen emails on October 7, 2016, less than one hour after a U.S. media outlet released video considered damaging to candidate Trump. Section III of this Report details the Office’s investigation into the Russian hacking operations, as well as other efforts by Trump Campaign supporters to obtain Clinton-related emails. RUSSIAN CONTACTS WITH THE CAMPAIGN The social media campaign and the GRU hacking operations coincided with a series of contacts between Trump Campaign officials and individuals with ties to the Russian government. The Office investigated whether those contacts reflected or resulted in the Campaign conspiring or coordinating with Russia in its election-interference activities. Although the investigation established that the Russian government perceived it would benefit from a Trump presidency and worked to secure that outcome, and that the Campaign expected it would benefit electorally from information stolen and released through Russian efforts, the investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities. The Russian contacts consisted of business connections, offers of assistance to the Campaign, invitations for candidate Trump and Putin to meet in person, invitations for Campaign officials and representatives of the Russian government to meet, and policy positions seeking improved U.S.-Russian relations. Section IV of this Report details the contacts between Russia and the Trump Campaign during the campaign and transition periods, the most salient of which are summarized below in chronological order. 2015. Some of the earliest contacts were made in connection with a Trump Organization real-estate project in Russia known as Trump Tower Moscow. Candidate Trump signed a Letter of Intent for Trump Tower Moscow by November 2015, and in January 2016 Trump Organization executive Michael Cohen emailed and spoke about the project with the office of Russian government press secretary Dmitry Peskov. The Trump Organization pursued the project through at least June 2016, including by considering travel to Russia by Cohen and candidate Trump. Spring 2016. Campaign foreign policy advisor George Papadopoulos made early contact with Joseph Mifsud, a London-based professor who had connections to Russia and traveled to Moscow in April 2016. Immediately upon his return to London from that trip, Mifsud told Papadopoulos that the Russian government had “dirt” on Hillary Clinton in the form of thousands 5 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) of emails. One week later, in the first week of May 2016, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information damaging to candidate Clinton. Throughout that period of time and for several months thereafter, Papadopoulos worked with Mifsud and two Russian nationals to arrange a meeting between the Campaign and the Russian government. No meeting took place. Summer 2016. Russian outreach to the Trump Campaign continued into the summer of 2016, as candidate Trump was becoming the presumptive Republican nominee for President. On June 9, 2016, for example, a Russian lawyer met with senior Trump Campaign officials Donald Trump Jr., Jared Kushner, and campaign chairman Paul Manafort to deliver what the email proposing the meeting had described as “official documents and information that would incriminate Hillary.” The materials were offered to Trump Jr. as “part of Russia and its government’s support for Mr. Trump.” The written communications setting up the meeting showed that the Campaign anticipated receiving information from Russia that could assist candidate Trump’s electoral prospects, but the Russian lawyer’s presentation did not provide such information. Days after the June 9 meeting, on June 14, 2016, a cybersecurity firm and the DNC announced that Russian government hackers had infiltrated the DNC and obtained access to opposition research on candidate Trump, among other documents. In July 2016, Campaign foreign policy advisor Carter Page traveled in his personal capacity to Moscow and gave the keynote address at the New Economic School. Page had lived and worked in Russia between 2003 and 2007. After returning to the United States, Page became acquainted with at least two Russian intelligence officers, one of whom was later charged in 2015 with conspiracy to act as an unregistered agent of Russia. Page’s July 2016 trip to Moscow and his advocacy for pro-Russian foreign policy drew media attention. The Campaign then distanced itself from Page and, by late September 2016, removed him from the Campaign. July 2016 was also the month WikiLeaks first released emails stolen by the GRU from the DNC. On July 22, 2016, WikiLeaks posted thousands of internal DNC documents revealing information about the Clinton Campaign. Within days, there was public reporting that U.S. intelligence agencies had “high confidence” that the Russian government was behind the theft of emails and documents from the DNC. And within a week of the release, a foreign government informed the FBI about its May 2016 interaction with Papadopoulos and his statement that the Russian government could assist the Trump Campaign. On July 31, 2016, based on the foreign government reporting, the FBI opened an investigation into potential coordination between the Russian government and individuals associated with the Trump Campaign. Separately, on August 2, 2016, Trump campaign chairman Paul Manafort met in New York City with his long-time business associate Konstantin Kilimnik, who the FBI assesses to have ties to Russian intelligence. Kilimnik requested the meeting to deliver in person a peace plan for Ukraine that Manafort acknowledged to the Special Counsel’s Office was a “backdoor” way for Russia to control part of eastern Ukraine; both men believed the plan would require candidate Trump’s assent to succeed (were he to be elected President). They also discussed the status of the 6 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Trump Campaign and Manafort’s strategy for winning Democratic votes in Midwestern states. Months before that meeting, Manafort had caused internal polling data to be shared with Kilimnik, and the sharing continued for some period of time after their August meeting. Fall 2016. On October 7, 2016, the media released video of candidate Trump speaking in graphic terms about women years earlier, which was considered damaging to his candidacy. Less than an hour later, WikiLeaks made its second release: thousands of John Podesta’s emails that had been stolen by the GRU in late March 2016. The FBI and other U.S. government institutions were at the time continuing their investigation of suspected Russian government efforts to interfere in the presidential election. That same day, October 7, the Department of Homeland Security and the Office of the Director of National Intelligence issued a joint public statement “that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.” Those “thefts” and the “disclosures” of the hacked materials through online platforms such as WikiLeaks, the statement continued, “are intended to interfere with the US election process.” Post-2016 Election. Immediately after the November 8 election, Russian government officials and prominent Russian businessmen began trying to make inroads into the new administration. The most senior levels of the Russian government encouraged these efforts. The Russian Embassy made contact hours after the election to congratulate the President-Elect and to arrange a call with President Putin. Several Russian businessmen picked up the effort from there. Kirill Dmitriev, the chief executive officer of Russia’s sovereign wealth fund, was among the Russians who tried to make contact with the incoming administration. In early December, a business associate steered Dmitriev to Erik Prince, a supporter of the Trump Campaign and an associate of senior Trump advisor Steve Bannon. Dmitriev and Prince later met face-to-face in January 2017 in the Seychelles and discussed U.S.-Russia relations. During the same period, another business associate introduced Dmitriev to a friend of Jared Kushner who had not served on the Campaign or the Transition Team. Dmitriev and Kushner’s friend collaborated on a short written reconciliation plan for the United States and Russia, which Dmitriev implied had been cleared through Putin. The friend gave that proposal to Kushner before the inauguration, and Kushner later gave copies to Bannon and incoming Secretary of State Rex Tillerson. On December 29, 2016, then-President Obama imposed sanctions on Russia for having interfered in the election. Incoming National Security Advisor Michael Flynn called Russian Ambassador Sergey Kislyak and asked Russia not to escalate the situation in response to the sanctions. The following day, Putin announced that Russia would not take retaliatory measures in response to the sanctions at that time. Hours later, President-Elect Trump tweeted, “Great move on delay (by V. Putin).” The next day, on December 31, 2016, Kislyak called Flynn and told him the request had been received at the highest levels and Russia had chosen not to retaliate as a result of Flynn’s request. *** On January 6, 2017, members of the intelligence community briefed President-Elect Trump on a joint assessment—drafted and coordinated among the Central Intelligence Agency, FBI, and 7 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) National Security Agency—that concluded with high confidence that Russia had intervened in the election through a variety of means to assist Trump’s candidacy and harm Clinton’s. A declassified version of the assessment was publicly released that same day. Between mid-January 2017 and early February 2017, three congressional committees—the House Permanent Select Committee on Intelligence (HPSCI), the Senate Select Committee on Intelligence (SSCI), and the Senate Judiciary Committee (SJC)—announced that they would conduct inquiries, or had already been conducting inquiries, into Russian interference in the election. Then-FBI Director James Comey later confirmed to Congress the existence of the FBI’s investigation into Russian interference that had begun before the election. On March 20, 2017, in open-session testimony before HPSCI, Comey stated: I have been authorized by the Department of Justice to confirm that the FBI, as part of our counterintelligence mission, is investigating the Russian government’s efforts to interfere in the 2016 presidential election, and that includes investigating the nature of any links between individuals associated with the Trump campaign and the Russian government and whether there was any coordination between the campaign and Russia’s efforts. . . . As with any counterintelligence investigation, this will also include an assessment of whether any crimes were committed. The investigation continued under then-Director Comey for the next seven weeks until May 9, 2017, when President Trump fired Comey as FBI Director—an action which is analyzed in Volume II of the report. On May 17, 2017, Acting Attorney General Rod Rosenstein appointed the Special Counsel and authorized him to conduct the investigation that Comey had confirmed in his congressional testimony, as well as matters arising directly from the investigation, and any other matters within the scope of 28 C.F.R. § 600.4(a), which generally covers efforts to interfere with or obstruct the investigation. President Trump reacted negatively to the Special Counsel’s appointment. He told advisors that it was the end of his presidency, sought to have Attorney General Jefferson (Jeff) Sessions unrecuse from the Russia investigation and to have the Special Counsel removed, and engaged in efforts to curtail the Special Counsel’s investigation and prevent the disclosure of evidence to it, including through public and private contacts with potential witnesses. Those and related actions are described and analyzed in Volume II of the report. *** THE SPECIAL COUNSEL’S CHARGING DECISIONS In reaching the charging decisions described in Volume I of the report, the Office determined whether the conduct it found amounted to a violation of federal criminal law chargeable under the Principles of Federal Prosecution. See Justice Manual § 9-27.000 et seq. (2018). The standard set forth in the Justice Manual is whether the conduct constitutes a crime; if so, whether admissible evidence would probably be sufficient to obtain and sustain a conviction; 8 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) and whether prosecution would serve a substantial federal interest that could not be adequately served by prosecution elsewhere or through non-criminal alternatives. See Justice Manual § 927.220. Section V of the report provides detailed explanations of the Office’s charging decisions, which contain three main components. First, the Office determined that Russia’s two principal interference operations in the 2016 U.S. presidential election—the social media campaign and the hacking-and-dumping operations— violated U.S. criminal law. Many of the individuals and entities involved in the social media campaign have been charged with participating in a conspiracy to defraud the United States by undermining through deceptive acts the work of federal agencies charged with regulating foreign influence in U.S. elections, as well as related counts of identity theft. See United States v. Internet Research Agency, et al., No. 18-cr-32 (D.D.C.). Separately, Russian intelligence officers who carried out the hacking into Democratic Party computers and the personal email accounts of individuals affiliated with the Clinton Campaign conspired to violate, among other federal laws, the federal computer-intrusion statute, and they have been so charged. See United States v. Netyksho, et al., No. 18-cr-215 (D.D.C.). (b) (5) (b) (5), (b) (6), (b) (7)(C) Second, while the investigation identified numerous links between individuals with ties to the Russian government and individuals associated with the Trump Campaign, the evidence was not sufficient to support criminal charges. Among other things, the evidence was not sufficient to charge any Campaign official as an unregistered agent of the Russian government or other Russian principal. And our evidence about the June 9, 2016 meeting and WikiLeaks’s releases of hacked materials was not sufficient to charge a criminal campaign-finance violation. Further, the evidence was not sufficient to charge that any member of the Trump Campaign conspired with representatives of the Russian government to interfere in the 2016 election. Third, the investigation established that several individuals affiliated with the Trump Campaign lied to the Office, and to Congress, about their interactions with Russian-affiliated individuals and related matters. Those lies materially impaired the investigation of Russian election interference. The Office charged some of those lies as violations of the federal falsestatements statute. Former National Security Advisor Michael Flynn pleaded guilty to lying about his interactions with Russian Ambassador Kislyak during the transition period. George Papadopoulos, a foreign policy advisor during the campaign period, pleaded guilty to lying to investigators about, inter alia, the nature and timing of his interactions with Joseph Mifsud, the professor who told Papadopoulos that the Russians had dirt on candidate Clinton in the form of thousands of emails. Former Trump Organization attorney Michael Cohen pleaded guilty to making false statements to Congress about the Trump Moscow project. Based on evidence of his lies to Congress and efforts to influence witnesses in the various Russia investigations, a grand jury charged Roger Stone with making false statements, obstruction of justice, and witness tampering. And in February 2019, the U.S. District Court for the District of Columbia found that 9 (b)(5)-2 (b)(6)/(b)(7)(C)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Manafort lied to the Office and the grand jury concerning his interactions and communications with Konstantin Kilimnik about Trump Campaign polling data and a peace plan for Ukraine. *** The Office investigated several other events that have been publicly reported to involve potential Russia-related contacts. For example, the investigation established that interactions between Russian Ambassador Kislyak and Trump Campaign officials both at the candidate’s April 2016 foreign policy speech in Washington, D.C., and during the week of the Republican National Convention were brief, public, and non-substantive. And the investigation did not establish that one Campaign official’s efforts to dilute a portion of the Republican Party platform on providing assistance to Ukraine were undertaken at the behest of candidate Trump or Russia. The investigation also did not establish that a meeting between Kislyak and Sessions in September 2016 at Sessions’s Senate office included any more than a passing mention of the presidential campaign. The investigation did not always yield admissible information or testimony, or a complete picture of the activities undertaken by subjects of the investigation. Some individuals invoked their Fifth Amendment right against compelled self-incrimination and were not, in the Office’s judgment, appropriate candidates for grants of immunity. The Office limited its pursuit of other witnesses and information—such as information known to attorneys or individuals claiming to be members of the media—in light of internal Department of Justice policies. See, e.g., Justice Manual §§ 9-13.400, 13.410. Some of the information obtained via court process, moreover, was presumptively covered by legal privilege and was screened from investigators by a filter (or “taint”) team. Even when individuals testified or agreed to be interviewed, they sometimes provided information that was false or incomplete, leading to some of the false-statements charges described above. And the Office faced practical limits on its ability to access relevant evidence as well—numerous witnesses and subjects lived abroad, and documents were held outside the United States. Further, the Office learned that some of the individuals we interviewed or whose conduct we investigated—including some associated with the Trump Campaign—deleted relevant communications or communicated during the relevant period using applications that feature encryption or that do not provide for long-term retention of data or communications records. In such cases, the Office was not able to corroborate witness statements through comparison to contemporaneous communications or fully question witnesses about statements that appeared inconsistent with other known facts. Accordingly, while this report embodies factual and legal determinations that the Office believes to be accurate and complete to the greatest extent possible, given these identified gaps, the Office cannot rule out the possibility that the unavailable information would shed additional light on (or cast in a new light) the events described in the report. 10 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) I. THE SPECIAL COUNSEL’S INVESTIGATION On May 17, 2017, Deputy Attorney General Rod J. Rosenstein—then serving as Acting Attorney General for the Russia investigation following the recusal of former Attorney General Jeff Sessions on March 2, 2016—appointed the Special Counsel “to investigate Russian interference with the 2016 presidential election and related matters.” Office of the Deputy Att’y Gen., Order No. 3915-2017, Appointment of Special Counsel to Investigate Russian Interference with the 2016 Presidential Election and Related Matters, May 17, 2017) (“Appointment Order”). Relying on “the authority vested” in the Acting Attorney General, “including 28 U.S.C. §§ 509, 510, and 515,” the Acting Attorney General ordered the appointment of a Special Counsel “in order to discharge [the Acting Attorney General’s] responsibility to provide supervision and management of the Department of Justice, and to ensure a full and thorough investigation of the Russian government’s efforts to interfere in the 2016 presidential election.” Appointment Order (introduction). “The Special Counsel,” the Order stated, “is authorized to conduct the investigation confirmed by then-FBI Director James B. Comey in testimony before the House Permanent Select Committee on Intelligence on March 20, 2017,” including: (i) any links and/or coordination between the Russian government and individuals associated with the campaign of President Donald Trump; and (ii) any matters that arose or may arise directly from the investigation; and (iii) any other matters within the scope of 28 C.F.R. § 600.4(a). Appointment Order ¶ (b). Section 600.4 affords the Special Counsel “the authority to investigate and prosecute federal crimes committed in the course of, and with intent to interfere with, the Special Counsel’s investigation, such as perjury, obstruction of justice, destruction of evidence, and intimidation of witnesses.” 28 C.F.R. § 600.4(a). The authority to investigate “any matters that arose . . . directly from the investigation,” Appointment Order ¶ (b)(ii), covers similar crimes that may have occurred during the course of the FBI’s confirmed investigation before the Special Counsel’s appointment. “If the Special Counsel believes it is necessary and appropriate,” the Order further provided, “the Special Counsel is authorized to prosecute federal crimes arising from the investigation of these matters.” Id. ¶ (c). Finally, the Acting Attorney General made applicable “Sections 600.4 through 600.10 of Title 28 of the Code of Federal Regulations.” Id. ¶ (d). The Acting Attorney General further clarified the scope of the Special Counsel’s investigatory authority in two subsequent memoranda. A memorandum dated August 2, 2017, explained that the Appointment Order had been “worded categorically in order to permit its public release without confirming specific investigations involving specific individuals.” It then confirmed that the Special Counsel had been authorized since his appointment to investigate allegations that three Trump campaign officials—Carter Page, Paul Manafort, and George Papadopoulos—“committed a crime or crimes by colluding with Russian government officials with respect to the Russian government’s efforts to interfere with the 2016 presidential election.” The memorandum also confirmed the Special Counsel’s authority to investigate certain other matters, including two additional sets of allegations involving Manafort (crimes arising from payments he received from the Ukrainian government and crimes arising from his receipt of loans 11 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) from a bank whose CEO was then seeking a position in the Trump Administration); allegations that Papadopoulos committed a crime or crimes by acting as an unregistered agent of the Israeli government; and four sets of allegations involving Michael Flynn, the former National Security Advisor to President Trump. On October 20, 2017, the Acting Attorney General confirmed in a memorandum the Special Counsel’s investigative authority as to several individuals and entities. First, “as part of a full and thorough investigation of the Russian government’s efforts to interfere in the 2016 (b)(5)-2 presidential election,” the Special Counsel was authorized to investigate “the pertinent activities (b)(6) / of Michael Cohen, Richard Gates, (b)(5), (b) (6), (b) (7)(C) Roger Stone, and (b)(5), (b) (6), (b) (7)(C) (b)(7)(C)-2 “Confirmation of the authorization to investigate such individuals,” the memorandum stressed, “does not suggest that the Special Counsel has made a determination that any of them has committed a crime.” Second, with respect to Michael Cohen, the memorandum recognized the Special Counsel’s authority to investigate “leads relate[d] to Cohen’s establishment and use of Essential Consultants LLC to, inter alia, receive funds from Russian-backed entities.” Third, the memorandum memorialized the Special Counsel’s authority to investigate individuals and entities who were possibly engaged in “jointly undertaken activity” with existing subjects of the investigation, including Paul Manafort. Finally, the memorandum described an FBI investigation opened before the Special Counsel’s appointment into “allegations that [then-Attorney General Jeff Sessions] made false statements to the United States Senate[,]” and confirmed the Special Counsel’s authority to investigate that matter. ■ The Special Counsel structured the investigation in view of his power and authority “to exercise all investigative and prosecutorial functions of any United States Attorney.” 28 C.F.R. § 600.6. Like a U.S. Attorney’s Office, the Special Counsel’s Office considered a range of classified and unclassified information available to the FBI in the course of the Office’s Russia investigation, and the Office structured that work around evidence for possible use in prosecutions of federal crimes (assuming that one or more crimes were identified that warranted prosecution). There was substantial evidence immediately available to the Special Counsel at the inception of the investigation in May 2017 because the FBI had, by that time, already investigated Russian election interference for nearly 10 months. The Special Counsel’s Office exercised its judgment regarding what to investigate and did not, for instance, investigate every public report of a contact between the Trump Campaign and Russian-affiliated individuals and entities. The Office has concluded its investigation into links and coordination between the Russian government and individuals associated with the Trump Campaign. Certain proceedings associated with the Office’s work remain ongoing. After consultation with the Office of the Deputy Attorney General, the Office has transferred responsibility for those remaining issues to other components of the Department of Justice and FBI. Appendix D lists those transfers. Two district courts confirmed the breadth of the Special Counsel’s authority to investigate Russia election interference and links and/or coordination with the Trump Campaign. See United States v. Manafort, 312 F. Supp. 3d 60, 79-83 (D.D.C. 2018); United States v. Manafort, 321 F. Supp. 3d 640, 650-655 (E.D. Va. 2018). In the course of conducting that investigation, the Office periodically identified evidence of potential criminal activity that was outside the scope of the Special Counsel’s authority established by the Acting Attorney General. After consultation with 12 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) the Office of the Deputy Attorney General, the Office referred that evidence to appropriate law enforcement authorities, principally other components of the Department of Justice and to the FBI. Appendix D summarizes those referrals. *** To carry out the investigation and prosecution of the matters assigned to him, the Special Counsel assembled a team that at its high point included 19 attorneys—five of whom joined the Office from private practice and 14 on detail or assigned from other Department of Justice components. These attorneys were assisted by a filter team of Department lawyers and FBI personnel who screened materials obtained via court process for privileged information before turning those materials over to investigators; a support staff of three paralegals on detail from the Department’s Antitrust Division; and an administrative staff of nine responsible for budget, finance, purchasing, human resources, records, facilities, security, information technology, and administrative support. The Special Counsel attorneys and support staff were co-located with and worked alongside approximately 40 FBI agents, intelligence analysts, forensic accountants, a paralegal, and professional staff assigned by the FBI to assist the Special Counsel’s investigation. Those “assigned” FBI employees remained under FBI supervision at all times; the matters on which they assisted were supervised by the Special Counsel.1 During its investigation the Office issued more than 2,800 subpoenas under the auspices of a grand jury sitting in the District of Columbia; executed nearly 500 search-and-seizure warrants; obtained more than 230 orders for communications records under 18 U.S.C. § 2703(d); obtained almost 50 orders authorizing use of pen registers; made 13 requests to foreign governments pursuant to Mutual Legal Assistance Treaties; and interviewed approximately 500 witnesses, including almost 80 before a grand jury. *** From its inception, the Office recognized that its investigation could identify foreign intelligence and counterintelligence information relevant to the FBI’s broader national security mission. FBI personnel who assisted the Office established procedures to identify and convey such information to the FBI. The FBI’s Counterintelligence Division met with the Office regularly for that purpose for most of the Office’s tenure. For more than the past year, the FBI also embedded personnel at the Office who did not work on the Special Counsel’s investigation, but whose purpose was to review the results of the investigation and to send—in writing—summaries of foreign intelligence and counterintelligence information to FBIHQ and FBI Field Offices. Those communications and other correspondence between the Office and the FBI contain information derived from the investigation, not all of which is contained in this Volume. This Volume is a summary. It contains, in the Office’s judgment, that information necessary to account for the Special Counsel’s prosecution and declination decisions and to describe the investigation’s main factual results. 1 FBI personnel assigned to the Special Counsel’s Office were required to adhere to all applicable federal law and all Department and FBI regulations, guidelines, and policies. An FBI attorney worked on FBI-related matters for the Office, such as FBI compliance with all FBI policies and procedures, including the FBI’s Domestic Investigations and Operations Guide (DIOG). That FBI attorney worked under FBI legal supervision, not the Special Counsel’s supervision. 13 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) II. R USSIAN " A CTIVE MEASURES" S OCIAL MEDIA CAMPAIGN The first form of Russian election influence came principally from the Internet Research Agency, LLC (IRA), a Russian organization funded by Yevgeniy Viktorovich Prigozhin and companies he controlled, including Concord Management and Consulting LLC and Concord Catering (collectively "Concord").2 The IRA conducted social media operations targeted at large U.S. audiences with the goal of sowing discord in the U.S. political system.3 These operations constituted "active measures" (aKTHBHhle MeporrpIDITIDI), a ten n that typically refers to operations conducted by Russian security services aimed at influencing the course of international affairs. 4 The IRA and its employees began operations targeting the United States as early as 2014. Using fictitious U.S . personas, IRA employees operated social media accounts an d group pages designed to attrnct U.S. audiences. These groups and accounts, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists. Over time, these social media accounts became a means to reach large U.S. audiences. IRA employees travelled to th e United States in mid-2014 on an intelligence-gathering mission to obtain infon nation and photographs for use in their social media posts. IRA employees posted derogato1y info1m ation about a number of candidates in the 2016 U.S. presidential election. By early to mid-2016, IRA operations included suppo1iing the Tnnnp Campaign and disparaging candidate Hillaiy Clinton. The IRA made various expenditures to cany out those activities, including buying political adve1iisements on social media in the names of U.S. persons and entities. Some IRA employees, posing as U.S . persons and without revealing their Russian association, communicated electronically with individuals associated with the Tnnnp Campaign and with other political activists to seek to coordinate political activities, including the staging of political rallies. 5 The investigation did not identify evidence that any U.S. persons knowingly or intentionally coordinated with th e IRA's interference operation. (b)(7)(E)-2 By the end of the 2016 U.S . election, the IRA had the ability to reach millions of U.S. persons through their social media accounts. Multiple IRA-controlled Facebook groups and (b)(3)-2, (b)(7)(E)-1 2 The Office is aware of reports that other Russian entities engaged in similai· active measures operations targeting the United States. Some evidence collected by the Office con oborates those repo1ts, and the Office has shared that evidence with other offices in the Deprutment of Justice and FBI. (b)(7)(E)-2 4 As discussed in Prut V below, the active measures investigation has resulted in c1iminal chru·ges against 13 individual Russian nationals and three Russian entities, principally for conspiracy to defraud the United States, in violation of 18 U.S .C. § 371. See Volume I, Section V.A, infra; Indictment, United States v. Internet Research Agency, et al. , 1:18-cr-32 (D.D.C. Feb. 16, 2018), Doc. 1 ("Internet Research Agency Indictment"). (b)(7)(E)-2 14 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Instagram accounts had hundreds of thousands of U.S . paiiicipants. IRA-controlled Twitter accounts sepai·ately had tens of thousands of followers, including multiple U.S. political figures who retweeted IRA-created content. In November 2017, a Facebook representative testified that Facebook had identified 470 IRA-contrnlled Facebook accounts that collectively made 80,000 posts between Januaiy 2015 and August 2017. Facebook estimated the IRA reached as many as 126 million persons through its Facebook accounts.6 In Januaiy 2018, Twitter announced th at it had identified 3,814 IRA-controlled Twitter accounts and notified approximately 1.4 million people Twitter believed may have been in contact with an IRA-controlled account. 7 A. Structure of the Internet Research Agency (b) (7)(A), (b) (7)(E) : (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) I . I • I I , · (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 6 Social Media Influence in the 2016 US. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook) ("We (b)(7)(E)-2 estimate that roughly 29 million people were se1ved content in their News Feeds directly from the IRA's 80,000 posts over the two years. Posts from these Pages were also shared, liked, and followed by people on Facebook, and, as a result, three times more people may have been exposed to a sto1y that originated from the Russian operation. Our best estimate is that approximately 126 million people may have been se1ved content from a Page associated with the IRA at some point dming the two-year period."). The Facebook representative also testified that Facebook had identified 170 Instagram accounts that posted approximately 120,000 pieces of content dming that time. Facebook did not offer an estimate of the audience reached via Instagram. (b)(3)-2, (b)(7)(E)-1 7 Twitter, Update on Twitter's Review of the 2016 US Election (Jan. 31, 2018). (b)(7)(E)-2 8 See SM-2230634, serial 92. (b)(7)(E)-2 9 (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3) (b) (7)(A), (b) (7)(E) (b)(3)-2, (b)(7)(E)-1 10 ) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3) 11 See SM-2230634, serial 86 (b) (7)(A), (b) (7)(E) 15 (b)(7)(E)-2 (b)(3)-2, (b)(7)(E)-1 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 3 Two individuals headed the IRA’s management: its general director, Mikhail Bystrov, and its executive director, Mikhail Burchik. (b) (7)(A), (b) (7)(E) 14 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 15 As early as the spring of 2014, the IRA began to hide its funding and activities. (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 16 The IRA’s U.S. operations are part of a larger set of interlocking operations known as “Project Lakhta,” (b) (7)(A), (b) (7)(E) 7 (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) 18 B. Funding and Oversight from Concord and Prigozhin (b)(7)(E)-2 Until at least February 2018, Yevgeniy Viktorovich Prigozhin and two Concord companies funded the IRA. Prigozhin is a wealthy Russian businessman who served as the head of Concord. (b)(3)-2, (b)(7)(E)-1 (b) (7)(A), (b) (7)(E) 13 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E), (b) (3) 14 See, e.g., SM-2230634, serials 9, 113 & 180 (b) (7)(A), (b) (7)(E) 15 (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3) 16 (b) (7)(A), (b) (7)(E) (b)(3)-2, (b)(7)(E)-1 See SM-2230634, serials 131 & 204. 17 (b) (7)(A), (b) (7)(E) 18 (b) (7)(A), (b) (7)(E) (b)(3)-2, (b)(7)(E)-1 (b)(3)-2, (b)(7)(E)-1 (b) (7)(A), (b) (7)(E), (b) (3) (b) (7)(A), (b) (7)(E), (b) (3) (b) (7)(A), (b) (7)(E) 16 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} IL I . . • • •! . I I . I I I ! . I (b)(3)-2, (b)(7)(E)-1 b} (7}(A}, (b} (7}(E}, (b} (3) I I . . I !. I • I I . • (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 ll(b} (7}(A}, (b} (7}(E} (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 ll(b} (7}(A}, (b} (7}(E} (b) (7)(A). (b) (7)(E). (b) (7)(C), (b) (6) (b) (7}(A}, (b} (7}(E} (b)(6)/(b)(7)(C)-4 fil{D) {/){A), {D) {/){t:) (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} 19 U.S. Treasmy Department, "Treasmy Sanctions Individuals and Entities in Connection with Russia's Occupation of Crimea and the Conflict in Ukraine" (Dec. 20, 2016). (b)(3)-2 (b)(7)(E)-1 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 22 See, e.g. , Neil MacFarquhar, Yevgeny Prigozhin, Russian Oligarch Indicted by US., Is Known (b)(3)-2, (b)(7)(E)-1 as "Putin 's Cook", New York Times (Feb. 16, 2018). (b) (7)(A), (b) (7)(E), (b) (3) (b)(7)(E)-2 24 {b) {7){A), {b) {7){E), {b) (b} (7}(A}, (b} (7}(E} {3) (b) (7)(A), (b) (7)(E) {b) {7){A), {b) {7){E), {b) (3) see also SM- 17 (b)(3)-2 (b)(7)(E)-1 (b)(7)(E)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 ril(b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(3)-2, (b)(7)(E)-1 (b)(7)(E)-2 (7)(A), (b) (7)(E), (b) (3) (7)(A), (b) (7)(E), (b) (3) 26 (b ) (7 )(A), (b) (7 )(El (b) 27 (b) {7)(A), (b) {7)(El (b) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 28 The term "troll" refers to internet users- in this context, paid operatives- who post inflammatory or otherwise dismptive content on social media or other websites. (b)(3)-2, (b)(7)(E)-1 18 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) I' • . • • .. . . ' • I I .. .. ... I (b) (7)(A), (b) (7)(E) .. (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) In May 2016, IRA employees, claiming to be U .S. social activists an d administrators of Facebook groups, recmited U.S. persons to hold signs (including one in front of the White House) th at read "Happy 55th Birthda Dear Boss," as an homa e to Pri ozhin whose 55th bi1i hda was on June 1, 2016 .31 \tJJ \I l\"'I , \I.I/ \I J\L..) (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 C. The IRA Targets U.S. Elections 1. The IRA Ramps Up U.S. Operations As Early As 2014 .• I . • .- ••• • I'• ... I . ••• • . I . I •. • . I'- • .. • • . I I (b) (7)(A), (b) (7)(E) . • • • • • I I • I I I I . . • !• I . I . I I • I I I . I • : • J . I . I (b)(7)(E)-2 subdivided the Translator Depaiiment into different responsibilities, ranging from operations on different social media platfon ns to analytics to I'• 29 (b} (7}(A}, (b} (7}(E} se1ials 131 & 204. (b)(7)(E)-2 30 31 See SM-2230634, See SM-2230634, serial 156. Internet Research Agency Indictment 1479936895656747 (United Muslims of America) (b) (7)(A), (b) (7)(E) (bl (])(Al. (b l (])(El. (bl (61. (bl (7)(C) , , I I I ,r &~;=~:;~;;Eii:11 , .. . .. (b)(6)/(b)(7)(C)-1 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2, (b)(6)/(b)(7)(C)-1 (b)(7)(E)-2, (b)(6)/(b)(7)(C)-1 19 (b)(7)(E)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) graphics and IT. (b} (7}(A}, (b} (7}(E} ll(b} (7}(A}, (b) (7) (E} (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} 34 See SM-2230634, serial 204 (b} (7}(A}, (b} (7}(E} 20 (b)(7)(E)-2 U.S. Depaiiment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) 37 IRA employees also traveled to the United States on intelligence-gathering missions. In June 2014, four IRA employees applied to the U.S. Department of State to enter the United States, while lying about the purpose of their trip and claiming to be four friends who had met at a patty. 38 Ultimately, two IRA employees- Anna Bogacheva and Aleksandra Ktylova- received visas and entered the United States on June 4, 2014. ... .. . t : I !. I • I I . (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 · (b) (7)(A), (b) (7)(E) (b)(7)(E)-1, (b)(3)-2 (b)(7)(E)-2 35 i&fPiSl&fPiRI (b) (7)(A), (b) (7)(E), (b) (3) lllllllliiilflm1UXl!JW1PJ8IIP18WIIP1N! 1 (b} (7}(A}, (b} (7}(E} (b) (7)(A), (b) (7)(E) (b)(7)(E)-1, (b)(3)-2 37 (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3) 38 See SM-2230634, serials 150 & 172 (b) (7)(A), (b) (7)(E) • (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)( E), (b) (b)(7)(E)-2 iffPISlifPi!i (3l(b) (7)(A), (b) (7)(E) 21 (b)(3)-2, (b)(7)(E)-1 (b)(7)(E)-2 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b)(6)/ (b)(7)(C)-4 (b)(7)(E)-2 2. U.S. Operations Throu gh IRA-Controlled Social Media Accounts Dozens of IRA employees were responsible for operating accounts and personas on different U.S. social media platfon ns. The IRA refe1Ted to employees assigned to operate the social media accounts as "specialists."42 Staiiing as early as 2014, the IRA's U.S. operations included social media specialists focusing on Facebook, YouTube, and Twitter. 43 The IRA later added specialists who operated on Tumbfr and Instagram accounts. 44 Initially, the IRA created social media accounts that pretended to be the personal accounts of U.S. persons.45 By eai·ly 2015 , the IRA began to create lai·ger social media groups or public social media pages that claimed (falsely) to be affiliated with U.S . political and grassroots organizations. In certain cases, the IRA created accounts that mimicked real U.S. organizations. For example, one IRA-contrnlled Twitter account, @TEN_ GOP, pmpo1ied to be connected to the Tennessee Republican Paiiy. 46 More commonly, the IRA created accounts in the nam es of fictitious U.S. organizations and grassroots groups an d used these accounts to pose as anti­ immigration groups, Tea Paiiy activists, Black Lives Matter protesters, and other U.S. social and political activists. (b)(7)(E)-2 (b)(3)-2, (b)(7)(E)-1 (b} (7}(A}, (b} (7}(E} \DJ l t JlAJ , \ DJ l t Jl t:J, \ DJ l->J (b)(7)(E)-2 ·' (b} (7}(A}, (b} (7}(E} (bl (?)(A}, (bl (?HE}, (bl 13 ) (b} (7}(A}, (b} (7}(E} (0) (/)(A), (0) (7)(E), (b) (3) (b} (7}(A} , (b} (7}(E} · (b} (7}(A}, (b} (7}(E} (b) (7)(A), (b) (7)(E), (b) (3) (b} (7}(A} , (b} (7}(E} (b)(7)(E)-2 (b)(7)(E)-1, (b)(3)-2 (b) (7)(A) , (b) (7)(E), (b) (3) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) 45 See, e.g. , Facebook ID 100011390466802 (Alex Anderson); Facebook ID 100009626173204 (Andrea Hansen); Facebook ID 100009728618427 (Ga1y Williams); Facebook ID 100013640043337 (Lakisha Richardson). 46 The account claimed to be the "Unofficial Twitter of Tennessee Republicans" and made posts that appeared to be endorsements of the state political party. See, e.g. , @TEN_GOP, 4/3/ 16 Tweet ("Tennessee GOP backs @realDonaldTmmp pe1iod #makeAmericagreatagain #tngop #tennessee #gop"). 22 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b)(7)(E)-2 (b)(7)(E)-2 (b)(7)(E)-2 The focus on the U.S . presidential campaign continued throughout 2016. rnilllll 2016 (b)(7)(E)-2 internal (b)(7)(A) , (E) reviewing the IRA-contrnlled Facebook group "Secured B ~," the (b)(3)-2, (b)(7)(E)-1 (b)(7)(E)-2 41 i&fPiSl&fPiBI (b) (7)(A), (b) (7)(E), (b) (3) 48 See, e.g. , SM-2230634 serial 131 (b) (7)(A), (b) (7)(E) 49 (b)(7)(A).(b)(7)(E) (b)(7)(E)-2 The IRA posted content about the Clinton candidacy before Clinton officially announced her presidential campaign. IRA-controlled social media accounts c1i ticized Clinton's record as Secreta1 of State and romoted various criti ues of her candidac . The IRA also used other techni ues. so (b) (7)(A), (b) (7)(E) 23 U.S. Depaiiment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) auth or criticized the "lower number of posts dedicated to criticizing Hilla1y Clinton" and reminded the Facebook specialist "it is imperative to intensify criticizing Hillaiy Clinton."51 IRA employees also acknowled ed that their work focused on influencino the U.S. - - election. '-IIIIAIIIUI.U ~IIIIIIAlllllli (b)(7)(E)-2 3. U.S. Operations Through Facebook (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} I I I (b} (7}(A}, (b} (7}(E} (b) (7}(A}, (b} (7}(E} (b) (7)(A), (b) (7)(E) •. I • I. ! • . . (b)(7)(E)-2 !" • • IRA Facebook groups active mcluded pmported conservative (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 52 (b)(7)(A), 53 54 u (E)(b) 1w1 1w1@ !@1P1WIWI (b)(3)-2, (b)(7)(E)-1 (b)(3)-2, (b)(7)(E)-1 (b) (7)(A), (b) (7)(E) (b} (7}(A), (b) (7)(E) (b) (3), (b) (7)(A), (b) (7)(E) (b) (7}(A), (b) (7)(E) (b) (3), (b) (7)(A), (b) (7)(E) (3), (b) (7)(A), (b) (7)(E) 24 (b)(7)(E)-2 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) groups (with names such as "Being Patriotic," "Stop All Immigrants," "Secured Borders," and "Tea Party News"), purpo1ted Black social justice groups ("Black Matters," "Blacktivist," and "Don't Shoot Us"), LGBTQ groups ("LGBT United"), and religious groups ("United Muslims of America"). Throughout 2016, IRA accounts published an increasing number of materials suppo1ting the Tnnnp Campaign and opposing the Clinton Campaign. For example, on May 31, 2016, the operational account "Matt Skiber" began to privately message dozens of pro-Tnnnp Facebook groups asking them to help plan a "pro-Tnnnp rally near Tnunp Tower."55 To reach larger U.S. audiences, the IRA purchased adve1tisements from Facebook that promoted the IRA groups on the newsfeeds of U.S . audience members. According to Facebook, the IRA purchased over 3,500 adve1t isements, and the expenditures totaled approximately $100,000. 56 During the U.S. presidential campaign, many IRA-purchased adve1tisements explicitly supported or opposed a presidential candidate or promoted U.S . rallies organized by the IRA (discussed below). As early as March 2016, the IRA purchased advertisements that overtly opposed the Clinton Campaign. For example, on March 18, 2016, the IRA purchased an adve1tisement depicting candidate Clinton and a caption that read in pali, "If one day God lets this liar enter the White House as a president - that day would be a real national tragedy."57 Similarly, on April 6, 2016, the IRA purchased adve1tisements for its account "Black Matters" calling for a "flashmob" of U.S . persons to "take a photo with #Hilla1yClintonForPrison2016 or #nohillaiy2016." 58 IRA-purchased adve1tisements featuring Clinton were, with ve1y few exceptions, negative. 59 IRA-purchased adve1tisements referencing candidate Tnnnp lai·gely suppo1ted his campaign. The first known IRA adve1tisement explicitly endorsing the Tnunp Campaign was purchased on April 19, 2016. The IRA bought an adve1tisement for its Instagram account "Tea Paity News" asking U.S. persons to help them "make a patriotic team of young Tnnnp suppo1ters" by uploading photos with the hashtag "#KIDS4TRUMP." 60 In subsequent months, the IRA purchased dozens of adve1tisements supporting the Tnunp Campaign, predominantly through the Facebook groups "Being Patriotic," "Stop All Invaders," and "Secured Borders." 55 ~Wl@lflQI@l (b)(6)/ 5/31/ 16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID 5/31/ 16 Facebook Message, ID 100009922908461 Matt S er) to ID 56 Social Media Influence in the 2016 US. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/ 17) (testimony of Colin Stretch, General Counsel of Facebook). 57 3/ 18/ 16 Facebook Adve1tisement ID 6045505152575. 58 4/6/ 16 Facebook Adve1tisement ID 6043740225319. 59 See SM-2230634, serial 213 (documenting politically-oriented adve1tisements from the larger set provided by Facebook). 60 4/ 19/ 16 Facebook Adve1tisement ID 6045151094235. 25 (b)(7)(C)-1 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Collectively, the IRA's social media accounts reached tens of millions of U.S. persons. Individual IRA social media accounts attrncted hundreds of thousands of followers. For example, at the time they were deactivated by Facebook in mid-2017, the IRA's "United Muslims of America" Facebook group had over 300,000 followers, the "Don't Shoot Us" Facebook group had over 250,000 followers, the "Being Patriotic" Facebook group had over 200,000 followers, and the "Seem ed Borders" Facebook group had over 130,000 followers.61 According to Facebook, in total the IRA-controlled accounts made over 80,000 posts before their deactivation in August 2017, and these posts reached at least 29 million U.S persons and "may have reached an estimated 126 million people."62 4. U.S. Operations Through Twitter • •· I I . • I' . . I • ~ . . ed to the Translator De aii ment served as Twitter (b) (7)(A), (b) (7)(E) I I . I I (b)(7)(E)-2 I I · I I' • I •· , •. I I • • I (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 Sepai·ately, the IRA operated a network of automated Twitter accounts (commonly refened to as a bot network) that enabled the IRA to amplify existing content on Twitter. a. Individualized Accounts (b) (7)(A), (b) (7)(E) · (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) 61 See Facebook ID 1479936895656747 (United Muslims 1157233400960126 (Don't Shoot); Facebook ID 1601685693432389 757183957716200 Secured Borders). \LIJ \I J\M.J, \LIJ \I J\J;;.J - I I - II II I (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) 62 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (I 1/1/17) (testimony of Colin Stretch, General Counsel of Facebook). (b)(7)(E)-2 (b)(7)(E)-2 (b)(7)(E)-2 63 (b) (7)(A) , (b) (7)(E) (b)(7)(E)-2 64 (b) (7)(A) , (b) (7)(E) (b)(7)(E)-2 (b)(7)(E)-2 i&fPiRl&fPi!i (b) (3), (b) (7)(A), (b) (7)(E) i&fPiSl&fPiWI (b) (3), (b) (7)(A), (b) (7)(E) 65 i&fPiRIWfPiBI (b) (3), (b) (7)(A), (b) (7)(E) 26 (b) (7)(A) , (b) (7)(E) (b)(3)-2, (b)(7)(E)-1 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b) (7)(A), (b) (7)(E) 66 (b)(7)(E)-2 The IRA operated individualized Twitter accounts similar to the operation of its Facebook accounts, by continuously posting original content to the accounts while also communicating with U.S. Twitter users directly (through public tweeting or Twitter's private messaging) . The IRA used many of these accounts to attempt to influence U.S. audiences on the election. Individualized accounts used to influence the U.S. presidential election included @TEN_GOP (described above); @jenn_abrams (claiming to be a Virginian Trnmp supporter with 70,000 followers); @Pamela_Moore13 (claiming to be a Texan Trnmp suppo1ter with 70,000 followers); and @America_l st_ (an anti-immigration persona with 24,000 followers). 67 In May 2016, the IRA created the Twitter account @march_for_trnmp, which promoted IRA-organized rallies in suppo1t of the Tnnnp Campaign (described below).68 (b)(7)(E)-2 (b)(7)(E)-2 Using these accounts and others, the IRA provoked reactions from users and the media. Multiple IRA-posted tweets gained popularity.70 U.S . media outlets also quoted tweets from IRA-controlled accounts and attributed them to the reactions of real U.S . persons.71 Similarly, numerous high- (b)(3)-2 (b)(7)(E)-1 (b)(7)(E)-2 66 (b) (7)(A), (b) (7)(E) (b) (3), (b) (7)(A), (b) (7)(E) :Wf8i91if81!1 (b)(7)(E)-2 67 Other individualized accounts included @MissouriNewsUS (an account with 3,800 followers that posted pro-Sanders and anti-Clinton material). 68 See@march_for_trnmp, 5/30/ 16 Tweet (first post from account). (b)(7)(E)-2 ° 7 For example, one IRA account tweeted, "To those people, who hate the Confederate flag. Did you know that the flag and the war wasn't about slave1y, it was all about money." The tweet received over 40,000 responses. @Jenn_Abrams 4/24/17 (2:37 p.m.) Tweet. 71 Josephine Lukito & Chiis Wells, Most Major Outlets Have Used Russian Tweets as Sources for Partisan Opinion: Study, Columbia Journalism Review (Mar. 8, 2018); see also Twitter Steps Up to &ryour support Miami! My team JUSt shared S)hotos from your TRUMP SIGN WAVING OAY. yestorday! I low yoo · and th«• is 00 quesoon • TOGETHER, WE WILL MAKE AMERICA GREAT AGAIN! On September 19, 2017, President T111mp 's personal account @realDonaldTnunp responded to a tweet from the IRA-controlled account @l0_gop (the backup account of @TEN_GOP, which had ah-eady been deactivated by Twitter). The tweet read: "We love you, Mr. President! " 104 IRA employees monitored the reaction of the Tnunp Campaign and, later, T111mp Administration officials to their tweets. For exainple, on August 23, 2016, the IRA­ controlled persona "Matt Skiber" Facebook account sent a message to a U.S. Tea Paiiy activist, writing that "Mr. T111mp posted about our event in Miaini! This is great!"105 The IRA employee included a screenshot of candidate T111mp's Facebook account, which included a post about the August 20, 2016 political rallies organized by the IRA. Screenshot ofT1·wnp Facebook Account (from Matt Skiber) (b)(6)/ (b)(7)(C)-1 97 @EiicT111mp 10/20/16 Tweet ("RT @TEN_GOP: BREAKING Hilla1y shuts down press conference when asked about DNC Operatives com1ption & #VoterFraud #debatenight #T111mpB"). 98 @KellyannePolls 11/6/ 16 Tweet ("RT @TEN_GOP: Mother of jailed sailor : ' Hold Hillaiy to same standai·ds as my son on Classified info' #hilla1ysemail #WeinerGate."). 99 @pai·scale 10/ 15/ 16 Tweet ("Thousands of deplorables chanting to the media: 'Tell The T111th! ' RT if you ai·e also done w/ biased Media! #F1idayFeeling"). 100 @GenFlynn 11/7/ 16 (retweeting @TEN_GOP post th at included in pait "@realDonaldT111mp &@mike_pence will be our next POTUS & VPOTUS."). 101 @TEN_GOP 10/ 11/16 Tweet ("No1th Cai·olina finds 2,214 voters over the age of 110! !"). 102 @TEN_GOP 11/6/ 16 Tweet ("Mother of jailed sailor: ' Hold Hilla1y to same standards as my son on classified info #hilla1yemail #WeinerGate. '"). 103 @DonaldJTmmpJr 11/7/ l 6 Tweet ("RT @Pamela_Moorel3: Detroit residents speak out against the failed policies of Obama, Hilla1y & democrats . ... "). 104 @rea1DonaldT111mp 9/ 19/ 17 (7:33 p.m.) Tweet ("THANK YOU for your suppo1t Miami ! My team just shared photos from your TRUMP SIGN WAVING DAY, yesterday! I love you - and there is no question- TOGETHER, WE WILL MAKE AMERICA GREAT AGAIN!"). 105 (b)(6)/ 8/23/ 16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID (b) (6), (b) (7)(C) (b)(7)(C)-1 34 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b} (7}(A}, (b} (7}(E} ,. (b)(7)(E)-2 b. Contact with Trump Campaign Officials in Connection to Rallies Staii ing in June 2016, the IRA contacted different U. S. persons affiliated with the Tnnnp Campaign in an effo1i to coordinate pro-Trnmp IRA-organized rallies inside the United States. In all cases, the IRA contacted the Campaign while claiming to be U.S. political activists working on behalf of a conservative grassroots organization. The IRA's contacts included requests for signs and other materials to use at rallies, 107 as well as requests to promote the rallies and help coordinate logistics.108 While ce1iain campaign volunteers agreed to provide the requested suppo1i (for example, agreeing to set aside a number of signs), the investigation has not identified evidence that any Tnnnp Campaign official understood the requests were coming from foreign nationals. *** In sum, the investigation established that Russia interfered in the 201 6 presidential election through the "active measures" social media campaign caITied out by the IRA, an organization funded by Prigozhin and companies that he controlled. As explained fini her in Volume I, Section V.A, infra, the Office concluded (and a gran d jmy has alleged) that Prigozhin, his companies, and IRA employees violated U.S . law through these operations, principally by undermining through deceptive acts the work of federal agencies chai·ged with regulating foreign influence in U.S. elections. I, (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 • t I ' :, I • •• I ' . :, I .. I t • I t . . • •• .• •• • • • •I , . • •• . • •• • I ' 35 I • (b)(G), (b)(7)(C) ••• •• • • (b)(6)/ • • .• (b)(7)(C)-1 • •• • (b)(6)/ • (b)(7)(C)-1 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) III. RUSSIAN HACKING AND DUMPING OPERATIONS Beginning in March 2016, units of the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU) hacked the computers and email accounts of organizations, employees, and volunteers supporting the Clinton Campaign, including the email account of campaign chairman John Podesta. Starting in April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC). The GRU targeted hundreds of email accounts used by Clinton Campaign employees, advisors, and volunteers. In total, the GRU stole hundreds of thousands of documents from the compromised email accounts and networks.109 The GRU later released stolen Clinton Campaign and DNC documents through online personas, “DCLeaks” and “Guccifer 2.0,” and later through the organization WikiLeaks. The release of the documents was designed and timed to interfere with the 2016 U.S. presidential election and undermine the Clinton Campaign. The Trump Campaign showed interest in the WikiLeaks releases and, in the summer and fall of 2016, Roger Stone tried to connect with WikiLeaks founder Julian Assange through intermediaries. Stone boasted to senior Campaign officials about his access to Assange. After Stone’s prediction of WikiLeaks’s first Clinton-related release proved true, the Trump Campaign stayed in contact with Stone about WikiLeaks’s activities. The investigation was unable to resolve whether Stone played a role in WikiLeaks’s release of the stolen Podesta emails on October 7, 2016, the same day a video from years earlier was published of Trump using graphic language about women. A. GRU Hacking Directed at the Clinton Campaign 1. GRU Units Target the Clinton Campaign Two military units of the GRU carried out the computer intrusions into the Clinton Campaign, DNC, and DCCC: Military Units 26165 and 74455.110 Military Unit 26165 is a GRU cyber unit dedicated to targeting military, political, governmental, and non-governmental organizations outside of Russia, including in the United States.111 The unit was sub-divided into departments with different specialties. One department, for example, developed specialized malicious software (“malware”), while another department conducted large-scale spearphishing campaigns.112 (b) (7)(A), (b) (7)(E) a bitcoin mining operation to 109 As discussed in Section V below, our Office charged 12 GRU officers for crimes arising from the hacking of these computers, principally with conspiring to commit computer intrusions, in violation of 18 U.S.C. §§1030 and 371. See Volume I, Section V.B, infra; Indictment, United States v. Netyksho, No. 1:18-cr-215 (D.D.C. July 13, 2018), Doc. 1 (“Netyksho Indictment”). 110 Netyksho Indictment ¶ 1. 111 Separate from this Office’s indictment of GRU officers, in October 2018 a grand jury sitting in the Western District of Pennsylvania returned an indictment charging certain members of Unit 26165 with hacking the U.S. Anti-Doping Agency, the World Anti-Doping Agency, and other international sport associations. United States v. Aleksei Sergeyevich Morenets, No. 18-263 (W.D. Pa.). 112 A spearphishing email is designed to appear as though it originates from a trusted source, and solicits information to enable the sender to gain access to an account or network, or causes the recipient to 36 (b)(7)(E)-2 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) secure bitcoins used to purchase computer infrastm cture used in hacking operations. 113 Militaiy Unit 74455 is a related GRU unit with multiple depaiiments that engaged in cyber operations. Unit 74455 assisted in the release of documents stolen by Unit 26165 , the promotion of those releases, an d the publication of anti-C linton content on social media accounts operated by th e GRU . Officers from Unit 74455 sepai·ately hacked computers belonging to state boai·ds of elections, secretai·ies of state, and U.S. companies that supplied softwai·e and other technology related to the administrntion of U .S. elections.11 4 Beginning in mid-March 2016, Unit 26165 had prima1y responsibility for hacking the DCCC an d DNC, as well as em ail accounts of individuals affiliated with the Clinton Campaign: 115 Unit 26165 used (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 began before the GRU had obtained any credentials or gained access to t ese networ s, m 1cating that the later DCCC and DNC intm sions were not crimes of oppo1iunity but rather the result of targeting. 116 GRU officers also sent hundreds of speai-phishing emails to the work and personal email accounts of Clinton Campaign employees and volunteers. Between M ai·ch 10, 2016 and M ai·ch 15, 2016, Unit 26165 appears to have sent approximately 90 speai-phishing emails to email accounts at hillaiyclinton .com . Sta1iing on March 15, 2016, the GRU began tai·geting Google email accounts used by Clinton Campaign employees, along with a smaller number of dnc.org email accounts .117 The GRU speai-phishing operation enabled it to gain access to numerous email accounts of Clinton Campaign employees and volunteers, including campaign chaiim an John Podesta, j unior volunteers assigned to the Clinton Campaign 's advance team , info1mal Clinton Campaign advisors, an d a DNC employee.11 8 GRU officers stole tens of thousan ds of em ails from speai-phishing victims, including vai·ious Clinton Campaign-related collllllunications. download malware that enables the sender to gain access to an account or network. Netyksho Indictment ,i 10. 113 Bitcoin mining consists of unlocking new bitcoins by solving computational problems. (b)(7)(E)-2 illllll kept its newly mined coins in an account on the bitcoin exchange platfo1m CEX.io. To i : ~ ases, the GRU routed funds into other accounts through transactions designed to obscure the source of funds . Netyksho Indictment ,i 62. 114 Netyksho Indictment ,i 69. 115 Netyksho Indictment ,i 9. 116 See SM-2589105, se1ials 144 & 495 . (b)(7)(E)-2 118 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 37 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) 2. Intrusions into the DCCC and DNC Networks a. Initial Access By no later than April 12, 2016, the GRU had gained access to the DCCC computer network using the credentials stolen from a DCCC employee who had been successfully spearphished th e week before. Over th e ensuing weeks, the GRU ti·aversed the network, identifying different computers connected to the DCCC network. By stealing network access credentials along the way (including those of IT administi·ators with miresti·icted access to the system), the GRU compromised approximately 29 different computers on the DCCC network. 119 Approximately six days after first hacking into th e DCCC network, on April 18, 2016, GRU officers gained access to the DNC network via a virtual private network (VPN) connection120 between the DCCC and DNC networks. 121 Between April 18, 2016 and June 8, 2016, Unit 26165 compromised more than 30 computers on the DNC network, including the DNC mail server and shared file server. 122 b. Implantation of Malware on D CCC and DNC Networks Unit 26165 implanted on the DCCC an d DNC networks two types of customized malware, 123 known as "X-Agent" an d "X-Tunnel"; Mimikatz, a credential-harvesting tool; and rar .exe, a tool used in th ese intrnsions to compile and compress materials for exfilti·ation. X-Agent was a multi-function hacking tool that allowed Unit 26165 to log keysti-okes, take screenshots, and gather other data about the infected computers (e.g., file directories, operating systems). 124 X­ Tunnel was a hacking tool that created an enc1ypted connection between the victim DCCC/DNC computers and GRU-conti·olled computers outside the DCCC and DNC networks that was capable of large-scale data ti·ansfers.125 GRU officers th en used X-Tunnel to exfilti-ate stolen data from the victim computers. (b)(7)(E)-2 120 A VPN extends a private network, allowing users to send and receive data across public networks (such as the internet) as if the connecting computer was directly connected to the p1ivate network. The VPN in this case had been created to give a small number of DCCC employees access to ce1t ain databases housed on the DNC network. Therefore, while the DCCC employees were outside the DNC's private network, they could access paits of the DNC network from their DCCC computers. (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 123 "Malwai·e" is sho1t for malicious softwai·e, and here refers to softwai·e designed to allow a third paity to infiltrate a computer without the consent or knowledge of the computer's user or operator. (7)(A), (b) (7)(E) (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 124 (b) 125 38 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) To operate X-Agent and X-Tunnel on the DCCC an d DNC networks, Unit 26165 officers set up a group of computers outside those networks to collllllunicate with the implanted malware. 126 The first set of GRU-controlled computers, known by the GRU as "middle servers," sent and received messages to and from malware on the DNC/DCCC networks. The middle servers, in tum, relayed messages to a second set of GRU-controlled com uters labeled internally by the GRU as an "AMS Panel." The AMS Panel • served as a (b)(7)(E)-2 nerve center through which GRU officers monitored and directed the m alwar e's operations on the DNC/DCCC networks. 127 ••iii The AMS Panel used to control X-A ent during the DCCC and DNC intrusions was housed on a leased com uter located near · Arizona. 128 \U/\I l\""I, \U]\I ]\CJ (b)(7)(E)-2 (b)(7)(A}, (b)(7)(E} (b)(7) (E)-2 (b)(7)(A}, (b)(7)(E} (b)(7)(E)-2 126 In connection with these intrnsions, the GRU used computers (virtual private networks, dedicated servers operated by hosting companies, etc.) that it leased from third-party providers located all over the world. The investi ation identified rental a ·eements and payments for computers located in, inter alia, Nlill•IAI!!~ all of which were used in the operations (b)(7)(E)-2 targetrng t e U.S . e ectron. 127 Netyksho Indictment ,i 25. 128 Netyksho Indictment ,i 24(c). 129 Netyksho Indictment ,i 24(b). 39 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) The Arizona-based AMS Pan el also stored thousands of files containing keylogging sessions captured through X-Agent. These sessions were captured as GRU officers monitored DCCC and DNC employees' work on infected computers regularly between April 2016 and June 2016. Data captured in these keylogging sessions included passwords, internal collllllunications between employees, banking info1mation, an d sensitive personal info1mation. c. Theft of Documents from DNC and DCCC Networks Officers from Unit 26165 stole thousands of documents from the DCCC an d DNC networks, including significant amounts of data pertaining to th e 2016 U.S. federal elections. Stolen documents included internal strategy documents, fundraising data, opposition research, and emails from the work inboxes of DNC employees. 130 The GRU began stealing DCCC data sho1ily after it gained access to the network. On April 14, 2016 (approximately three days aBer the initial intru sion) GRU officers downloaded rar.exe onto th e DCCC's document server. The following day, the GRU searched one comproinised DCCC computer for files containing search ten ns that included "Hilla1y ," "DNC," "Cmz," and "Tnnnp." 131 On April 25 , 2016, the GRU collected and compressed PDF and Microsoft documents from folders on the DCCC 's shared file server that pe1iained to the 2016 election.132 The GRU appears to have compressed an d exfilti·ated over 70 gigabytes of data from this file server. 133 The GRU also stole documents from the DNC network sho1ily after gaining access. On April 22, 2016, the GRU copied files from the DNC network to GRU-conti·olled computers. Stolen documents included the DNC's opposition research into can didate Tmmp.i 34 Between approximately May 25, 2016 and June 1, 2016, GRU officers accessed th e DNC 's mail server from a GRU-conti·olled computer leased inside the United States. 135 Dming these connections, 130 Netyksho Indictment ff 27-29; (b} (7}(A}, (b} (7}(E} 131 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 · (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 SM-2589105-HACK, sen a 5. (b} (7}(A}, (b} (7}(E} (b} (7}(A}, (b} (7}(E} See SM-2589105-GJ, sena 649. As pa1t o its mvestigation, e FBI ater receive • se1vers and copies of relevant traffic logs. Netyksho Indictment ,i,i 28-29. 40 (b)(7)(E)-2 I :, - • I U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Unit 26165 officers appear to have stolen thousan ds of emails and attachments, which were later released by WikiLeaks in July 2016.136 B. Dissemination of the Hacked Materials The GRU's operations extended beyond stealing materials, an d included releasing documents stolen from th e Clinton Campaign and its supporters. The GRU can ied out the anonymous release through two fictitious online personas that it created-DCLeaks and Guccifer 2.0- and later through the organization WikiLeaks. 1. DCLeaks The GRU began planning the releases at least as early as April 19, 2016, when Unit 26165 registered the domain dcleaks.com through a service that an onymized the registrnnt. 137 Unit 26165 paid for the registration using a pool of bitcoin that it had mined. 138 The dcleaks.com landing page pointed to different ti·anches of stolen documents, ~m anged by victim or subject matter. Other dcleaks.com pages contained indexes of th e stolen emails that were being released (bearing the sender, recipient, an d date of the email) . To control access and the timing ofreleases, pages were sometimes password-protected for a period of time and later made unresti·icted to the public. Staiiing in June 2016, the GRU posted stolen documents onto th e website dcleak s.com, including documents stolen from a number of individuals associated with the Clinton Campaign. These documents appeared to have originated from personal email accounts (in pa1ticular, Google and Microsoft accounts), rather than the DNC an d DCCC computer networks. DCLeaks victims included an advisor to the Clinton Campaign, a fo1m er DNC employee and Clinton Campaign employee, and four other campaign volunteers.139 The GRU released through dcleaks.com th ousands of documents, including personal identifying and financial info1mation, internal con espondence related to the Clinton Campaign and prior political jobs, an d fundraising files and infoimation.140 Netyksho Indictment ,r 29. The last-in-time DNC email released by WikiLeaks was dated May 25, 2016, the same pe1iod of time during which the GRU gained access to the DNC's email se1ver. Netyksho Indictment ,r 45. 136 Netyksho Indictment ,r 35. Approximately a week before the registration of dcleaks.com, the same actors attem ted to re ister the website electionleaks.com using the same domain registration se1vice. 137 138 (b)(7)(E)-2 See SM-2589105, se1ial 181; Netyksho Indictment ,r 2l(a). (b)(7)(E)-2 140 See, e.g., Internet Archive, "h s://dcleaks.com/" archive date Nov. 10, 2016). Additionally, DCLeaks released documents relating to.aiiJl:.Uili ~ - - ~ , emails belonging (b)(6)/ to and emails from 2015 re atmg to Repu can Party emp oyees un er the portfolio name (b)(7)(C)-4 "T e Urute States Republican Patty"). "The United States Republican Paity" po1tfolio contained approximately 300 emails from a variety of GOP members, PACs, campaigns, state paities, and businesses dated between May and October 2015. According to open-source reporting, these victims shared the same fflfWlfflllif!! 41 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) GRU officers operated a Facebook page under the DCLeaks moniker, which they primarily used to promote releases of materials.141 The Facebook page was administered through a small number of preexisting GRU-controlled Facebook accounts.142 GRU officers also used the DCLeaks Facebook account, the Twitter account @dcleaks_, and the email account dcleaksproject@gmail.com to communicate privately with reporters and other U.S. persons. GRU officers using the DCLeaks persona gave certain reporters early access to archives of leaked files by sending them links and passwords to pages on the dcleaks.com website that had not yet become public. For example, on July 14, 2016, GRU officers operating under the DCLeaks persona sent a link and password for a non-public DCLeaks webpage to a U.S. reporter via the Facebook account.143 Similarly, on September 14, 2016, GRU officers sent reporters Twitter direct messages from @dcleaks_, with a password to another non-public part of the dcleaks.com website.144 The DCLeaks.com website remained operational and public until March 2017. 2. Guccifer 2.0 On June 14, 2016, the DNC and its cyber-response team announced the breach of the DNC network and suspected theft of DNC documents. In the statements, the cyber-response team alleged that Russian state-sponsored actors (which they referred to as “Fancy Bear”) were responsible for the breach.145 Apparently in response to that announcement, on June 15, 2016, GRU officers using the persona Guccifer 2.0 created a WordPress blog. In the hours leading up to the launch of that WordPress blog, GRU officers logged into a Moscow-based server used and managed by Unit 74455 and searched for a number of specific words and phrases in English, including “some hundred sheets,” “illuminati,” and “worldwide known.” Approximately two hours after the last of those searches, Guccifer 2.0 published its first post, attributing the DNC server hack to a lone Romanian hacker and using several of the unique English words and phrases that the GRU officers had searched for that day.146 Tennessee-based web-hosting company, called Smartech Corporation. William Bastone, RNC E-Mail Was, In Fact, Hacked By Russians, The Smoking Gun (Dec. 13, 2016). 141 Netyksho Indictment ¶ 38. 142 See, e.g., Facebook Account 100008825623541 (Alice Donovan). 143 7/14/16 Facebook Message, ID 793058100795341 (DC Leaks) to ID (b) (6), (b) (7)(C) 144 (b)(6)/ (b)(7)(C)-1 See, e.g., 9/14/16 Twitter DM, @dcleaks_ to (b) (6), (b) (7)(C) 9/14/16 Twitter DM, (b) (6), (b) (7)(C) @dcleaks_ to The messages read: “Hi https://t.co/QTvKUjQcOx pass: (b)(6)/ KvFsg%*14@gPgu& enjoy ;).” (b)(7)(C)-1 145 Dmitri Alperovitch, Bears in the Midst: Intrusion into the Democratic National Committee, CrowdStrike Blog (June 14, 2016). CrowdStrike updated its post after the June 15, 2016 post by Guccifer 2.0 claiming responsibility for the intrusion. 146 Netyksho Indictment ¶¶ 41-42. 42 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) That same day, June 15, 2016, the GRU also used the Guccifer 2.0 WordPress blog to begin releasing to the public documents stolen from the DNC and DCCC computer networks. The Guccifer 2.0 persona ultimately released thousan ds of documents stolen from the DNC an d DCCC in a series of blog posts between June 15, 2016 an d October 18, 2016.147 Released documents included opposition research perfo1med by the DNC (including a memorandum analyzing potential criticisms of candidate Tnnnp), internal policy documents (such as recommendations on how to address politically sensitive issues), analyses of specific congressional races, and fundraising documents. Releases were organized around thematic issues, such as specific states (e.g. , Florida an d Pennsylvania) that were perceived as competitive in the 2016 U.S . presidential election. Beginning in late June 2016, the GRU also used the Guccifer 2.0 persona to release documents directly to reporters an d other interested individuals. Specifically, on June 27, 2016, Guccifer 2.0 sent an email to the news outlet The Smoking Gun offering to provide "exclusive access to some leaked emails linked [to] Hillaiy Clinton 's staff." 148 The GRU later sent the repo1ier a password and link to a locked po1iion of the dcleaks.com website that contained an ai·chive of emails stolen by Unit 26165 from a Clinton Campaign volunteer in March 2016. 149 That the Guccifer 2.0 persona provided repo1ters access to a restricted po1iion of the DCLeaks website tends to indicate that both personas were operated by the same or a closely-related group of people. 150 The GRU continued its release efforts through Guccifer 2.0 into August 2016. For example, on August 15, 2016, the Guccifer 2.0 persona sent a can didate for the U.S . Congress documents related to the candidate 's opponent. 151 On August 22, 2016, the Guccifer 2.0 persona transfen ed approximately 2.5 gigabytes of Florida-related data stolen from the DCCC to a U.S. blogger covering Florida politics.152 On August 22, 2016, the Guccifer 2.0 persona sent a U.S. repo1ier documents stolen from the DCCC pertaining to the Black Lives Matter movement. 153 147 Releases of documents on the Guccifer 2.0 blog occU1Ted on June 15, 2016; June 20, 2016; June 21 , 2016; July 6, 2016; July 14, 2016; August 12, 2016; August 15, 2016; August 21, 2016; August 31, 2016; September 15, 2016; September 23, 2016; October 4, 2016; and October 18, 2016. 148 6/27/ 16 Ema~ (subject "leaked emails") ; ■ (b)(6)/(b)(7)(C)-1 uccifer20@aol.fr to (b)(7)(E)-2 [t;>IMXQIWIMXW•- (b)(6)/(b)(7)(C)-1 (b)(7)(E)-2 150 Before sending the repo1t er the link and password to the closed DCLeaks website, and in an apparent effo1t to deflect attention from the fact that DCLeaks and Guccifer 2.0 were operated by the same organization, the Guccifer 2.0 persona sent the repo1ter an email stating that DCLeaks was a "Wikileaks sub project" and that Guccifer 2.0 had asked DCLeaks to release the leaked emails with "closed access" to give repo1t ers a preview of them. 151 Netyksho Indictment ,i 43(a). 152 Netyksho Indictment ,i 43(b). 153 Netyksho Indictment ,i 43(c). 43 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) The GRU was also in contact through the Guccifer 2.0 persona with Roger Stone, a former Trump Campaign member whose interest in material stolen from the Clinton Campaign is further discussed in Volume I, Section III.D.1, infra. After the GRU had published stolen DNC documents through Guccifer 2.0, Stone told members of the Campaign that he was in contact with Guccifer 2.0.154 In early August 2016, Stone publicly protested Twitter’s suspension of the Guccifer 2.0 Twitter account. After it was reinstated, GRU officers posing as Guccifer 2.0 wrote to Stone via private message, “thank u for writing back . . . do u find anyt[h]ing interesting in the docs i posted?” On August 17, 2016, the GRU added, “please tell me if i can help u anyhow . . . it would be a great pleasure to me.” On September 9, 2016, the GRU—again posing as Guccifer 2.0—referred to a stolen DCCC document posted online and asked Stone, “what do u think of the info on the turnout model for the democrats entire presidential campaign.” Stone responded, “pretty standard.”155 The investigation did not identify evidence of other communications between Stone and Guccifer 2.0. 3. Use of WikiLeaks In order to expand its interference in the 2016 U.S. presidential election, the GRU units transferred many of the documents they stole from the DNC and the chairman of the Clinton Campaign to WikiLeaks. GRU officers used both the DCLeaks and Guccifer 2.0 personas to communicate with WikiLeaks through Twitter private messaging and through encrypted channels, including possibly through WikiLeaks’s private communication system. a. WikiLeaks’s Expressed Opposition Toward the Clinton Campaign WikiLeaks, and particularly its founder Julian Assange, privately expressed opposition to candidate Clinton well before the first release of stolen documents. In November 2015, Assange wrote to other members and associates of WikiLeaks that “[w]e believe it would be much better for GOP to win . . . Dems+Media+liberals woudl [sic] then form a block to reign in their worst qualities. . . . With Hillary in charge, GOP will be pushing for her worst qualities., dems+media+neoliberals will be mute. . . . She’s a bright, well connected, sadisitic sociopath.”156 In March 2016, WikiLeaks released a searchable archive of approximately 30,000 Clinton emails that had been obtained through FOIA litigation.157 While designing the archive, one WikiLeaks member explained the reason for building the archive to another associate: 154 Gates 4/10/18 302, at 3. 155 8/15/16 – 9/9/16 Twitter DMs, @Guccifer_2 & @RogerJStoneJr. 156 11/19/15 Twitter Group Chat, Group ID 594242937858486276, @WikiLeaks et al. Assange also wrote that, “GOP will generate a lot oposition [sic], including through dumb moves. Hillary will do the same thing, but co-opt the liberal opposition and the GOP opposition. Hence hillary has greater freedom to start wars than the GOP and has the will to do so.” Id. 157 WikiLeaks, “Hillary Clinton Email Archive,” available at https://wikileaks.org/clinton-emails/. 44 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) [W]e want this repository to become “the place” to search for background on hillary’s plotting at the state department during 2009-2013. . . . Firstly because its useful and will annoy Hillary, but secondly because we want to be seen to be a resource/player in the US election, because eit [sic] may en[]courage people to send us even more important leaks.158 b. WikiLeaks’s First Contact with Guccifer 2.0 and DCLeaks Shortly after the GRU’s first release of stolen documents through dcleaks.com in June 2016, GRU officers also used the DCLeaks persona to contact WikiLeaks about possible coordination in the future release of stolen emails. On June 14, 2016, @dcleaks_ sent a direct message to @WikiLeaks, noting, “You announced your organization was preparing to publish more Hillary’s emails. We are ready to support you. We have some sensitive information too, in particular, her financial documents. Let’s do it together. What do you think about publishing our info at the same moment? Thank you.”159 (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 Around the same time, WikiLeaks initiated communications with the GRU persona Guccifer 2.0 shortly after it was used to release documents stolen from the DNC. On June 22, 2016, seven days after Guccifer 2.0’s first releases of stolen DNC documents, WikiLeaks used Twitter’s direct message function to contact the Guccifer 2.0 Twitter account and suggest that Guccifer 2.0 “[s]end any new material [stolen from the DNC] here for us to review and it will have a much higher impact than what you are doing.”160 On July 6, 2016, WikiLeaks again contacted Guccifer 2.0 through Twitter’s private messaging function, writing, “if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC is approaching and she will solidify bernie supporters behind her after.” The Guccifer 2.0 persona responded, “ok . . . i see.” WikiLeaks also explained, “we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie and hillary is interesting.”161 c. The GRU’s Transfer of Stolen Materials to WikiLeaks Both the GRU and WikiLeaks sought to hide their communications, which has limited the Office’s ability to collect all of the communications between them. Thus, although it is clear that the stolen DNC and Podesta documents were transferred from the GRU to WikiLeaks, (b)(7)(E)-2 (b) (7)(A), (b) (7)(E) - 158 3/14/16 Twitter DM, @WikiLeaks to (b) (6), (b) (7)(C) Less than two weeks earlier, the same account had been used to send a private message opposing the idea of Clinton “in whitehouse with her (b)(6)/ bloodlutt and amitions [sic] of empire with hawkish liberal-interventionist appointees.” 11/19/15 Twitter (b)(7)(C)-4 Group Chat, Group ID 594242937858486276, @WikiLeaks et al. 159 6/14/16 Twitter DM, @dcleaks_ to @WikiLeaks. 160 Netyksho Indictment ¶ 47(a). 161 7/6/16 Twitter DMs, @WikiLeaks & @guccifer_2. 45 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) The Office was able to identify when the GRU (operating through its personas Guccifer 2.0 and DCLeaks) transfened some of the stolen documents to WikiLeaks through online archives set up by the GRU. Assan e had access to the internet from the Ecuadorian Embass in London, En land. (b)(7)(E)-2 On July 14, 2016, GRU officers used a Guccifer 2.0 email account to send WikiLeaks an email bearing the subject "big archive" and the message "a new attempt. " 163 The email contained an encryp ted attachment with the name "wk dnc linkl.txt.gpg." 164 Using the Guccifer 2.0 Twitter account, GRU officers sent WikiLeaks an encryp ted file and instructions on how to open it. 165 On July 18, 2016, WikiLeaks confin ned in a direct message to the Guccifer 2.0 account that it had "the 1Gb or so archive" an d would make a release of the stolen documents "this week. " 166 On July 22, 2016, WikiLeaks released over 20,000 emails an d other documents stolen from the DNC computer networks. 167 The Democratic National Convention began three days later. Similar collllllunications occuned between WikiLeaks and the GRU-operated persona DCLeaks. On September 15, 2016, @dcleaks wrote to @WikiLeaks, "hi there! I'm from DC Leaks. How could we discuss some submission-related issues? Am hying to reach out to you via your secured chat but getting no response. I've got something that might interest you. You won't be disappointed, I promise." 168 The WikiLeaks account responded, "Hi there," without fmi her elaboration. The @dcleaks_ account did not respond illllllediately. The same day, the Twitter account @guccifer_2 sent @dcleaks_ a direct message, which is the first known contact between the personas. 169 During subsequent communications, the (b)(7)(E)-2 163 This was not the GRU's first attempt at t:ransfening data to WikiLeaks. On June 29, 2016, the GRU used a Guccifer 2.0 email account to send a lruj e enc ted file to a WikiLeaks email account. 6/29/16 Email, guccifer2@mail.com (The email appears to have been (b)(7)(E)-2 undelivered.) 11 [Q>IQI@IQ> QI@_ 164 See SM-2589105-DCLEAKS, serial 28 (analysis). 165 6/27/ 16 Twitter DM, @Guccifer_2 to @WikiLeaks. 166 7/ 18/ 16 Twitter DM, @Guccifer_2 & @WikiLeaks. 167 "DNC Email Archive," WikiLeaks (Jul. 22, 2016), available at https://wikileaks.org/dnc-emails. 168 9/ 15/ 16 Twitter DM, @dcleaks_ to @WikiLeaks. 169 9/ 15/ 16 Twitter DM, @guccifer_2 to @dcleaks_. 46 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Guccifer 2.0 persona infon ned DCLeaks that WikiLeaks was tiying to contact DCLeaks and an ange for a way to speak through enc1ypted emails. 170 An analysis of the metadata collected from the WikiLeaks site revealed that the stolen Podesta emails show a creation date of September 19, 2016. 171 Based on info1m ation about Assange's computer an d its possible operating system, this date may be when th e GRU staged the stolen Podesta emails for transfer to WikiLeaks (as the GRU had previously done in July 2016 for the DNC emails).172 The WikiLeaks site also released PDFs an d other documents taken from Podesta that were attachments to emails in his account; these documents had a creation date of October 2, 2016, which appears to be the date the attachments were separately staged by WikiLeaks on its site.173 Beginning on September 20, 2016, WikiLeaks and DCLeaks resumed collllllunications in a brief exchange. On September 22, 2016, a DCLeaks email account dcleaksproject@gmail.com sent an email to a WikiLeaks account with the subject "Submission" and the message "Hi from DCLeaks." The email contained a PGP-enc1 ted message with the filename "wiki_mail.txt.gpg." 174 The email, however, bears a number of similarities to t e Ju y 14, 2016 ema1 m w 1c GRU officers used the Guccifer 2.0 persona to give WikiLeaks access to the archive of DNC files. On September 22, 2016 (the same (b)(7)(E)-2 day of DCLeaks' email to WikiLeaks), the Twitter account ,dcleaks sent a sin le messa e to WikiLeaks with th e sti-in of characters • The Office cannot mle out that stolen documents were ti-ansfe1Ted to WikiLeaks through inte1mediaries who visited during the summer of 2016. For example, public repo1i ing identified Andi M .. 11 M hn WikiL ak . t h h . t d ·th th ti fi fth . (b} (3), (b} (7}(A}, (b} (7}(E} (b} (7}(A}, (b} (7}(E} (b)(3)-2, (b)(7)(E)-1 (b)(7)(E)-2 170 See SM-2589105-DCLEAKS, serial 28; 9/ 15/ 16 Twitter DM, @Guccifer_2 &@WikiLeaks. 171 See SM-2284941, serials 63 & 64 (b} (7}(A}, (b} (7}(E} (b)(7)(E)-2 (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} 173 When WikiLeaks saved attachments separately from the stolen emails, its computer system appears to have treated each attachment as a new file and given it a new creation date. See SM-2284941, se1ials 63 & 64. 174 See 9/22/ 16 Email, dcleaksproject@gmail.com (b} (7}(A}, (b} (7}(E} 175 (b)(7)(E)-2 Ellen Nakashima et al., A German Hacker Offers a Rare Look Inside the Secretive World of Julian Assange and WikiLeaks, Washington Post (Jan. 17, 2018). 47 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b)(3)-2, (b)(7)(E)-1 (b)(7)(E)-2 (b} (7}(A}, (b} (7}(E} (b)(J), (b)(7)(A ), (E) {D) {;,s), {D) {/){A), {D) {/){t:) On October 7, 2016, WikiLeaks released the first em ails stolen from the Podesta email account. In total, WikiLeaks released 33 trnnches of stolen emails between October 7, 2016 and November 7, 2016. The releases included private speeches given by Clinton ; 177 internal communications between Podesta and other high-ranking members of the Clinton Campaign; 178 and conespondence related to the Clinton Foundation.179 In total, WikiLeaks released over 50,000 documents stolen from Podesta's personal email account. The last-in-time email released from Podesta 's account was dated March 21 , 2016, two days after Podesta received a spea1p hishing email sent by th e GRU. d. WikiLeaks Statements Dissembling A bout the S ource ofS tolen Materials As repo1t s attributing the DNC an d DCCC hacks to the Russian government emerged, WikiLeaks and Assange m ade several public statements apparently designed to obscure the source of the materials that WikiLeaks was releasing . The file-transfer evidence described above and other infonnation uncovered during the investigation discredit WikiLeaks's claims about the source of m aterial that it posted. Beginning in th e summer of 2016, Assange and WikiLeaks made a number of statem ents about Seth Rich, a former DNC staff member who was killed in July 2016. The statements about Rich implied falsely that he had been the source of the stolen DNC emails. On August 9, 2016, the @WikiLeaks Twitter account posted: "ANNOUNCE: WikiLeaks has decided to issue a US$20k reward for infon nation leading to conviction for the murder ofDNC staffer Seth Rich ."180 Likewise, on August 25, 2016, Assange was asked in an interview, "Why are you so interested in Seth Rich 's killer?" an d responded, "We 're ve1y interested in anything th at might be a threat to alleged Wikileaks sources." The interviewer responded to Assange 's statement by commenting, "I know you don 't want to reveal your source, but it ce1tainly sounds like you 're suggesting a m an who leaked info1mation to WikiLeaks was th en murdered." Assange replied, "If there 's someone who's potentially connected to our publication, and that person has been murdered in suspicious · (b} (7}(A}, (b} (7}(E} (b)(6)/(b)(7)(C)-4 l(b} (7}(A}, (b} (7}(E}, (b} (6), (b)(7)(E)-2 (b} (7}(C} (b} (6), (b} (7}(C} (b)(6)/ (b)(7)(C)-4 (b)(6)/ (b)(7)(C)-4 : (b} (6), (b} (7}(C} 179 Netyksho Indictment ,r 43 . 180 @WikiLeaks 8/9/16 Tweet. 48 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) circumstan ces, it doesn't necessarily mean that the two are connected. But it is a ve1y serious matter. .. that type of allegation is ve1y serious, as it's taken ve1y seriously by us." 181 After the U.S. intelligence collllllunity publicly announced its assessment that Russia was behind the hacking operation, Assange continued to deny that the Clinton materials released by WikiLeaks had come from Russian hacking. According to media reports, Assange told a U.S. congressman that the DNC hack was an "inside job," and pmpo1ied to have ''physical proof' that Russians did not give materials to Assange. 182 C. Additional GRU Cyber Operations While releasing the stolen emails and documents through DCLeaks, Guccifer 2.0, and WikiLeaks, GRU officers continued to target and hack victims linked to the Democratic campaign and, eventually, to target entities responsible for election administration in several states. 1. Summer and Fall 2016 Operations Targeting Democrat-Linked Victims On July 27, 2016, Unit 26165 targeted email accounts connected to candidate Clinton 's (b)(6)/ personal office Earlier that day, candidate Tnunp made public statements that (b)(7)(C)-4 included the following: "Russia, if you 're listening, I hope you're able to find the 30,000 emails that are missing. I think you will probably be rewarded 1nightily by om press." 183 The "30,000 emails" were apparently a reference to emails described in media accounts as having been stored on a personal server that candidate Clinton had used while serving as Secretaiy of State. Within approximately five hom s ofTrnmp's statement, GRU officers targeted for the first time Clinton's personal office. After candidate Trump 's remarks,Unit 26165 created and sent iw1q1e17rl (b)(6)/ malicious links tai·geting 15 email accounts at the domain mcluding an email The investigation 1 not m d evidence of eai·lier (b)(7)(C)-4 account belonging to Clinton aide GRU attempts to compromise accounts hosted on this dom ain. It is uncleai· how the GRU was able to identify these email accounts, which were not public. 184 Unit 26165 officers also hacked into a DNC account hosted on a cloud-computing service On September 20, 2016, the GRU began to generate (b)(7)(E)-2 function designed to allow users to produce backups of as "snaps ots") . The GRU then stole those snapshots by moving 181 See Assange: "Murdered DNC Staffer Was 'Potential' WikiLeaks Source, " Fox News (Aug. 25, 2016)(containing video of Assange interview by Megyn Kelly). 182 M. Raju & Z. Cohen, A GOP Congressman 's Lonely Quest Defending Julian Assange, CNN (May 23, 2018). 183 "Donald Tnnnp on Russian & Missing Hillruy Clinton Emails," YouTube Channel C-SPAN, Posted 7/27/ 16, available at https://www.youtube.com/watch?v=3kxG8uJUsWU (struting at 0:41). (b)(7)(E)-2 49 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed . R. Crim. P. 6(e) them to account that they controlled; from there, the copies were moved to GRU­ (b)(7)(E)-2 controlled computers. The GRU stole approximately 300 gigabytes of data from the DNC cloud­ based account. 185 2. Intrnsions Targeting the Administration of U.S. Elections In addition to targeting individuals involved in the Clinton Campaign, GRU officers also targeted individuals and entities involved in the administrntion of the elections. Victims included U.S. state and local entities, such as state boards of elections (SBOEs), secretaries of state, and county governments, as well as individuals who worked for those entities.186 The GRU also targeted private technology fnms responsible for manufacturing and administering election-related software and hardware, such as voter registration software and electronic polling stations. 187 The GRU continued to target these victims through the elections in November 2016. While the investigation identified evidence that the GRU targeted these individuals and entities, the Office did not investigate fmther. The Office did not, for instan ce, obtain or examine servers or other relevant items belonging to these victims. The Office understands that the FBI, the U.S. Depait ment of Homeland Security, and the states have sepai·ately investigated that activity. By at least the summer of 2016, GRU officers sought access to state and local computer networks by exploiting known software vulnerabilities on websites of state and local governmental entities. GRU officers, for example, tai·geted state and local databases of registered voters using a technique known as "SQL injection," by which malicious code was sent to the state or local website in order to nm commands (such as exfiltrating the database contents). 188 In one instance in approximately June 2016, the GRU compromised the computer network of the Illinois State Board of Elections by exploiting a vulnerability in the SBOE 's website. The GRU then gained access to a database containing infonnation on millions of registered Illinois voters, 189 and extracted data related to thousands of U.S. voters before the malicious activity was identified.190 that scanned state and local websites for · od in July 2016, GRU officers (b)(7)(E)-2 for vulnerabilities on websites of more than GRU officers - 185 Netyksho Indictment ,i 34; see also SM-2589105-HACK, serial 29 (b) (7)(A), (b) (7)(E) 186 Netyksho Indictment ,i 69. (b)(7)(E)-2 (b)(7)(E)-2 (b)(3)-2, (b)(7)(E)-1 188 (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3)(b) (b)(7)(E)-2 (7)(A), (b) (7)(E) (b)(7)(E)-2 (b)(7)(E)-2 (b)(7)(E)-2 50 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) (b) (7)(A), (b) (7)(E) Similar (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 for vulnerabilities continued through the election. Unit 74455 also sent spearphishing emails to public officials involved in election administration and personnel at companies involved in voting technology. In August 2016, GRU officers targeted employees of (b) (7)(A), (b) (7)(E) a voting technology company that developed software used by numerous U.S. counties to manage voter rolls, and installed malware on the company network. Similarly, in November 2016, the GRU sent spearphishing emails to over 120 email accounts used by Florida county officials responsible for administering the 2016 U.S. election.191 The spearphishing emails contained an attached Word document coded with malicious software (commonly referred to as a Trojan) that permitted the GRU to access the infected computer.192 The FBI was separately responsible for this investigation. We understand the FBI believes that this operation enabled the GRU to gain access to the network of at least one Florida county government. The Office did not independently verify that belief and, as explained above, did not undertake the investigative steps that would have been necessary to do so. (b)(7)(E)-2 D. Trump Campaign and the Dissemination of Hacked Materials The Trump Campaign showed interest in WikiLeaks’s releases of hacked materials throughout the summer and fall of 2016. Trump associate Roger Stone made several attempts to contact WikiLeaks founder Assange, boasted of his access to Assange, and was in regular contact with Campaign officials about the releases that Assange made and was believed to be planning. (b) (5) (b)(5)-2 1. Role of Roger Stone a. Background Roger Stone has known President Trump for many years and was an advisor to the Trump Campaign from close to its inception until approximately August 2015. After leaving the Campaign in August 2015, Stone continued to promote the Campaign and maintained regular contact with Trump Campaign members, including candidate Trump and, when they joined the Campaign, with campaign officials Paul Manafort, Steve Bannon, and Rick Gates. According to multiple witnesses involved with the Campaign, beginning in June 2016 and continuing through October 2016, Stone spoke about WikiLeaks with senior Campaign officials, including candidate Trump. (b)(7)(E)-2 191 Netyksho Indictment ¶ 76; (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3)(b) 192 (b)(7)(E)-2 (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E), (b) (3) 51 (b)(3)-2, (b)(7)(E)-1 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) b. Contacts with the Campaign about WikiLeaks Stone has publicly denied having any direct contact with Assange and claimed not to have had any discussions with an intermediary connected to Assange until July or August 2016.193 Other members and associates of the Trump Campaign, however, told the Office that Stone claimed to the Campaign as early as June 2016—before any announcement by Assange or WikiLeaks—that he had learned that WikiLeaks would release documents damaging to the Clinton Campaign. On June 12, 2016, Assange claimed in a televised interview to “have emails relating to Hillary Clinton which are pending publication,”194 but provided no additional context. In debriefings with the Office, former deputy campaign chairman Rick Gates said that, before Assange’s June 12 announcement, Gates and Stone had a phone conversation in which Stone said something “big” was coming and had to do with a leak of information.195 Stone also said to Gates that he thought Assange had Clinton emails. Gates asked Stone when the information was going to be released. Stone said the release would happen very soon. According to Gates, between June 12, 2016 and July 22, 2016, Stone repeated that information was coming. Manafort and Gates both called to ask Stone when the release would happen, and Gates recalled candidate Trump being generally frustrated that the Clinton emails had not been found.196 Paul Manafort, who would later become campaign chairman, provided similar information about the timing of Stone’s statements about WikiLeaks.197 According to Manafort, sometime in June 2016, Stone told Manafort that he was dealing with someone who was in contact with WikiLeaks and believed that there would be an imminent release of emails by WikiLeaks.198 193 Executive Session, Permanent Select Committee on Intelligence, U.S. House of Representatives, 116 Cong. 39-40 (Sept. 26, 2017) (Statement of Roger J. Stone, Jr.). th 194 See Mahita Gajanan, Julian Assange Timed DNC Email Release for Democratic Convention, Time (July 27, 2016) (quoting the June 12, 2016 television interview). 195 In February 2018, Gates pleaded guilty, pursuant to a plea agreement, to a superseding criminal information charging him with conspiring to defraud and commit multiple offenses (i.e., tax fraud, failure to report foreign bank accounts, and acting as an unregistered agent of a foreign principal) against the United States, as well as making false statements to our Office. Superseding Criminal Information, United States v. Richard W. Gates III, 1:17-cr-201 (D.D.C. Feb. 23, 2018), Doc. 195 (“Gates Superseding Criminal Information”); Plea Agreement, United States v. Richard W. Gates III, 1:17-cr-201 (D.D.C. Feb. 23, 2018), Doc. 205 (“Gates Plea Agreement”). Gates has provided information and in-court testimony that the Office has deemed to be reliable. 196 Gates 10/25/18 302, at 1-2. 197 As explained further in Volume I, Section IV.A.8, infra, Manafort entered into a plea agreement with our Office. We determined that he breached the agreement by being untruthful in proffer sessions and before the grand jury. We have generally recounted his version of events in this report only when his statements are sufficiently corroborated to be trustworthy; to identify issues on which Manafort’s untruthful responses may themselves be of evidentiary value; or to provide Manafort’s explanations for certain events, even when we were unable to determine whether that explanation was credible. His account appears here principally because it aligns with those of other witnesses. 198 (b)(3)-1 (b) (3) 52 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Michael Cohen, former executive vice president of the Trump Organization and special counsel to Donald J. Trump,199 told the Office that he recalled an incident in which he was in candidate Trump’s office in Trump Tower when Stone called. Cohen believed the call occurred before July 22, 2016, when WikiLeaks released its first tranche of Russian-stolen DNC emails.200 Stone was patched through to the office and placed on speakerphone. Stone then told the candidate that he had just gotten off the phone with Julian Assange and in a couple of days WikiLeaks would release information. According to Cohen, Stone claimed that he did not know what the content of the materials was and that Trump responded, “oh good, alright” but did not display any further reaction.201 Cohen further told the Office that, after WikiLeaks’s subsequent release of stolen DNC emails in July 2016, candidate Trump said to Cohen something to the effect of, “I guess Roger was right.”202 After WikiLeaks’s July 22, 2016 release of documents, Stone participated in a conference call with Manafort and Gates. According to Gates, Manafort expressed excitement about the release and congratulated Stone.203 Manafort, for his part, told the Office that, shortly after WikiLeaks’s July 22 release, Manafort also spoke with candidate Trump and mentioned that Stone had predicted the release and claimed to have access to WikiLeaks. Candidate Trump responded that Manafort should stay in touch with Stone.204 Manafort relayed the message to Stone, likely on July 25, 2016.205 Manafort also told Stone that he wanted to be kept apprised of any 199 In November 2018, Cohen pleaded guilty pursuant to a plea agreement to a single-count information charging him with making false statements to Congress, in violation of 18 U.S.C. § 1001(a) & (c). He had previously pleaded guilty to several other criminal charges brought by the U.S. Attorney’s Office in the Southern District of New York, after a referral from this Office. In the months leading up to his false-statements guilty plea, Cohen met with our Office on multiple occasions for interviews and provided information that the Office has generally assessed to be reliable and that is included in this report. 200 Cohen 8/7/18 302, at 8-9. 201 Cohen described the content of the call in an initial interview with our Office and its timing in a later interview. With respect to timing, Cohen stated that he believed the call would have been in July 2016, based on his own travel schedule and other factors. Cohen 8/7/18 302, at 8. Cohen believes that WikiLeaks had not released any campaign-related documents at the time, and that Stone’s telephone call was prior to the release of stolen DNC documents on July 22, 2016. In February 2019 congressional testimony, Cohen stated he believed the conversation in question occurred on “either the 18th or 19th and I would guess that it would be on the 19th” of July. See Testimony of Michael D. Cohen, Committee on Oversight and Reform, U.S. House of Representatives, 116th Cong. 5 (Feb. 27, 2019). 202 Cohen 9/18/18 302, at 10. During his February 2019 congressional testimony, Cohen stated: Mr. Stone told Mr. Trump that he had just gotten off the phone with Julian Assange and that Mr. Assange told Mr. Stone that within a couple of days there would be a massive dump of emails that would damage Hillary Clinton’s campaign. Mr. Trump responded by stating to the effect, wouldn’t that be great. See Testimony of Michael D. Cohen, Committee on Oversight and Reform, U.S. House of Representatives, 116th Cong. 5 (Feb. 27, 2019). 203 Gates 10/25/18 302 (serial 241), at 4. 204 (b) (3) 205 (b) (3) (b)(3)-1 53 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) developments with WikiLeaks and separately told Gates to keep in touch with Stone about future WikiLeaks releases.206 According to Gates, by the late summer of 2016, the Trump Campaign was planning a press strategy, a communications campaign, and messaging based on the possible release of Clinton emails by WikiLeaks.207 Gates also stated that Stone called candidate Trump multiple times during the campaign.208 Gates recalled one lengthy telephone conversation between Stone and candidate Trump that took place while Trump and Gates were driving to LaGuardia Airport. Although Gates could not hear what Stone was saying on the telephone, shortly after the call candidate Trump told Gates that more releases of damaging information would be coming.209 Stone also had conversations about WikiLeaks with Steve Bannon, both before and after Bannon took over as the chairman of the Trump Campaign. Bannon recalled that, before joining the Campaign on August 13, 2016, Stone told him that he had a connection to Assange. Stone implied that he had inside information about WikiLeaks. After Bannon took over as campaign chairman, Stone repeated to Bannon that he had a relationship with Assange and said that WikiLeaks was going to dump additional materials that would be bad for the Clinton Campaign.210 c. Roger Stone’s Known Efforts to Communicate with WikiLeaks Three days after WikiLeaks released stolen DNC documents on July 22, 2016, Stone sent an email to his associate Jerome Corsi directing him to “[g]et to Assange [a]t Ecuadorian Embassy in London and get the pending [WikiLeaks] emails . . . they deal with Foundation, allegedly.”211 Corsi is an author who holds a doctorate in political science.212 In 2016, Corsi also worked for the media outlet WorldNetDaily (WND). Corsi first met Stone in early 2016 and began having recorded conversations with Stone that Corsi intended to use as content for WND. According to Corsi, by March 2016, Corsi stopped making recordings with Stone and began to be more of a self-described “operative” for Stone, seeking to assist the Trump Campaign in a personal capacity.213 (b)(3)-1 206 (b) (3) 207 Gates 4/10/18 302, at 3; Gates 4/11/18 302, at 1-2 (SM-2180998); Gates 10/25/18 302, at 2. 208 Gates 10/25/18 302 (serial 241), at 4. 209 Gates 10/25/18 302 (serial 241), at 4. 210 Bannon 10/26/18 302, at 1-2. 211 7/25/16 Email, Stone to Corsi. 212 Corsi first rose to public prominence in August 2004 when he published his book Unfit for Command: Swift Boat Veterans Speak Out Against John Kerry. In the 2008 election cycle, Corsi gained prominence for being a leading proponent of the allegation that Barack Obama was not born in the United States. Corsi told the Office that Donald Trump expressed interest in his writings, and that he spoke with Trump on the phone on at least six occasions. Corsi 9/6/18 302, at 3. 213 Corsi 10/31/18 302, at 2; (b) (3) Corsi was first interviewed on September 6, 2018 at the Special Counsel’s offices in Washington, D.C. He was accompanied by counsel throughout the interview. Corsi was subsequently interviewed on September 17, 2018; September 21, 2018; October 31, 2018; November 1, 2018; and November 2, 2018. Counsel was 54 (b)(3)-1 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) After receiving Stone’s July 25, 2016 email, Corsi forwarded the email to another associate, Theodore Malloch, who lived in London at the time.214 Corsi told the Office during interviews that he “must have” previously discussed Assange with Malloch.215 Corsi also told the Office that he introduced Malloch and Stone earlier in 2016, when Malloch wanted to become involved in the Campaign.216 On July 31, 2016, Stone sent another email to Corsi, this one stating that Malloch “should see Assange.”217 (b) (3) (b)(3)-1 According to Malloch, Corsi asked him to put Corsi in touch with Assange, whom Corsi wished to interview. Malloch recalled that Corsi also suggested that individuals in the “orbit” of U.K. politician Nigel Farage might be able to contact Assange and asked if Malloch knew them. Malloch told Corsi that he would think about the request but made no actual attempt to connect Corsi with Assange.218 On August 2, 2016, Corsi sent Stone an email reading, in part, “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned to be very damaging.” Corsi added, “Time to let more than Podesta to be exposed as in bed w[ith] enemy if they are not ready to drop HRC [Hillary Rodham Clinton]. That appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage for Foundation debacle.”219 At a public event held on August 8, 2016, Stone made his first of several public statements that he had been in contact with Assange—a claim that he later amended to indicate the communication was via a “mutual friend.”220 present for all interviews, and the interviews beginning on September 21, 2018 were conducted pursuant to a proffer agreement that precluded affirmative use of his statements against him in limited circumstances. 214 7/25/16 Email, Corsi to Malloch. 215 Corsi 10/31/18 302, at 4. 216 Corsi 9/6/18 302, at 5. 217 7/31/16 Email, Stone to Corsi. 218 (b) (3) 219 8/2/16 Email, Corsi to Stone. Malloch denied ever communicating with Assange or WikiLeaks, stating that he did not pursue the request to contact Assange because he believed he had no connections to Assange. (b) (3) 220 At the August 8, 2016 event, Stone stated, “I actually have communicated with Assange. I believe the next tranche of his documents pertain to the Clinton Foundation, but there’s no telling what the October surprise may be.” “Roger Stone at the Southwest Broward Republican Organization,” YouTube Channel “Stone Cold Truth,” Posted 8/10/16, available at https://www.youtube.com/watch ?v=6gM_cyROnto (starting at 46:50). On August 16, 2016, Stone stated during an interview, “I had communicated with Mr. Assange,” then adding, “I never said I met with him or that I spoke with him,” but said “we have a mutual acquaintance who is a fine gentleman.” “Roger Stone Discusses the Future Plans of WikiLeaks,” YouTube Channel TheBlaze, Posted 8/16/16, available at https://www.youtube.com/watch?time_continue=18&v=HfrzKmeXsrI (starting at 0:00). 55 (b)(3)-1 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Malloch stated to investigators that beginning in or about August 2016, he and Corsi had multiple FaceTime discussions about WikiLeaks and Stone. On these calls, Corsi stated that Stone had made a connection to Assange and that the hacked emails of John Podesta would be released prior to Election Day and would be helpful to the Trump Campaign. In one conversation in or around August or September 2016, Corsi told Malloch that the release of the Podesta emails was coming, after which “we” were going to be in the driver’s seat.221 Beginning in August 2016, Stone began to communicate with another associate, Randy Credico, about WikiLeaks. Credico, a New York radio show host, interviewed Assange on August 25, 2016.222 On August 26, 2016, Credico sent a text message to Stone that read “Julian Assange talk[ed] about you last night.”223 Stone asked what Assange said, to which Credico responded, “He didn’t say anything bad we were talking about how the Press is trying to make it look like you and he are in cahoots.”224 The following day, Credico sent a text message stating, “Julian Assange has kryptonite on Hillary.”225 In September 2016, Stone asked Credico to pass along a request to Assange for any emails from the State Department or candidate Clinton that pertained to an event in 2011 when Clinton was serving as Secretary of State.226 Credico agreed to pass along the request and sent the request to an attorney who had regular contact with WikiLeaks. He included Stone on the email as a blind copy.227 (In an interview with the Office, the attorney stated that she did not communicate the request to WikiLeaks.228) In late September and early October 2016, Credico and Stone communicated about possible upcoming WikiLeaks releases. On October 1, 2016, Credico sent Stone text messages that read, “big news Wednesday . . . now pretend u don’t know me . . . Hillary’s campaign will die this week.”229 After a planned WikiLeaks press conference on October 2, 2016 was postponed, Stone 221 (b)(3)-1 (b) (3) 222 Interview of Julian Assange by Randy Credico on WBAI, Posted 8/25/16, available at https://www.weblinenews.com/julian-assange-hillary-clinton-donald-trump/. Credico discussed the interview with Stone a few days before the interview. On August 19, 2016, Credico sent a text message to Stone that read in part, “I’m going to have Assange on my show next Thursday.” On August 21, 2016, Credico sent another text message to Stone, writing in part “I have Assange on Thursday so I’m completely tied up on that day.” 8/19-20/16 Text Messages, Credico to Stone. 223 8/26/16 Text Message, Credico to Stone. 224 8/26/16, Text Message, Credico to Stone. 225 8/27/16, Text Message, Credico to Stone. 226 9/18-19/16 Text Messages, Stone & Credico); 9/18/16 Email, Stone to Credico. 227 9/20/16 Email, Credico to Kunstler, bcc: Stone. 228 Kunstler 10/3/18 302, at 1. 229 The day before, on September 30, 2016, Credico sent Stone a photograph of Credico standing outside the Ecuadorian Embassy in London, where Assange was living. Credico visited London in September 2016 and stopped by the Ecuadorian Embassy to drop off a letter thanking Assange for 56 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) emailed Credico to ask about the delay. Credico responded, “head fake.”230 On October 3, 2016, Stone wrote Credico asking, “Did Assange back off.” Credico initially responded, “I can’t tal[k] about it,” but later wrote, “I think its on for tomorrow.” Credico added, “Off the Record Hillary and her people are doing a full-court press they keep Assange from making the next dump . . . that’s all I can tell you on this line . . . Please leave my name out of it.”231 During an interview in December 2018, Credico told the Office that he had not heard that claim from anyone specific and did not recall why he wrote it to Stone.232 Stone repeated Credico’s October 2016 predictions about WikiLeaks to multiple people, including persons involved with the Trump Campaign.233 On October 3, 2016, Stone received an email from a reporter asking, “[Assange] – what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he doesn’t call me back.”234 On October 3, 2016, Stone emailed Erik Prince—a campaign donor and occasional informal advisor, see Volume I, Section IV.B.2.a—to say “Spoke to my friend in London last night. The payload is still coming.”235 The following day, Prince emailed Stone to ask whether he had “hear[d] anymore from London.” Stone responded, “Yes – want to talk on a secure line – got Whatsapp.”236 According to Prince, Stone and Prince did speak subsequently, and Stone said that WikiLeaks would release more materials that would be damaging to the Clinton Campaign. Stone also indicated to Prince that he had what Prince described as almost “insider stock trading” type information about Assange.237 On October 4, 2016, after Assange completed a press conference without announcing new releases, Bannon emailed Stone, “What was that this morning???” and asked if Assange had “cut a deal w/ Clintons.” Stone emailed Bannon back telling him Assange was afraid, but that there would be a dump coming once a week.238 participating in the August 2016 radio interview. According to Credico, he never spoke with Assange or (b)(3)-2 anyone from WikiLeaks that day. Credico 12/6/18 302, at 8. (b) (3), (b) (7)(E) (b)(7)(E)-1 (b) (3), (b) (7)(E) 230 10/2/16 Email, Credico to Stone. 231 8/19/16 – 10/8/16 Text Messages, Credico & Stone. 232 Credico 12/6/18 302, at 9. 233 Stone also made one public statement that appears to have been spurred by his conversations with Credico. On October 2, 2016, Stone participated in an InfoWars interview and said, “An intermediary met with him in London recently who is a friend of mine and a friend of his, a believer in freedom. And I am assured that the motherlode is coming Wednesday.” Trump Advisor Roger Stone Says He’s Been ‘Assured’ Through an Assange Intermediary that ‘The Mother Lode is Coming, Media Matters, Posted 10/3/16, available at https://www.mediamatters.org/video/2016/10/03/trump-advisor-roger-stone-says-hes-been-assured-through-assange-intermediary-mother-lode-coming/213488. 234 10/3/16 Email, Stone to 235 10/3/16 Email, Stone to Prince. 236 10/4/16 Email, Stone to Bannon. 237 Prince 5/3/18 302, at 7. (b) (7)(C), (b) (6) 238 The communication followed a press conference by Assange in which he made no mention of releasing materials related to candidate Clinton. Stone answered that Assange had a “[s]erious security 57 (b)(6)/ (b)(7)(C)-4 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) d. WikiLeaks’s October 7, 2016 Release of Stolen Podesta Emails On October 7, 2016, four days after the Assange press conference that Stone had discussed with Trump Campaign officials, the Washington Post published an Access Hollywood video that captured comments by candidate Trump some years earlier and that was expected to adversely affect the Campaign.239 Less than an hour after the video’s publication, WikiLeaks released the first set of emails stolen by the GRU from the account of Clinton Campaign chairman John Podesta. The Office investigated whether Roger Stone played any role in WikiLeaks’s dissemination of the Podesta emails at that time. During his first September 2018 interview, Corsi stated that he had refused Stone’s July 25, 2016 request to contact Assange, and that had been the last time they had talked about contacting Assange.240 Email and text communications between Stone and Corsi show that was false. During a later September 2018 interview, Corsi told the Office that one of his WikiLeaks-related communications with Stone had occurred on October 7, 2016, just prior to WikiLeaks’s release.241 Corsi told the Office that he spoke with Stone before publication of the Access Hollywood video and that Stone knew about the tape’s content and its imminent release, both of which he relayed to Corsi.242 Corsi gave conflicting accounts of what happened after Stone purportedly informed him about the video.243 Initially, Corsi told investigators that he had instructed Stone to have WikiLeaks release information to counteract the expected reaction to the video’s release, and that Stone said that was a good idea and would get it done. Later during the same interview, Corsi stated that Stone had told Corsi to have WikiLeaks drop the Podesta emails immediately, and Corsi told Stone he would do it. Corsi said that, because he had no direct means of communicating with WikiLeaks, he told members of the news site WND—who were participating on a conference call with him that day—to reach Assange immediately.244 Corsi claimed that the pressure was concern” but that WikiLeaks would release “a load every week going forward.” 10/4/16 Email, Stone to Bannon; Bannon 2/14/18 302, at 33. 239 Candidate Trump can be heard off camera making graphic statements about women. 240 Corsi 9/6/18 302, at 5–6. 241 Corsi 9/21/18 302, at 6. 242 Corsi 9/21/18 302, at 6. 243 Corsi 9/21/18 302, at 6. 244 In a later November 2018 interview, Corsi stated that he relayed Stone’s information in a different conference call. Corsi initially stated that he believed Malloch was on the call but then focused on other individuals who were on the call-invitation, which Malloch was not. (Separate travel records show that at the time of the call, Malloch was aboard a transatlantic flight). Corsi at one point stated that after WikiLeaks’s release of stolen emails on October 7, 2016, he concluded Malloch had gotten in contact with Assange. Corsi 11/1/18 302, at 6. 58 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) enormous and recalled telling the conference call the Access Hollywood tape was coming.245 Corsi stated that he was convinced that his efforts had caused WikiLeaks to release the emails when they did.246 In a later November 2018 interview, Corsi stated that he thought that he had told people on a WND conference call about the forthcoming tape and had sent out a tweet asking whether anyone could contact Assange, but then said that maybe he had done nothing.247 The Office investigated Corsi’s allegations about the events of October 7, 2016 but found little corroboration for his allegations about the day.248 In public statements, Stone has denied having advance knowledge of the Access Hollywood tape.249 Telephone records show that, on the morning of October 7, 2016, Stone had a conversation with a reporter from the Washington Post (the first media outlet to publish the Access Hollywood video).250 However, the phone records themselves do not indicate that the conversation was with any of the reporters who broke the Access Hollywood story, and the Office has not otherwise been able to identify the substance of the conversation. Telephone records show communication between Stone and Corsi on October 7, 2016, as well as Corsi’s participation in two conference calls that day.251 However, the Office has not identified any conference call participant, or anyone who spoke to Corsi that day, who says that they received non-public information about the tape from Corsi or acknowledged having contacted a member of WikiLeaks on October 7, 2016 after a conversation with Corsi. e. Donald Trump Jr. Interaction with WikiLeaks Donald Trump Jr. had direct electronic communications with WikiLeaks during the campaign period. On September 20, 2016, an individual named Jason Fishbein sent WikiLeaks the password for an unlaunched website focused on Trump’s “unprecedented and dangerous” ties 245 During the same interview, Corsi also suggested that he may have sent out public tweets because he knew Assange was reading his tweets. Our Office was unable to find evidence of any such tweets. 246 Corsi 9/21/18 302, at 6-7. 247 Corsi 11/1/18 302, at 6. that, after the election, Corsi boasted that he and (b)(3)-1 Stone had played an important role in interacting with WikiLeaks during the Campaign, and they should be given credit for what they had done with respect to WikiLeaks during the Campaign. (b) (3) 248 (b) (3) 249 Chuck Ross, Jerome Corsi Testified That Roger Stone Sought WikiLeaks’ Help To Rebut ‘Access Hollywood’ Tape, Daily Caller (Nov. 27, 2018) (quoting Stone as claiming that he did not have knowledge of the tape until its publication). 250 Call Records of Roger Stone (b) (3) (reflecting an 18-minute telephone call with a Washington Post number starting at approximately 11:53 a.m.). 251 Call Records of Roger Stone (b) (3) (showing a 17-minute telephone call with Jerome Corsi starting at approximately 1:42 p.m., followed by a second twenty-minute telephone call between the two starting at approximately 2:18 p.m.); Call Records of Jerome Corsi (b) (3) (b) (3) (showing a conference line for approximately fifteen minutes starting at approximately 2:00 p.m.). 59 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) to Russia, PutinTrump.org.252 WikiLeaks publicly tweeted: “‘Let’s bomb Iraq’ Progress for America PAC to launch “PutinTrump.org’ at 9:30am. Oops pw is ‘putintrump’ putintrump.org.” Several hours later, WikiLeaks sent a Twitter direct message to Donald Trump Jr., “A PAC run anti-Trump site putintrump.org is about to launch. The PAC is a recycled pro-Iraq war PAC. We have guessed the password. It is ‘putintrump.’ See ‘About’ for who is behind it. Any comments?”253 Several hours later, Trump Jr. emailed a variety of senior campaign staff: Guys I got a weird Twitter DM from wikileaks. See below. I tried the password and it works and the about section they reference contains the next pic in terms of who is behind it. Not sure if this is anything but it seems like it’s really wikileaks asking me as I follow them and it is a DM. Do you know the people mentioned and what the conspiracy they are looking for could be? These are just screen shots but it’s a fully built out page claiming to be a PAC let me know your thoughts and if we want to look into it.254 Trump Jr. attached a screenshot of the “About” page for the unlaunched site PutinTrump.org. The next day (after the website had launched publicly), Trump Jr. sent a direct message to WikiLeaks: “Off the record, I don’t know who that is but I’ll ask around. Thanks.”255 On October 3, 2016, WikiLeaks sent another direct message to Trump Jr., asking “you guys” to help disseminate a link alleging candidate Clinton had advocated using a drone to target Julian Assange. Trump Jr. responded that he already “had done so,” and asked, “what’s behind this Wednesday leak I keep reading about?”256 WikiLeaks did not respond. On October 12, 2016, WikiLeaks wrote again that it was “great to see you and your dad talking about our publications. Strongly suggest your dad tweets this link if he mentions us wlsearch.tk.”257 WikiLeaks wrote that the link would help Trump in “digging through” leaked emails and stated, “we just released Podesta emails Part 4.”258 Two days later, Trump Jr. publicly tweeted the wlsearch.tk link.259 - 252 - 9/20/16 Twitter DM, @JasonFishbein to @WikiLeaks; see JF00587 (9/21/16 Messages, @jabber.cryptoparty.is &(b) (6), (b) (7)(C) @jabber.cryptoparty.is); Fishbein 9/5/18 302, at 4. When (b)(6)/ interviewed by our Office, Fishbein produced what he claimed to be logs from a chatroom in which the (b)(7)(C)-4 participants discussed U.S. politics; one of the other participants had posted the website and password that Fishbein sent to WikiLeaks. (b) (6), (b) (7)(C) 253 9/20/16 Twitter DM, @WikiLeaks to @DonaldJTrumpJr. 254 TRUMPORG_28_000629-33 (9/21/16 Email, Trump Jr. to Conway et al. (subject “Wikileaks”)). 255 9/21/16 Twitter DM, @DonaldJTrumpJr to @WikiLeaks. 256 10/3/16 Twitter DMs, @DonaldJTrumpJr & @WikiLeaks. 257 At the time, the link took users to a WikiLeaks archive of stolen Clinton Campaign documents. 258 10/12/16 Twitter DM, @WikiLeaks to @DonaldJTrumpJr. 259 @DonaldJTrumpJr 10/14/16 (6:34 a.m.) Tweet. 60 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) 2. Other Potential Campaign Interest in Russian Hacked Materials Throughout 2016, the Trump Campaign expressed interest in Hillary Clinton’s private email server and whether approximately 30,000 emails from that server had in fact been permanently destroyed, as reported by the media. Several individuals associated with the Campaign were contacted in 2016 about various efforts to obtain the missing Clinton emails and other stolen material in support of the Trump Campaign. Some of these contacts were met with skepticism, and nothing came of them; others were pursued to some degree. The investigation did not find evidence that the Trump Campaign recovered any such Clinton emails, or that these contacts were part of a coordinated effort between Russia and the Trump Campaign. a. Henry Oknyansky (a/k/a Henry Greenberg) In the spring of 2016, Trump Campaign advisor Michael Caputo learned through a Floridabased Russian business partner that another Florida-based Russian, Henry Oknyansky (who also went by the name Henry Greenberg), claimed to have information pertaining to Hillary Clinton. Caputo notified Roger Stone and brokered communication between Stone and Oknyansky. Oknyansky and Stone set up a May 2016 in-person meeting.260 Oknyansky was accompanied to the meeting by Alexei Rasin, a Ukrainian associate involved in Florida real estate. At the meeting, Rasin offered to sell Stone derogatory information on Clinton that Rasin claimed to have obtained while working for Clinton. Rasin claimed to possess financial statements demonstrating Clinton’s involvement in money laundering with Rasin’s companies. According to Oknyansky, Stone asked if the amounts in question totaled millions of dollars but was told it was closer to hundreds of thousands. Stone refused the offer, stating that Trump would not pay for opposition research.261 Oknyansky claimed to the Office that Rasin’s motivation was financial. According to Oknyansky, Rasin had tried unsuccessfully to shop the Clinton information around to other interested parties, and Oknyansky would receive a cut if the information was sold.262 Rasin is noted in public source documents as the director and/or registered agent for a number of Florida companies, none of which appears to be connected to Clinton. The Office found no other evidence that Rasin worked for Clinton or any Clinton-related entities. In their statements to investigators, Oknyansky and Caputo had contradictory recollections about the meeting. Oknyansky claimed that Caputo accompanied Stone to the meeting and provided an introduction, whereas Caputo did not tell us that he had attended and claimed that he was never told what information Oknyansky offered. Caputo also stated that he was unaware Oknyansky sought to be paid for the information until Stone informed him after the fact.263 260 Caputo 5/2/18 302, at 4; Oknyansky 7/13/18 302, at 1. 261 Oknyansky 7/13/18 302, at 1-2. 262 Oknyansky 7/13/18 302, at 2. 263 Caputo 5/2/18 302, at 4; Oknyansky 7/13/18 302, at 1. 61 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) The Office did not locate Rasin in the United States, although the Office confirmed Rasin had been issued a Florida driver’s license. The Office otherwise was unable to determine the content and origin of the information he purportedly offered to Stone. Finally, the investigation did not identify evidence of a connection between the outreach or the meeting and Russian interference efforts. b. Campaign Efforts to Obtain Deleted Clinton Emails After candidate Trump stated on July 27, 2016, that he hoped Russia would “find the 30,000 emails that are missing,” Trump asked individuals affiliated with his Campaign to find the deleted Clinton emails.264 Michael Flynn—who would later serve as National Security Advisor in the Trump Administration—recalled that Trump made this request repeatedly, and Flynn subsequently contacted multiple people in an effort to obtain the emails.265 Barbara Ledeen and Peter Smith were among the people contacted by Flynn. Ledeen, a long-time Senate staffer who had previously sought the Clinton emails, provided updates to Flynn about her efforts throughout the summer of 2016.266 Smith, an investment advisor who was active in Republican politics, also attempted to locate and obtain the deleted Clinton emails.267 Ledeen began her efforts to obtain the Clinton emails before Flynn’s request, as early as December 2015.268 On December 3, 2015, she emailed Smith a proposal to obtain the emails, stating, “Here is the proposal I briefly mentioned to you. The person I described to you would be happy to talk with you either in person or over the phone. The person can get the emails which 1. Were classified and 2. Were purloined by our enemies. That would demonstrate what needs to be demonstrated.”269 Attached to the email was a 25-page proposal stating that the “Clinton email server was, in all likelihood, breached long ago,” and that the Chinese, Russian, and Iranian intelligence services could “re-assemble the server’s email content.”270 The proposal called for a three-phase approach. The first two phases consisted of open-source analysis. The third phase consisted of checking with certain intelligence sources “that have access through liaison work with various foreign services” to determine if any of those services had gotten to the server. The proposal noted, “Even if a single email was recovered and the providence [sic] of that email was a foreign service, it would be catastrophic to the Clinton campaign[.]” Smith forwarded the email to two colleagues and 264 Flynn 4/25/18 302, at 5-6; Flynn 5/1/18 302, at 1-3. 265 Flynn 5/1/18 302, at 1-3. 266 Flynn 4/25/18 302, at 7; Flynn 5/4/18 302, at 1-2; Flynn 11/29/17 302, at 7-8. 267 Flynn 11/29/17 302, at 7. 268 Szobocsan 3/29/17 302, at 1. 269 12/3/15 Email, Ledeen to Smith. 270 12/3/15 Email, Ledeen to Smith (attachment). 62 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) wrote, “we can discuss to whom it should be referred.”271 On December 16, 2015, Smith informed Ledeen that he declined to participate in her “initiative.” According to one of Smith’s business associates, Smith believed Ledeen’s initiative was not viable at that time.272 Just weeks after Trump’s July 2016 request to find the Clinton emails, however, Smith tried to locate and obtain the emails himself. He created a company, raised tens of thousands of dollars, and recruited security experts and business associates. Smith made claims to others involved in the effort (and those from whom he sought funding) that he was in contact with hackers with “ties and affiliations to Russia” who had access to the emails, and that his efforts were coordinated with the Trump Campaign.273 On August 28, 2016, Smith sent an email from an encrypted account with the subject “Sec. Clinton’s unsecured private email server” to an undisclosed list of recipients, including Campaign co-chairman Sam Clovis. The email stated that Smith was “[j]ust finishing two days of sensitive meetings here in DC with involved groups to poke and probe on the above. It is clear that the Clinton’s home-based, unprotected server was hacked with ease by both State-related players, and private mercenaries. Parties with varying interests, are circling to release ahead of the election.”274 On September 2, 2016, Smith directed a business associate to establish KLS Research LLC in furtherance of his search for the deleted Clinton emails.275 One of the purposes of KLS Research was to manage the funds Smith raised in support of his initiative.276 KLS Research received over $30,000 during the presidential campaign, although Smith represented that he raised even more money.277 Smith recruited multiple people for his initiative, including security experts to search for and authenticate the emails.278 In early September 2016, as part of his recruitment and fundraising effort, Smith circulated a document stating that his initiative was “in coordination” with the Trump Campaign, “to the extent permitted as an independent expenditure organization.”279 The document listed multiple individuals affiliated with the Trump Campaign, including Flynn, Clovis, Bannon, 271 12/3/15 Email, Smith to Szobocsan & Safron. 272 Szobocsan 3/29/18 302, at 1. 273 8/31/16 Email, Smith to Smith. 274 8/28/16 Email, Smith to Smith. (b)(3)-1 275 Incorporation papers of KLS Research LLC, 7/26/17 (b) (3) Szobocsan 3/29/18 302, at 2. 276 277 (b) (3) 278 Szobocsan 3/29/18 302, at 3. Financial Institution Record of Peter Smith and KLS Research LLC, 10/31/17 10/11/16 Email, Smith to (b) (6), (b) (7)(C) Tait 8/22/17 302, at 3; York 7/12/17 302, at 1-2; York 11/22/17 302, at 1. 279 - (b) (3) York 7/13/17 302 (attachment KLS Research, LLC, “Clinton Email Reconnaissance Initiative,” Sept. 9, 2016). 63 (b)(3)-1 (b)(6)/ (b)(7)(C)-4 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) and Kellyanne Conway.280 The investigation established that Smith communicated with at least Flynn and Clovis about his search for the deleted Clinton emails,281 but the Office did not identify evidence that any of the listed individuals initiated or directed Smith’s efforts. In September 2016, Smith and Ledeen got back in touch with each other about their respective efforts. Ledeen wrote to Smith, “wondering if you had some more detailed reports or memos or other data you could share because we have come a long way in our efforts since we last visited. . . . We would need as much technical discussion as possible so we could marry it against the new data we have found and then could share it back to you ‘your eyes only.’”282 Ledeen claimed to have obtained a trove of emails (from what she described as the “dark web”) that purported to be the deleted Clinton emails. Ledeen wanted to authenticate the emails and solicited contributions to fund that effort. Erik Prince provided funding to hire a tech advisor to ascertain the authenticity of the emails. According to Prince, the tech advisor determined that the emails were not authentic.283 A backup of Smith’s computer contained two files that had been downloaded from WikiLeaks and that were originally attached to emails received by John Podesta. The files on Smith’s computer had creation dates of October 2, 2016, which was prior to the date of their release by WikiLeaks. Forensic examination, however, established that the creation date did not reflect when the files were downloaded to Smith’s computer. (It appears the creation date was when WikiLeaks staged the document for release, as discussed in Volume I, Section III.B.3.c, supra.284) The investigation did not otherwise identify evidence that Smith obtained the files before their release by WikiLeaks. Smith continued to send emails to an undisclosed recipient list about Clinton’s deleted emails until shortly before the election. For example, on October 28, 2016, Smith wrote that there was a “tug-of-war going on within WikiLeaks over its planned releases in the next few days,” and that WikiLeaks “has maintained that it will save its best revelations for last, under the theory this allows little time for response prior to the U.S. election November 8.”285 An attachment to the 280 The same recruitment document listed Jerome Corsi under “Independent Groups/Organizations/Individuals,” and described him as an “established author and writer from the right on President Obama and Sec. Clinton.” 281 Flynn 11/29/17 302, at 7-8; 10/15/16 Email, Smith to Flynn et al.; 8/28/16 Email, Smith to Smith (bcc: Clovis et al.). 282 9/16/16 Email, Ledeen to Smith. 283 Prince 4/4/18 302, at 4-5. 284 The forensic analysis of Smith’s computer devices found that Smith used an older Apple operating system that would have preserved that October 2, 2016 creation date when it was downloaded (no matter what day it was in fact downloaded by Smith). See Volume I, Section III.B.3.c, supra. The Office tested this theory in March 2019 by downloading the two files found on Smith’s computer from WikiLeaks’s site using the same Apple operating system on Smith’s computer; both files were successfully downloaded and retained the October 2, 2016 creation date. See SM-2284941, serial 62. 285 10/28/16 Email, Smith to Smith. 64 U.S. Department of Justice Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) email claimed that WikiLeaks would release “All 33k deleted Emails” by “November 1st.” No emails obtained from Clinton’s server were subsequently released. Smith drafted multiple emails stating or intimating that he was in contact with Russian hackers. For example, in one such email, Smith claimed that, in August 2016, KLS Research had organized meetings with parties who had access to the deleted Clinton emails, including parties with “ties and affiliations to Russia.”286 The investigation did not identify evidence that any such meetings occurred. Associates and security experts who worked with Smith on the initiative did not believe that Smith was in contact with Russian hackers and were aware of no such connection.287 The investigation did not establish that Smith was in contact with Russian hackers or that Smith, Ledeen, or other individuals in touch with the Trump Campaign ultimately obtained the deleted Clinton emails. *** In sum, the investigation established that the GRU hacked into email accounts of persons affiliated with the Clinton Campaign, as well as the computers of the DNC and DCCC. The GRU then exfiltrated data related to the 2016 election from these accounts and computers, and disseminated that data through fictitious online personas (DCLeaks and Guccifer 2.0) and later through WikiLeaks. The investigation also established that the Trump Campaign displayed interest in the WikiLeaks releases, and that former Campaign member Roger Stone was in contact with the Campaign about those releases, claiming advance knowledge of more to come. As explained in Volume I, Section V.B, infra, the evidence was sufficient to support computerintrusion (and other) charges against GRU officers for their role in election-related hacking. (b)(5)-2 (b) (5) 286 8/31/16 Email, Smith to Smith. 287 Safron 3/20/18 302, at 3; Szobocsan 3/29/18 302, at 6. 65 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) IV. RUSSIAN GOVERNMENT LINKS TO AND CONTACTS WITH THE TRUMP CAMPAIGN The Office identified multiple contacts—“links,” in the words of the Appointment Order— between Trump Campaign officials and individuals with ties to the Russian government. The Office investigated whether those contacts constituted a third avenue of attempted Russian interference with or influence on the 2016 presidential election. In particular, the investigation examined whether these contacts involved or resulted in coordination or a conspiracy with the Trump Campaign and Russia, including with respect to Russia providing assistance to the Campaign in exchange for any sort of favorable treatment in the future. Based on the available information, the investigation did not establish such coordination. This Section describes the principal links between the Trump Campaign and individuals with ties to the Russian government, including some contacts with Campaign officials or associates that have been publicly reported to involve Russian contacts. Each subsection begins with an overview of the Russian contact at issue and then describes in detail the relevant facts, which are generally presented in chronological order, beginning with the early months of the Campaign and extending through the post-election, transition period. A. Campaign Period (September 2015 – November 8, 2016) Russian-government-connected individuals and media entities began showing interest in Trump’s campaign in the months after he announced his candidacy in June 2015.288 Because Trump’s status as a public figure at the time was attributable in large part to his prior business and entertainment dealings, this Office investigated whether a business contact with Russia-linked individuals and entities during the campaign period—the Trump Tower Moscow project, see Volume I, Section IV.A.1, infra—led to or involved coordination of election assistance. Outreach from individuals with ties to Russia continued in the spring and summer of 2016, when Trump was moving toward—and eventually becoming—the Republican nominee for President. As set forth below, the Office also evaluated a series of links during this period: outreach to two of Trump’s then-recently named foreign policy advisors, including a representation that Russia had “dirt” on Clinton in the form of thousands of emails (Volume I, Sections IV.A.2 & IV.A.3); dealings with a D.C.-based think tank that specializes in Russia and has connections with its government (Volume I, Section IV.A.4); a meeting at Trump Tower between the Campaign and a Russian lawyer promising dirt on candidate Clinton that was “part of Russia and its government’s support for [Trump]” (Volume I, Section IV.A.5); events at the Republican National Convention (Volume I, Section IV.A.6); post-Convention contacts between Trump Campaign officials and Russia’s ambassador to the United States (Volume I, Section IV.A.7); and contacts through campaign chairman Paul Manafort, who had previously worked for a Russian oligarch and a pro-Russian political party in Ukraine (Volume I, Section IV.A.8). 288 For example, on August 18, 2015, on behalf of the editor-in-chief of the internet newspaper Vzglyad, Georgi Asatryan emailed campaign press secretary Hope Hicks asking for a phone or in-person candidate interview. 8/18/15 Email, Asatryan to Hicks. One day earlier, the publication’s founder (and former Russian parliamentarian) Konstantin Rykov had registered two Russian websites—Trump2016.ru and DonaldTrump2016.ru. No interview took place. 66 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed . R. Crim. P. 6(e) 1. Trnmp Tower Moscow Proj ect The Tnunp Organization has pursued and completed projects outside the United States as paii of its real estate po1ifolio. Some projects have involved the acquisition and ownership (through subsidia1y cmporate structures) of prope1iy. In other cases, the Trnmp Organization has executed licensing deals with real estate developers and management companies, often local to the countiy where the project was located.289 Between at least 2013 and 2016, the Trnmp Organization explored a similai· licensing deal in Russia involving the construction of a Trnmp-branded prope1iy in Moscow. The project, commonly refe1Ted to as a "Trnmp Tower Moscow" or "Tnunp Moscow" project, anticipated a combination of commercial, hotel, and residential prope1iies all within the saine building. Between 2013 and June 2016, several employees of the Trnmp Organization, including then­ president of the organization Donald J. Trnmp, pursued a Moscow deal with several Russian counte1paii ies. From the fall of 2015 until the middle of 2016, Michael Cohen spearheaded the Trnmp Organization's pursuit of a Trnmp Tower Moscow project, including by reporting on the project's status to candidate Trnmp and other executives in the Trnmp Organization.290 a. Trump Tower Moscow Venture with the Crocus Group (2013-2014) The Trnmp Organization and the Crocus Group, a Russian real estate conglomerate owned and conti·olled by Aras Agalarov, began discussing a Russia-based real estate project sho1i ly after the conclusion of the 2013 Miss Universe pageant in Moscow. 291 Donald J. Trnmp Jr. served as the primaiy negotiator on behalf of the Trnmp Organization; Emin Agalarov (son of Aras Agalarov) and Irakli "Ike" Kaveladze represented the Crocus Group during negotiations,292 with the occasional assistance of Robert Goldstone.293 In December 2013, Kaveladze and Tnunp Jr. negotiated and signed preliininaiy te1ms of 289 See, e.g., Inteniiew of Donald J. Trump, Jr, Senate Judiciary Committee, 115th Cong. 151-52 (Sept. 7, 2017) (discussing licensing deals of specific projects). 290 As noted in Volume I, Section III.D.1, supra, in November 2018, Cohen pleaded guilty to making false statements to Congress concerning, among other things, the duration of the Tmmp Tower Moscow project. See Info1mation ,i 7(a), United States v. Michael Cohen , l:18-cr-850 (S.D.N.Y. Nov. 29, 2018), Doc. 2 ("Cohen Info1m ation"). 291 See Inteniie,,v of Donald J. Trump, Jr, Senate Judiciary Committee, 115th Cong. 13 (Sept. 7, 2017) ("Following the pageant the Tmmp Organization and Mr. Agalarov's company, Crocus Group, began prelimina1ily discussion [sic] potential real estate projects in Moscow."). As has been widely repo1ted, the Miss Universe pageant- which Tmmp co-owned at the time- was held at the Agalarov-owned Crocus City Hall in Moscow in November 2013. Both groups were involved in organizing the pageant, and Arns Agalarov' s son Emin was a musical perfo1mer at the event, which Tmmp attended. Kaveladze 11/ 16/ 17 302, at 2, 4-6; (b) (3) KAV_ 00385 (12/6/ 13 Email, Tmmp Jr. to Kaveladze & E. Agalarov). 292 OSC- (b)(3)-1 (b)(3)-1 67 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) an agreement for the Trump Tower Moscow project.294 On December 23, 2013, after discussions with Donald J. Trump, the Trump Organization agreed to accept an arrangement whereby the organization received a flat 3.5% commission on all sales, with no licensing fees or incentives.295 The parties negotiated a letter of intent during January and February 2014.296 From January 2014 through November 2014, the Trump Organization and Crocus Group discussed development plans for the Moscow project. Some time before January 24, 2014, the Crocus Group sent the Trump Organization a proposal for a 800-unit, 194-meter building to be constructed at an Agalarov-owned site in Moscow called “Crocus City,” which had also been the site of the Miss Universe pageant.297 In February 2014, Ivanka Trump met with Emin Agalarov and toured the Crocus City site during a visit to Moscow.298 From March 2014 through July 2014, the groups discussed “design standards” and other architectural elements.299 For example, in July 2014, members of the Trump Organization sent Crocus Group counterparties questions about the “demographics of these prospective buyers” in the Crocus City area, the development of neighboring parcels in Crocus City, and concepts for redesigning portions of the building.300 In August 2014, the Trump Organization requested specifications for a competing Marriott-branded tower being built in Crocus City.301 Beginning in September 2014, the Trump Organization stopped responding in a timely fashion to correspondence and proposals from the Crocus Group.302 Communications between the two groups continued through November 2014 with decreasing frequency; what appears to be the last communication is dated November 24, 2014.303 The project appears not to have developed past the planning stage, and no construction occurred. (b)(3)-1 294 (b) (3) 295 OSC-KAV_00452 (12/23/13 Email, Trump Jr. to Kaveladze & E. Agalarov). 296 See, e.g., OSC-KAV_01158 (Letter agreement signed by Trump Jr. & E. Agalarov); OSCKAV_01147 (1/20/14 Email, Kaveladze to Trump Jr. et al.). 297 See, e.g., OSC-KAV_00972 (10/14/14 Email, McGee to Khoo et al.) (email from Crocus Group contractor about specifications); OSC-KAV_00540 (1/24/14 Email, McGee to Trump Jr. et al.). 298 See OSC-KAV_00631 (2/5/14 Email, E. Agalarov to Ivanka Trump, Trump Jr. & Kaveladze); Goldstone Facebook post, 2/4/14 (8:01 a.m.) (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 299 See, e.g., OSC-KAV_00791 (6/3/14 Email, Kaveladze to Trump Jr. et al.; OSC-KAV_00799 (6/10/14 Email, Trump Jr. to Kaveladze et al.); OSC-KAV_00817 (6/16/14 Email, Trump Jr. to Kaveladze et al.). 300 OSC-KAV_00870 (7/17/14 Email, Khoo to McGee et al.). 301 OSC-KAV_00855 (8/4/14 Email, Khoo to McGee et al.). 302 OSC-KAV_00903 (9/29/14 Email, Tropea to McGee & Kaveladze (noting last response was on August 26, 2014)); OSC-KAV_00906 (9/29/14 Email, Kaveladze to Tropea & McGee (suggesting silence “proves my fear that those guys are bailing out of the project”)); OSC-KAV_00972 (10/14/14 Email, McGee to Khoo et al.) (email from Crocus Group contractor about development specifications)). 303 OSC-KAV_01140 (11/24/14 Email, Khoo to McGee et al.). 68 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) b. Communications with I.C. Expert Investment Company and Giorgi Rtskhiladze (Summer and Fall 2015) In the late summer of 2015, the Trump Organization received a new inquiry about pursuing a Trump Tower project in Moscow. In approximately September 2015, Felix Sater, a New Yorkbased real estate advisor, contacted Michael Cohen, then-executive vice president of the Trump Organization and special counsel to Donald J. Trump.304 Sater had previously worked with the Trump Organization and advised it on a number of domestic and international projects. Sater had explored the possibility of a Trump Tower project in Moscow while working with the Trump Organization and therefore knew of the organization’s general interest in completing a deal there.305 Sater had also served as an informal agent of the Trump Organization in Moscow previously and had accompanied Ivanka Trump and Donald Trump Jr. to Moscow in the mid2000s.306 Sater contacted Cohen on behalf of I.C. Expert Investment Company (I.C. Expert), a Russian real-estate development corporation controlled by Andrei Vladimirovich Rozov.307 Sater had known Rozov since approximately 2007 and, in 2014, had served as an agent on behalf of Rozov during Rozov’s purchase of a building in New York City.308 Sater later contacted Rozov and proposed that I.C. Expert pursue a Trump Tower Moscow project in which I.C. Expert would license the name and brand from the Trump Organization but construct the building on its own. Sater worked on the deal with Rozov and another employee of I.C. Expert.309 Cohen was the only Trump Organization representative to negotiate directly with I.C. Expert or its agents. In approximately September 2015, Cohen obtained approval to negotiate with I.C. Expert from candidate Trump, who was then president of the Trump Organization. Cohen provided updates directly to Trump about the project throughout 2015 and into 2016, assuring him the project was continuing.310 Cohen also discussed the Trump Moscow project with Ivanka Trump as to design elements (such as possible architects to use for the project311) and Donald J. Trump Jr. (about his experience in Moscow and possible involvement in the project312) during the fall of 2015. 304 Sater provided information to our Office in two 2017 interviews conducted under a proffer agreement,(b) (3) (b)(3)-1 (b)(3)-1 305 (b) (3) 306 Sater 9/19/17 302, at 1-2, 5. 307 Sater 9/19/17 302, at 3. 308 Rozov 1/25/18 302, at 1. 309 Rozov 1/25/18 302, at 1; see also 11/2/15 Email, Cohen to Rozov et al. (sending letter of intent). 310 Cohen 9/12/18 302, at 1-2, 4-6. 311 Cohen 9/12/18 302, at 5. 312 Cohen 9/12/18 302, at 4-5. 69 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Also during the fall of 2015, Cohen communicated about the Trump Moscow proposal with Giorgi Rtskhiladze, a business executive who previously had been involved in a development deal with the Trump Organization in Batumi, Georgia.313 Cohen stated that he spoke to Rtskhiladze in part because Rtskhiladze had pursued business ventures in Moscow, including a licensing deal with the Agalarov-owned Crocus Group.314 On September 22, 2015, Cohen forwarded a preliminary design study for the Trump Moscow project to Rtskhiladze, adding “I look forward to your reply about this spectacular project in Moscow.” Rtskhiladze forwarded Cohen’s email to an associate and wrote, “[i]f we could organize the meeting in New York at the highest level of the Russian Government and Mr. Trump this project would definitely receive the worldwide attention.”315 On September 24, 2015, Rtskhiladze sent Cohen an attachment that he described as a proposed “[l]etter to the Mayor of Moscow from Trump org,” explaining that “[w]e need to send this letter to the Mayor of Moscow (second guy in Russia) he is aware of the potential project and will pledge his support.”316 In a second email to Cohen sent the same day, Rtskhiladze provided a translation of the letter, which described the Trump Moscow project as a “symbol of stronger economic, business and cultural relationships between New York and Moscow and therefore United States and the Russian Federation.”317 On September 27, 2015, Rtskhiladze sent another email to Cohen, proposing that the Trump Organization partner on the Trump Moscow project with “Global Development Group LLC,” which he described as being controlled by Michail Posikhin, a Russian architect, and Simon Nizharadze.318 Cohen told the Office that he ultimately declined the proposal and instead continued to work with I.C. Expert, the company represented by Felix Sater.319 c. Letter of Intent and Contacts to Russian Government (October 2015-January 2016) i. Trump Signs the Letter of Intent on behalf of the Trump Organization Between approximately October 13, 2015 and November 2, 2015, the Trump Organization (through its subsidiary Trump Acquisition, LLC) and I.C. Expert completed a letter of intent (LOI) for a Trump Moscow property. The LOI, signed by Trump for the Trump Organization and Rozov on behalf of I.C. Expert, was “intended to facilitate further discussions” in order to “attempt to 313 Rtskhiladze was a U.S.-based executive of the Georgian company Silk Road Group. In approximately 2011, Silk Road Group and the Trump Organization entered into a licensing agreement to build a Trump-branded property in Batumi, Georgia. Rtskhiladze was also involved in discussions for a Trump-branded project in Astana, Kazakhstan. The Office twice interviewed Rtskhiladze, (b) (3) 314 Cohen 9/12/18 302, at 12; see also Rtskhiladze 5/10/18 302, at 1. 315 9/22/15 Email, Rtskhiladze to Nizharadze. 316 9/24/15 Email, Rtskhiladze to Cohen. 317 9/24/15 Email, Rtskhiladze to Cohen. 318 9/27/15 Email, Rtskhiladze to Cohen. 319 Cohen 9/12/18 302, at 12. 70 - (b)(3)-1 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) enter into a mutually acceptable agreement” related to the Trump-branded project in Moscow.320 The LOI contemplated a development with residential, hotel, commercial, and office components, and called for “[a]pproximately 250 first class, luxury residential condominiums,” as well as “[o]ne first class, luxury hotel consisting of approximately 15 floors and containing not fewer than 150 hotel rooms.”321 For the residential and commercial portions of the project, the Trump Organization would receive between 1% and 5% of all condominium sales,322 plus 3% of all rental and other revenue.323 For the project’s hotel portion, the Trump Organization would receive a base fee of 3% of gross operating revenues for the first five years and 4% thereafter, plus a separate incentive fee of 20% of operating profit. 324 Under the LOI, the Trump Organization also would receive a $4 million “up-front fee” prior to groundbreaking.325 Under these terms, the Trump Organization stood to earn substantial sums over the lifetime of the project, without assuming significant liabilities or financing commitments.326 On November 3, 2015, the day after the Trump Organization transmitted the LOI, Sater emailed Cohen suggesting that the Trump Moscow project could be used to increase candidate Trump’s chances at being elected, writing: Buddy our boy can become President of the USA and we can engineer it. I will get all of Putins team to buy in on this, I will manage this process. . . . Michael, Putin gets on stage with Donald for a ribbon cutting for Trump Moscow, and Donald owns the republican nomination. And possibly beats Hillary and our boy is in. . . . We will manage this process better than anyone. You and I will get Donald and Vladimir on a stage together very shortly. That the game changer.327 Later that day, Sater followed up: Donald doesn’t stare down, he negotiates and understands the economic issues and Putin only want to deal with a pragmatic leader, and a successful business man is a good candidate for someone who knows how to negotiate. “Business, politics, whatever it all is the same for someone who knows how to deal” 320 11/2/15 Email, Cohen to Rozov et al. (attachment) (hereinafter “LOI”); see also 10/13/15 Email, Sater to Cohen & Davis (attaching proposed letter of intent). 321 LOI, p. 2. 322 The LOI called for the Trump Organization to receive 5% of all gross sales up to $100 million; 4% of all gross sales from $100 million to $250 million; 3% of all gross sales from $250 million to $500 million; 2% of all gross sales from $500 million to $1 billion; and 1% of all gross sales over $1 billion. LOI, Schedule 2. 323 LOI, Schedule 2. 324 LOI, Schedule 1. 325 LOI, Schedule 2. 326 Cohen 9/12/18 302, at 3. 327 11/3/15 Email, Sater to Cohen (12:14 p.m.). 71 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) I think I can get Putin to say that at the Trump Moscow press conference. If he says it we own this election. Americas most difficult adversary agreeing that Donald is a good guy to negotiate. . . . We can own this election. Michael my next steps are very sensitive with Putins very very close people, we can pull this off. Michael lets go. 2 boys from Brooklyn getting a USA president elected. This is good really good.328 According to Cohen, he did not consider the political import of the Trump Moscow project to the 2016 U.S. presidential election at the time. Cohen also did not recall candidate Trump or anyone affiliated with the Trump Campaign discussing the political implications of the Trump Moscow project with him. However, Cohen recalled conversations with Trump in which the candidate suggested that his campaign would be a significant “infomercial” for Trump-branded properties.329 ii. Post-LOI Contacts with Individuals in Russia Given the size of the Trump Moscow project, Sater and Cohen believed the project required approval (whether express or implicit) from the Russian national government, including from the Presidential Administration of Russia.330 Sater stated that he therefore began to contact the Presidential Administration through another Russian business contact.331 In early negotiations with the Trump Organization, Sater had alluded to the need for government approval and his attempts to set up meetings with Russian officials. On October 12, 2015, for example, Sater wrote to Cohen that “all we need is Putin on board and we are golden,” and that a “meeting with Putin and top deputy is tentatively set for the 14th [of October].”332 (b) (3) this meeting (b)(3)-1 was being coordinated by associates in Russia and that he had no direct interaction with the Russian government.333 Approximately a month later, after the LOI had been signed, Lana Erchova emailed Ivanka Trump on behalf of Erchova’s then-husband Dmitry Klokov, to offer Klokov’s assistance to the Trump Campaign.334 Klokov was at that time Director of External Communications for PJSC Federal Grid Company of Unified Energy System, a large Russian electricity transmission 328 11/3/15 Email, Sater to Cohen (12:40 p.m.). 329 Cohen 9/12/18 302, at 3-4; Cohen 8/7/18 302, at 15. 330 (b) (3) 331 Sater 12/15/17 302, at 3-4. 332 10/12/15 Email, Sater to Cohen (8:07 a.m.). 333 (b) (3) Sater 12/15/17 302, at 2. (b)(3)-1 (b)(3)-1 334 Ivanka Trump received an email from a woman who identified herself as “Lana E. Alexander,” which said in part, “If you ask anyone who knows Russian to google my husband Dmitry Klokov, you’ll see who he is close to and that he has done Putin’s political campaigns.” 11/16/15 Email, Erchova to I. Trump. 72 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) company, and had been previously employed as an aide and press secretary to Russia’s energy minister. Ivanka Trump forwarded the email to Cohen.335 He told the Office that, after receiving this inquiry, he had conducted an internet search for Klokov’s name and concluded (incorrectly) that Klokov was a former Olympic weightlifter.336 Between November 18 and 19, 2015, Klokov and Cohen had at least one telephone call and exchanged several emails. Describing himself in emails to Cohen as a “trusted person” who could offer the Campaign “political synergy” and “synergy on a government level,” Klokov recommended that Cohen travel to Russia to speak with him and an unidentified intermediary. Klokov said that those conversations could facilitate a later meeting in Russia between the candidate and an individual Klokov described as “our person of interest.”337 In an email to the Office, Erchova later identified the “person of interest” as Russian President Vladimir Putin.338 In the telephone call and follow-on emails with Klokov, Cohen discussed his desire to use a near-term trip to Russia to do site surveys and talk over the Trump Moscow project with local developers. Cohen registered his willingness also to meet with Klokov and the unidentified intermediary, but was emphatic that all meetings in Russia involving him or candidate Trump— including a possible meeting between candidate Trump and Putin—would need to be “in conjunction with the development and an official visit” with the Trump Organization receiving a formal invitation to visit.339 (Klokov had written previously that “the visit [by candidate Trump to Russia] has to be informal.”)340 Klokov had also previously recommended to Cohen that he separate their negotiations over a possible meeting between Trump and “the person of interest” from any existing business track.341 Re-emphasizing that his outreach was not done on behalf of any business, Klokov added in second email to Cohen that, if publicized well, such a meeting could have “phenomenal” impact “in a business dimension” and that the “person of interest[’s]” “most important support” could have significant ramifications for the “level of projects and their capacity.” Klokov concluded by telling 335 11/16/15 Email, I. Trump to Cohen. 336 Cohen 8/7/18 302, at 17. During his interviews with the Office, Cohen still appeared to believe that the Klokov he spoke with was that Olympian. The investigation, however, established that the email address used to communicate with Cohen belongs to a different Dmitry Klokov, as described above. 337 11/18/15 Email, Klokov to Cohen (6:51 a.m.). 338 In July 2018, the Office received an unsolicited email purporting to be from Erchova, in which she wrote that “[a]t the end of 2015 and beginning of 2016 I was asked by my ex-husband to contact Ivanka Trump . . . and offer cooperation to Trump’s team on behalf of the Russian officials.” 7/27/18 Email, Erchova to Special Counsel’s Office. The email claimed that the officials wanted to offer candidate Trump “land in Crimea among other things and unofficial meeting with Putin.” Id. In order to vet the email’s claims, the Office responded requesting more details. The Office did not receive any reply. 339 11/18/15 Email, Cohen to Klokov (7:15 a.m.). 340 11/18/15 Email, Klokov to Cohen (6:51 a.m.). 341 11/18/15 Email, Klokov to Cohen (6:51 a.m.) (“I would suggest separating your negotiations and our proposal to meet. I assure you, after the meeting level of projects and their capacity can be completely different, having the most important support.”). 73 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Cohen that there was “no bigger warranty in any project than [the] consent of the person of interest.”342 Cohen rejected the proposal, saying that “[c]urrently our LOI developer is in talks with VP’s Chief of Staff and arranging a formal invite for the two to meet.”343 This email appears to be their final exchange, and the investigation did not identify evidence that Cohen brought Klokov’s initial offer of assistance to the Campaign’s attention or that anyone associated with the Trump Organization or the Campaign dealt with Klokov at a later date. Cohen explained that he did not pursue the proposed meeting because he was already working on the Moscow Project with Sater, who Cohen understood to have his own connections to the Russian government.344 By late December 2015, however, Cohen was complaining that Sater had not been able to use those connections to set up the promised meeting with Russian government officials. Cohen told Sater that he was “setting up the meeting myself.”345 On January 11, 2016, Cohen emailed the office of Dmitry Peskov, the Russian government’s press secretary, indicating that he desired contact with Sergei Ivanov, Putin’s chief of staff. Cohen erroneously used the email address “Pr_peskova@prpress.gof.ru” instead of “Pr_peskova@prpress.gov.ru,” so the email apparently did not go through.346 On January 14, 2016, Cohen emailed a different address (info@prpress.gov.ru) with the following message: Dear Mr. Peskov, Over the past few months, I have been working with a company based in Russia regarding the development of a Trump Tower-Moscow project in Moscow City. Without getting into lengthy specifics, the communication between our two sides has stalled. As this project is too important, I am hereby requesting your assistance. I respectfully request someone, preferably you; contact me so that I might discuss the specifics as well as arranging meetings with the appropriate individuals. I thank you in advance for your assistance and look forward to hearing from you soon.347 Two days later, Cohen sent an email to Pr_peskova@prpress.gov.ru, repeating his request to speak with Sergei Ivanov.348 Cohen testified to Congress, and initially told the Office, that he did not recall receiving a response to this email inquiry and that he decided to terminate any further work on the Trump Moscow project as of January 2016. Cohen later admitted that these statements were false. In 342 11/19/15 Email, Klokov to Cohen (7:40 a.m.). 343 11/19/15 Email, Cohen to Klokov (12:56 p.m.). 344 Cohen 9/18/18 302, at 12. 345 FS00004 (12/30/15 Text Message, Cohen to Sater (6:17 p.m.)). 346 1/11/16 Email, Cohen to pr_peskova@prpress.gof.ru (9:12 a.m.). 347 1/14/16 Email, Cohen to info@prpress.gov.ru (9:21 a.m.). 348 1/16/16 Email, Cohen to pr_peskova@prpress.gov.ru (10:28 a.m.). 74 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) fact, Cohen had received (and recalled receiving) a response to his inquiry, and he continued to work on and update candidate Trump on the project through as late as June 2016.349 On January 20, 2016, Cohen received an email from Elena Poliakova, Peskov’s personal assistant. Writing from her personal email account, Poliakova stated that she had been trying to reach Cohen and asked that he call her on the personal number that she provided.350 Shortly after receiving Poliakova’s email, Cohen called and spoke to her for 20 minutes.351 Cohen described to Poliakova his position at the Trump Organization and outlined the proposed Trump Moscow project, including information about the Russian counterparty with which the Trump Organization had partnered. Cohen requested assistance in moving the project forward, both in securing land to build the project and with financing. According to Cohen, Poliakova asked detailed questions and took notes, stating that she would need to follow up with others in Russia.352 Cohen could not recall any direct follow-up from Poliakova or from any other representative of the Russian government, nor did the Office identify any evidence of direct follow-up. However, the day after Cohen’s call with Poliakova, Sater texted Cohen, asking him to “[c]all me when you have a few minutes to chat . . . It’s about Putin they called today.”353 Sater then sent a draft invitation for Cohen to visit Moscow to discuss the Trump Moscow project,354 along with a note to “[t]ell me if the letter is good as amended by me or make whatever changes you want and send it back to me.”355 After a further round of edits, on January 25, 2016, Sater sent Cohen an invitation—signed by Andrey Ryabinskiy of the company MHJ—to travel to “Moscow for a working visit” about the “prospects of development and the construction business in Russia,” “the various land plots available suited for construction of this enormous Tower,” and “the opportunity to co-ordinate a follow up visit to Moscow by Mr. Donald Trump.”356 According 349 Cohen Information ¶¶ 4, 7. Cohen’s interactions with President Trump and the President’s lawyers when preparing his congressional testimony are discussed further in Volume II. See Vol. II, Section II.K.3, infra. 350 1/20/16 Email, Poliakova to Cohen (5:57 a.m.) (“Mr. Cohen[,] I can’t get through to both your phones. Pls, call me.”). 351 Telephone records show a 20-minute call on January 20, 2016 between Cohen and the number Poliakova provided in her email. Call Records of Michael Cohen (b) (3) After (b)(3)-1 the call, Cohen saved Poliakova’s contact information in his Trump Organization Outlook contact list. 1/20/16 Cohen Microsoft Outlook Entry (6:22 a.m.). 352 Cohen 9/12/18 302, at 2-3. 353 FS00011 (1/21/16 Text Messages, Sater to Cohen). 354 The invitation purported to be from Genbank, a Russian bank that was, according to Sater, working at the behest of a larger bank, VTB, and would consider providing financing. FS00008 (12/31/15 Text Messages, Sater & Cohen). Additional information about Genbank can be found infra. 355 FS00011 (1/21/16 Text Message, Sater to Cohen (7:44 p.m.)); 1/21/16 Email, Sater to Cohen (6:49 p.m.). 356 1/25/16 Email, Sater to Cohen (12:01 p.m.) (attachment). 75 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) to Cohen, he elected not to travel at the time because of concerns about the lack of concrete proposals about land plots that could be considered as options for the project.357 d. Discussions about Russia Travel by Michael Cohen or Candidate Trump (December 2015-June 2016) i. Sater’s Overtures to Cohen to Travel to Russia The late January communication was neither the first nor the last time that Cohen contemplated visiting Russia in pursuit of the Trump Moscow project. Beginning in late 2015, Sater repeatedly tried to arrange for Cohen and candidate Trump, as representatives of the Trump Organization, to travel to Russia to meet with Russian government officials and possible financing partners. In December 2015, Sater sent Cohen a number of emails about logistics for traveling to Russia for meetings.358 On December 19, 2015, Sater wrote: Please call me I have Evgeney [Dvoskin] on the other line.[359] He needs a copy of your and Donald’s passports they need a scan of every page of the passports. Invitations & Visas will be issued this week by VTB Bank to discuss financing for Trump Tower Moscow. Politically neither Putins office nor Ministry of Foreign Affairs cannot issue invite, so they are inviting commercially/ business. VTB is Russia’s 2 biggest bank and VTB Bank CEO Andrey Kostin, will be at all meetings with Putin so that it is a business meeting not political. We will be invited to Russian consulate this week to receive invite & have visa issued.360 In response, Cohen texted Sater an image of his own passport.361 Cohen told the Office that at one point he requested a copy of candidate Trump’s passport from Rhona Graff, Trump’s executive assistant at the Trump Organization, and that Graff later brought Trump’s passport to Cohen’s 357 Cohen 9/12/18 302, at 6-7. 358 See, e.g., 12/1/15 Email, Sater to Cohen (12:41 p.m.) (“Please scan and send me a copy of your passport for the Russian Ministry of Foreign Affairs.”). 359 Toll records show that Sater was speaking to Evgeny Dvoskin. Call Records of Felix Sater Dvoskin is an executive of Genbank, a large bank with lending focused (b)(3)-1 in Crimea, Ukraine. At the time that Sater provided this financing letter to Cohen, Genbank was subject to U.S. government sanctions, see Russia/Ukraine-related Sanctions and Identifications, Office of Foreign Assets Control (Dec. 22, 2015), available at https://www.treasury.gov/resource-center/sanctions/OFACEnforcement/Pages/20151222.aspx. Dvoskin, who had been deported from the United States in 2000 for criminal activity, was under indictment in the United States for stock fraud under the aliases Eugene Slusker and Gene Shustar. See United States v. Rizzo, et al., 2:03-cr-63 (E.D.N.Y. Feb. 6, 2003). (b) (3) 360 12/19/15 Email, Sater to Cohen (10:50 a.m.); FS00002 (12/19/15 Text Messages, Sater to Cohen, (10:53 a.m.). 361 FS00004 (12/19/15 Text Message, Cohen to Sater); ERT_0198-256 (12/19/15 Text Messages, Cohen & Sater). 76 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) office.362 The investigation did not, however, establish that the passport was forwarded to Sater.363 Into the spring of 2016, Sater and Cohen continued to discuss a trip to Moscow in connection with the Trump Moscow project. On April 20, 2016, Sater wrote Cohen, “[t]he People wanted to know when you are coming?”364 On May 4, 2016, Sater followed up: I had a chat with Moscow. ASSUMING the trip does happen the question is before or after the convention. I said I believe, but don't know for sure, that’s it’s probably after the convention. Obviously the pre-meeting trip (you only) can happen anytime you want but the 2 big guys where [sic] the question. I said I would confirm and revert. . . . Let me know about If I was right by saying I believe after Cleveland and also when you want to speak to them and possibly fly over.365 Cohen responded, “My trip before Cleveland. Trump once he becomes the nominee after the convention.”366 The day after this exchange, Sater tied Cohen’s travel to Russia to the St. Petersburg International Economic Forum (“Forum”), an annual event attended by prominent Russian politicians and businessmen. Sater told the Office that he was informed by a business associate that Peskov wanted to invite Cohen to the Forum.367 On May 5, 2016, Sater wrote to Cohen: Peskov would like to invite you as his guest to the St. Petersburg Forum which is Russia’s Davos it’s June 16-19. He wants to meet there with you and possibly introduce you to either Putin or Medvedev, as they are not sure if 1 or both will be there. This is perfect. The entire business class of Russia will be there as well. He said anything you want to discuss including dates and subjects are on the table to discuss[.]368 The following day, Sater asked Cohen to confirm those dates would work for him to travel; Cohen wrote back, “[w]orks for me.”369 362 Cohen 9/12/18 302, at 5. 363 On December 21, 2015, Sater sent Cohen a text message that read, “They need a copy of DJT passport,” to which Cohen responded, “After I return from Moscow with you with a date for him.” FS00004 (12/21/15 Text Messages, Cohen & Sater). 364 FS00014 (4/20/16 Text Message, Sater to Cohen (9:06 p.m.)). 365 FS00015 (5/4/16 Text Message, Sater to Cohen (7:38 p.m.)). 366 FS00015 (5/4/16 Text Message, Cohen to Sater (8:03 p.m.)). 367 Sater 12/15/17 302, at 4. 368 FS00016 (5/5/16 Text Messages, Sater to Cohen (6:26 & 6:27 a.m.)). 369 FS00016 (5/6/16 Text Messages, Cohen & Sater). 77 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) On June 9, 2016, Sater sent Cohen a notice that he (Sater) was completing the badges for the Forum, adding, “Putin is there on the 17th very strong chance you will meet him as well.”370 On June 13, 2016, Sater forwarded Cohen an invitation to the Forum signed by the Director of the Roscongress Foundation, the Russian entity organizing the Forum.371 Sater also sent Cohen a Russian visa application and asked him to send two passport photos.372 According to Cohen, the invitation gave no indication that Peskov had been involved in inviting him. Cohen was concerned that Russian officials were not actually involved or were not interested in meeting with him (as Sater had alleged), and so he decided not to go to the Forum.373 On June 14, 2016, Cohen met Sater in the lobby of the Trump Tower in New York and informed him that he would not be traveling at that time.374 ii. Candidate Trump’s Opportunities to Travel to Russia The investigation identified evidence that, during the period the Trump Moscow project was under consideration, the possibility of candidate Trump visiting Russia arose in two contexts. First, in interviews with the Office, Cohen stated that he discussed the subject of traveling to Russia with Trump twice: once in late 2015; and again in spring 2016.375 According to Cohen, Trump indicated a willingness to travel if it would assist the project significantly. On one occasion, Trump told Cohen to speak with then-campaign manager Corey Lewandowski to coordinate the candidate’s schedule. Cohen recalled that he spoke with Lewandowski, who suggested that they speak again when Cohen had actual dates to evaluate. Cohen indicated, however, that he knew that travel prior to the Republican National Convention would be impossible given the candidate’s preexisting commitments to the Campaign.376 Second, like Cohen, Trump received and turned down an invitation to the St. Petersburg International Economic Forum. In late December 2015, Mira Duma—a contact of Ivanka Trump’s from the fashion industry—first passed along invitations for Ivanka Trump and candidate Trump from Sergei Prikhodko, a Deputy Prime Minister of the Russian Federation.377 On January 14, 2016, Rhona Graff sent an email to Duma stating that Trump was “honored to be asked to participate in the highly prestigious” Forum event, but that he would “have to decline” the invitation given his “very grueling and full travel schedule” as a presidential candidate.378 Graff 370 FS00018 (6/9/16 Text Messages, Sater & Cohen). 371 6/13/16 Email, Sater to Cohen (2:10 p.m.). 372 FS00018 (6/13/16 Text Message, Sater to Cohen (2:20 p.m.)); 6/13/16 Email, Sater to Cohen. 373 Cohen 9/12/18 302, at 6-8. 374 FS00019 (6/14/16 Text Messages, Cohen & Sater (12:06 and 2:50 p.m.)). 375 Cohen 9/12/18 302, at 2. 376 Cohen 9/12/18 302, at 7. 377 12/21/15 Email, Mira to Ivanka Trump (6:57 a.m.) (attachments); TRUMPORG_16_000057 (1/7/16 Email, I. Trump to Graff (9:18 a.m.)). 378 1/14/16 Email, Graff to Mira. 78 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) asked Duma whether she recommended that Graff “send a formal note to the Deputy Prime Minister” declining his invitation; Duma replied that a formal note would be “great.”379 It does not appear that Graff prepared that note immediately. According to written answers from President Trump,380 Graff received an email from Deputy Prime Minister Prikhodko on March 17, 2016, again inviting Trump to participate in the 2016 Forum in St. Petersburg.381 Two weeks later, on March 31, 2016, Graff prepared for Trump’s signature a two-paragraph letter declining the invitation.382 The letter stated that Trump’s “schedule has become extremely demanding” because of the presidential campaign, that he “already ha[d] several commitments in the United States” for the time of the Forum, but that he otherwise “would have gladly given every consideration to attending such an important event.”383 Graff forwarded the letter to another executive assistant at the Trump Organization with instructions to print the document on letterhead for Trump to sign.384 At approximately the same time that the letter was being prepared, Robert Foresman—a New York-based investment banker—began reaching out to Graff to secure an in-person meeting with candidate Trump. According to Foresman, he had been asked by Anton Kobyakov, a Russian presidential aide involved with the Roscongress Foundation, to see if Trump could speak at the Forum.385 Foresman first emailed Graff on March 31, 2016, following a phone introduction brokered through Trump business associate Mark Burnett (who produced the television show The Apprentice). In his email, Foresman referenced his long-standing personal and professional expertise in Russia and Ukraine, his work setting up an early “private channel” between Vladimir Putin and former U.S. President George W. Bush, and an “approach” he had received from “senior Kremlin officials” about the candidate. Foresman asked Graff for a meeting with the candidate, Corey Lewandowski, or “another relevant person” to discuss this and other “concrete things” Foresman felt uncomfortable discussing over “unsecure email.”386 On April 4, 2016, Graff forwarded Foresman’s meeting request to Jessica Macchia, another executive assistant to Trump.387 379 1/15/16 Email, Mira to Graff. 380 As explained in Volume II and Appendix C, on September 17, 2018, the Office sent written questions to the President’s counsel. On November 20, 2018, the President provided written answers to those questions through counsel. 381 Written Responses of Donald J. Trump (Nov. 20, 2018), at 17 (Response to Question IV, Part (e)) (“[D]ocuments show that Ms. Graff prepared for my signature a brief response declining the invitation.”). 382 Written Responses of Donald J. Trump (Nov. 20, 2018), at 17 (Response to Question IV, Part (e)); see also TRUMPORG_16_000134 (unsigned letter dated March 31, 2016). 383 TRUMPORG_16_000134 (unsigned letter). 384 TRUMPORG_16_000133 (3/31/16 Email, Graff to Macchia). 385 Foresman 10/17/18 302, at 3-4. 386 See TRUMPORG_16_00136 (3/31/16 Email, Foresman to Graff); see also Foresman 10/17/18 302, at 3-4. 387 See TRUMPORG_16_00136 (4/4/16 Email, Graff to Macchia). 79 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) With no response forthcoming, Foresman twice sent reminders to Graff—first on April 26 and again on April 30, 2016.388 Graff sent an apology to Foresman and forwarded his April 26 email (as well as his initial March 2016 email) to Lewandowski.389 On May 2, 2016, Graff forwarded Foresman’s April 30 email—which suggested an alternative meeting with Donald Trump Jr. or Eric Trump so that Foresman could convey to them information that “should be conveyed to [the candidate] personally or [to] someone [the candidate] absolutely trusts”—to policy advisor Stephen Miller.390 No communications or other evidence obtained by the Office indicate that the Trump Campaign learned that Foresman was reaching out to invite the candidate to the Forum or that the Campaign otherwise followed up with Foresman until after the election, when he interacted with the Transition Team as he pursued a possible position in the incoming Administration.391 When interviewed by the Office, Foresman denied that the specific “approach” from “senior Kremlin officials” noted in his March 31, 2016 email was anything other than Kobyakov’s invitation to Roscongress. According to Foresman, the “concrete things” he referenced in the same email were a combination of the invitation itself, Foresman’s personal perspectives on the invitation and Russia policy in general, and details of a Ukraine plan supported by a U.S. think tank (EastWest Institute). Foresman told the Office that Kobyakov had extended similar invitations through him to another Republican presidential candidate and one other politician. Foresman also said that Kobyakov had asked Foresman to invite Trump to speak after that other presidential candidate withdrew from the race and the other politician’s participation did not work out.392 Finally, Foresman claimed to have no plans to establish a back channel involving Trump, stating the reference to his involvement in the Bush-Putin back channel was meant to burnish his credentials to the Campaign. Foresman commented that he had not recognized any of the experts announced as Trump’s foreign policy team in March 2016, and wanted to secure an in-person meeting with the candidate to share his professional background and policy views, including that Trump should decline Kobyakov’s invitation to speak at the Forum.393 2. George Papadopoulos George Papadopoulos was a foreign policy advisor to the Trump Campaign from March 388 See TRUMPORG_16_00137 (4/26/16 Email, Foresman to Graff); TRUMPORG_16_00141 (4/30/16 Email, Foresman to Graff). 389 See TRUMPORG_16_00139 (4/27/16 Email, Graff to Foresman); TRUMPORG_16_00137 (4/27/16 Email, Graff to Lewandowski). 390 TRUMPORG_16_00142 (5/2/16 Email, Graff to S. Miller); see also TRUMPORG_16_00143 (5/2/16 Email, Graff to S. Miller) (forwarding March 2016 email from Foresman). 391 Foresman’s contacts during the transition period are discussed further in Volume I, Section IV.B.3, infra. 392 Foresman 10/17/18 302, at 4. 393 Foresman 10/17/18 302, at 8-9. 80 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) 2016 to early October 2016.394 In late April 2016, Papadopoulos was told by London-based professor Joseph Mifsud, immediately after Mifsud’s return from a trip to Moscow, that the Russian government had obtained “dirt” on candidate Clinton in the form of thousands of emails. One week later, on May 6, 2016, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information that would be damaging to candidate Clinton. Papadopoulos shared information about Russian “dirt” with people outside of the Campaign, and the Office investigated whether he also provided it to a Campaign official. Papadopoulos and the Campaign officials with whom he interacted told the Office that they did not recall that Papadopoulos passed them the information. Throughout the relevant period of time and for several months thereafter, Papadopoulos worked with Mifsud and two Russian nationals to arrange a meeting between the Campaign and the Russian government. That meeting never came to pass. a. Origins of Campaign Work In March 2016, Papadopoulos became a foreign policy advisor to the Trump Campaign.395 As early as the summer of 2015, he had sought a role as a policy advisor to the Campaign but, in a September 30, 2015 email, he was told that the Campaign was not hiring policy advisors.396 In late 2015, Papadopoulos obtained a paid position on the campaign of Republican presidential candidate Ben Carson.397 Although Carson remained in the presidential race until early March 2016, Papadopoulos had stopped actively working for his campaign by early February 2016.398 At that time, Papadopoulos reached out to a contact at the London Centre of International Law Practice (LCILP), which billed itself as a “unique institution . . . comprising high-level professional international law practitioners, dedicated to the advancement of global legal knowledge and the practice of international law.”399 Papadopoulos said that he had finished his role with the Carson 394 Papadopoulos met with our Office for debriefings on several occasions in the summer and fall of 2017, after he was arrested and charged in a sealed criminal complaint with making false statements in a January 2017 FBI interview about, inter alia, the timing, extent, and nature of his interactions and communications with Joseph Mifsud and two Russian nationals: Olga Polonskaya and Ivan Timofeev. Papadopoulos later pleaded guilty, pursuant to a plea agreement, to an information charging him with making false statements to the FBI, in violation of 18 U.S.C. § 1001(a). 395 A Transcript of Donald Trump’s Meeting with the Washington Post Editorial Board, Washington Post (Mar. 21, 2016). 396 7/15/15 LinkedIn Message, Papadopoulos to Lewandowski (6:57 a.m.); 9/30/15 Email, Glassner to Papadopoulos (7:42:21 a.m.). 397 Papadopoulos 8/10/17 302, at 2. 398 Papadopoulos 8/10/17 302, at 2; 2/4/16 Email, Papadopoulos to Idris. 399 London Centre of International Law Practice, at https://www.lcilp.org/ (via web.archive.org). 81 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) campaign and asked if LCILP was hiring.400 In early February, Papadopoulos agreed to join LCILP and arrived in London to begin work.401 As he was taking his position at LCILP, Papadopoulos contacted Trump campaign manager Corey Lewandowski via LinkedIn and emailed campaign official Michael Glassner about his interest in joining the Trump Campaign.402 On March 2, 2016, Papadopoulos sent Glassner another message reiterating his interest.403 Glassner passed along word of Papadopoulos’s interest to another campaign official, Joy Lutes, who notified Papadopoulos by email that she had been told by Glassner to introduce Papadopoulos to Sam Clovis, the Trump Campaign’s national cochair and chief policy advisor.404 At the time of Papadopoulos’s March 2 email, the media was criticizing the Trump Campaign for lack of experienced foreign policy or national security advisors within its ranks.405 To address that issue, senior Campaign officials asked Clovis to put a foreign policy team together on short notice.406 After receiving Papadopoulos’s name from Lutes, Clovis performed a Google search on Papadopoulos, learned that he had worked at the Hudson Institute, and believed that he had credibility on energy issues.407 On March 3, 2016, Clovis arranged to speak with Papadopoulos by phone to discuss Papadopoulos joining the Campaign as a foreign policy advisor, and on March 6, 2016, the two spoke.408 Papadopoulos recalled that Russia was mentioned as a topic, and he understood from the conversation that Russia would be an important aspect of the Campaign’s foreign policy.409 At the end of the conversation, Clovis offered Papadopoulos a role as a foreign policy advisor to the Campaign, and Papadopoulos accepted the offer.410 b. Initial Russia-Related Contacts Approximately a week after signing on as a foreign policy advisor, Papadopoulos traveled 400 2/4/16 Email, Papadopoulos to Idris. 401 2/5/16 Email, Idris to Papadopoulos (6:11:25 p.m.); 2/6/16 Email, Idris to Papadopoulos (5:34:15 p.m.). 402 2/4/16 LinkedIn Message, Papadopoulos to Lewandowski (1:28 p.m.); 2/4/16 Email, Papadopoulos to Glassner (2:10:36 p.m.). 403 3/2/16 Email, Papadopoulos to Glassner (11:17:23 a.m.). 404 3/2/16 Email, Lutes to Papadopoulos (10:08:15 p.m.). 405 Clovis 10/3/17 302 (1 of 2), at 4. 406 Clovis 10/3/17 302 (1 of 2), at 4. 407 (b) (3) ; 3/3/16 Email, Lutes to Clovis & Papadopoulos (6:05:47 p.m.). 408 3/6/16 Email, Papadopoulos to Clovis (4:24:21 p.m.). 409 Statement of Offense ¶ 4, United States v. George Papadopoulos, 1:17-cr-182 (D.D.C. Oct. 5, 2017), Doc. 19 (“Papadopoulos Statement of Offense”). 410 Papadopoulos 8/10/17 302, at 2. 82 (b)(3)-1 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) to Rome, Italy, as pali of his duties with LCILP.411 The pmpose of the ti·ip was to meet officials affiliated with Link Campus University, a for-profit institution headed by a fo1mer Italian government official. 412 During the visit, Papadopoulos was inti·oduced to Joseph Mifsud. Mifsud is a Maltese national who worked as a professor at the London Academy of Diplom acy in London, England. 413 Although Mifsud worked out of London and was also affiliated with LCILP, the encounter in Rome was the first time that Papadopoulos met him.4 14 Mifsud maintained various Russian contacts while living in London, as described further below. Among his contacts was ,415 a one-time employee of the IRA, the entity that caITied out the Russian social media campaign (see Volume ! Section II, supra). In Janua1y and Febrnaiy 2016, Mifsud and discussed possibly meeting in Russia._ The (b)(7)(E)-2 investigation did not identi evidence of them meeting. Later, in the spring of 2016, was also in contact • • • that was linked to an employee of tne Russian Ministry of Defense, and that account had overlapping contacts with a group of Russian milita1y­ conu-olled Facebook accounts that included accounts used to promote the DCLeaks releases in the course of the GRU's hack-and-release operations (see Volume I, Section III.B .1, supra). 11919191 @fPJB! According to Papadopoulos, Mifsud at first seem ed uninterested in Papadopoulos when they met in Rom e. 416 After Papadopoulos info1med Mifsud about his role in the Trnmp Campaign, however, Mifsud appear ed to tak e greater interest in Papadopoulos. 417 The two discussed Mifsud 's European and Russian contacts and had a general discussion about Russia; Mifsud also offered to inu-oduce Papadopoulos to European leaders and oth ers with contacts to the Russian government. 4 18 Papadopoulos told the Office that Mifsud's claim of substantial connections with Russian government officials interested Papadopoulos, who thought that such connections could increase his importan ce as a policy advisor to the Trnmp Campaign. 4 19 411 Papadopoulos 8/ 10/ 17 302, at 2-3; Papadopoulos Statement of Offense ,i 5. 412 Papadopoulos 8/ 10/ 17 302, at 2-3; Stephanie Kirchgaessner et al. , Joseph Mifsud: more questions than answers about mystery professor linked to Russia, The Guardian (Oct. 31, 2017) ("Link Campus University ... is headed by a fo1mer Italian interior minister named Vincenzo Scotti."). (b)(3)-2, (b)(7)(E)-1 413 Papadopoulos Statement of Offense ,i 5. 414 Papadopoulos 8/ 10/ 17 302, at 3. (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) (b) (7)(A), (b) (7)(E) -- (b)(3)-2, (b)(7)(E)-1 , ! l(b) (7)(A), (b) (7)(E), (b) (b)(7)(A), (b)(7)(E), (b) (3) (b)(7)(E)-2 (b)(7)(E)-2 (3) (b) (7)(A), (b ) (7)(E ) (b)(7)(E)-2 416 Papadopoulos Statement of Offense ,i 5. 417 Papadopoulos Statement of Offense ,i 5. 418 Papadopoulos 8/ 10/ 17 302, at 3; Papadopoulos 8/ 11/ 17 302, at 2. 419 Papadopoulos Statement of Offense ,i 5. (b)(7)(E)-2 83 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) On March 17, 2016, Papadopoulos returned to London.420 Four days later, candidate Trump publicly named him as a member of the foreign policy and national security advisory team chaired by Senator Jeff Sessions, describing Papadopoulos as “an oil and energy consultant” and an “[e]xcellent guy.”421 On March 24, 2016, Papadopoulos met with Mifsud in London.422 Mifsud was accompanied by a Russian female named Olga Polonskaya. Mifsud introduced Polonskaya as a former student of his who had connections to Vladimir Putin.423 Papadopoulos understood at the time that Polonskaya may have been Putin’s niece but later learned that this was not true.424 During the meeting, Polonskaya offered to help Papadopoulos establish contacts in Russia and stated that the Russian ambassador in London was a friend of hers.425 Based on this interaction, Papadopoulos expected Mifsud and Polonskaya to introduce him to the Russian ambassador in London, but that did not occur.426 Following his meeting with Mifsud, Papadopoulos sent an email to members of the Trump Campaign’s foreign policy advisory team. The subject line of the message was “Meeting with Russian leadership--including Putin.”427 The message stated in pertinent part: I just finished a very productive lunch with a good friend of mine, Joseph Mifsud, the director of the London Academy of Diplomacy--who introduced me to both Putin’s niece and the Russian Ambassador in London--who also acts as the Deputy Foreign Minister.428 The topic of the lunch was to arrange a meeting between us and the Russian leadership to discuss U.S.-Russia ties under President Trump. They are keen to host us in a “neutral” city, or directly in Moscow. They said the leadership, including Putin, is ready to meet with us and Mr. Trump should there be interest. Waiting for everyone’s thoughts on moving forward with this very important issue.429 420 Papadopoulos 8/10/17 302, at 2. 421 Phillip Rucker & Robert Costa, Trump Questions Need for NATO, Outlines Noninterventionist Foreign Policy, Washington Post (Mar. 21, 2016). 422 Papadopoulos 8/10/17 302, at 3; 3/24/16 Text Messages, Mifsud & Papadopoulos. 423 Papadopoulos 8/10/17 302, at 3. 424 Papadopoulos 8/10/17 302, at 3; Papadopoulos 2/10/17 302, at 2-3; Papadopoulos Internet Search History (3/24/16) (revealing late-morning and early-afternoon searches on March 24, 2016 for “putin’s niece,” “olga putin,” and “russian president niece olga,” among other terms). 425 Papadopoulos 8/10/17 302, at 3. 426 Papadopoulos Statement of Offense ¶ 8 n.1. 427 3/24/16 Email, Papadopoulos to Page et al. (8:48:21 a.m.). 428 Papadopoulos’s statements to the Campaign were false. As noted above, the woman he met was not Putin’s niece, he had not met the Russian Ambassador in London, and the Ambassador did not also serve as Russia’s Deputy Foreign Minister. 429 3/24/16 Email, Papadopoulos to Page et al. (8:48:21 a.m.). 84 U.S. Depar tment of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed . R. Crim. P. 6(e) Papadopoulos ' s message came at a time when Clovis perceived a shift in the Campaign's approach toward Russia-from one of engaging with Russia throu h the NATO framework and takin a strnn stance on Russian a ression in Ukraine (b)(3)-1 Clovis 's response to Papadopoulos, however, did not reflect that shift. Replying to Papadopoulos and the other members of the foreign policy adviso1y team copied on the initial email, Clovis wrote: This is most infonnative. Let me work it through the campaign. No commitments until we see how this plays out. My thought is that we probably should not go fo1ward with any meetings with the Russians until we have had occasion to sit with our NATO allies, especially France, Gennany and Great Britain. We need to reassure our allies that we are not going to advan ce anything with Russia until we have eve1yone on the same page. More thoughts later today. Great work. 43 1 c. March 31 Foreign Policy Team Meeting The Campaign held a meeting of the foreign policy adviso1y team with Senator Sessions and candidate Tnnnp approximately one week later, on March 31 , 2016, in Washington, D.C. 432 The meeting- which was intended to generate press coverage for the Campaign433- took place at the Tnnnp International Hotel. 434 Papadopoulos flew to Washington for the event. At the meeting, Senator Sessions sat at one end of an oval table, while Tnnnp sat at the other. As reflected in the photograph below (which was posted to Tmmp's Instagram account), Papadopoulos sat between the two, two seats to Sessions's left: (b)(3)-1 430 (b) (3) 431 3/24/ 16 Email , Clovis to Papadopoulos et al. (8 :55:04 a.m.). 432 Papadopoulos 8/ 10/ 17 302, at 4 ; Papadopoulos 8/ 11/ 17 302, at 3. 433 Sessions 1/ 17118 302, at 16-17. 434 Papadopoulos 8/ 10/ 17 302, at 4. 85 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) March 31, 2016 Meeting of Foreign Policy Team, with Papadopoulos (Fourth from Right of Candidate Trump) During the meeting, each of the newly announced foreign policy advisors introduced themselves and briefly described their areas of experience or expertise.435 Papadopoulos spoke about his previous work in the energy sector and then brought up a potential meeting with Russian officials.436 Specifically, Papadopoulos told the group that he had learned through his contacts in London that Putin wanted to meet with candidate Trump and that these connections could help arrange that meeting.437 Trump and Sessions both reacted to Papadopoulos’s statement. Papadopoulos and Campaign advisor J.D. Gordon—who told investigators in an interview that he had a “crystal clear” recollection of the meeting—have stated that Trump was interested in and receptive to the idea of a meeting with Putin.438 Papadopoulos understood Sessions to be similarly supportive of his efforts to arrange a meeting.439 Gordon and two other attendees, however, recall that Sessions generally opposed the proposal, though they differ in their accounts of the concerns he voiced or the strength of the opposition he expressed.440 d. George Papadopoulos Learns That Russia Has “Dirt” in the Form of Clinton Emails Whatever Sessions’s precise words at the March 31 meeting, Papadopoulos did not understand Sessions or anyone else in the Trump Campaign to have directed that he refrain from 435 Papadopoulos 8/10/17 302, at 4. 436 Papadopoulos 8/10/17 302, at 4. 437 Papadopoulos Statement of Offense ¶ 9; see Gordon 8/29/17 302, at 14; Carafano 9/12/17 302, at 2; Hoskins 9/14/17 302, at 1. 438 Papadopoulos 8/10/17 302, at 4-5; Gordon 9/7/17 302, at 4-5. 439 Papadopoulos 8/10/17 302, at 5; Papadopoulos 8/11/17 302, at 3. 440 Sessions 1/17/18 302, at 17; Gordon 9/7/17 302, at 5; Hoskins 9/14/17 302, at 1; Carafano 9/12/17 302, at 2. 86 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) making further efforts to arrange a meeting between the Campaign and the Russian government. To the contrary, Papadopoulos told the Office that he understood the Campaign to be supportive of his efforts to arrange such a meeting.441 Accordingly, when he returned to London, Papadopoulos resumed those efforts.442 Throughout April 2016, Papadopoulos continued to correspond with, meet with, and seek Russia contacts through Mifsud and, at times, Polonskaya.443 For example, within a week of her initial March 24 meeting with him, Polonskaya attempted to send Papadopoulos a text message— which email exchanges show to have been drafted or edited by Mifsud—addressing Papadopoulos’s “wish to engage with the Russian Federation.”444 When Papadopoulos learned from Mifsud that Polonskaya had tried to message him, he sent her an email seeking another meeting.445 Polonskaya responded the next day that she was “back in St. Petersburg” but “would be very pleased to support [Papadopoulos’s] initiatives between our two countries” and “to meet [him] again.”446 Papadopoulos stated in reply that he thought “a good step” would be to introduce him to “the Russian Ambassador in London,” and that he would like to talk to the ambassador, “or anyone else you recommend, about a potential foreign policy trip to Russia.”447 Mifsud, who had been copied on the email exchanges, replied on the morning of April 11, 2016. He wrote, “This is already been agreed. I am flying to Moscow on the 18th for a Valdai meeting, plus other meetings at the Duma. We will talk tomorrow.”448 The two bodies referenced by Mifsud are part of or associated with the Russian government: the Duma is a Russian legislative assembly,449 while “Valdai” refers to the Valdai Discussion Club, a Moscow-based group that “is close to Russia’s foreign-policy establishment.”450 Papadopoulos thanked Mifsud and said that he would see him “tomorrow.”451 For her part, Polonskaya responded that she had “already alerted my personal links to our conversation and your request,” that “we are all very excited the possibility of a good relationship with Mr. Trump,” and that “[t]he Russian Federation would love to welcome him once his candidature would be officially announced.”452 441 Papadopoulos 8/10/17 302, at 4-5; Papadopoulos 8/11/17 302, at 3; Papadopoulos 9/20/17 302, 442 Papadopoulos Statement of Offense ¶ 10. 443 Papadopoulos Statement of Offense ¶¶ 10-15. 444 3/29/16 Emails, Mifsud to Polonskaya (3:39 a.m. and 5:36 a.m.). 445 4/10/16 Email, Papadopoulos to Polonskaya (2:45:59 p.m.). 446 4/11/16 Email, Polonskaya to Papadopoulos (3:11:24 a.m.). 447 4/11/16 Email, Papadopoulos to Polonskaya (9:21:56 a.m.). 448 4/11/16 Email, Mifsud to Papadopoulos (11:43:53). 449 Papadopoulos Statement of Offense ¶ 10(c). at 2. 450 Anton Troianovski, Putin Ally Warns of Arms Race as Russia Considers Response to U.S. Nuclear Stance, Washington Post (Feb. 10, 2018). 451 4/11/16 Email, Papadopoulos to Mifsud (11:51:53 a.m.). 452 4/12/16 Email, Polonskaya to Papadopoulos (4:47:06 a.m.). 87 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Papadopoulos’s and Mifsud’s mentions of seeing each other “tomorrow” referenced a meeting that the two had scheduled for the next morning, April 12, 2016, at the Andaz Hotel in London. Papadopoulos acknowledged the meeting during interviews with the Office,453 and records from Papadopoulos’s UK cellphone and his internet-search history all indicate that the meeting took place.454 Following the meeting, Mifsud traveled as planned to Moscow.455 On April 18, 2016, while in Russia, Mifsud introduced Papadopoulos over email to Ivan Timofeev, a member of the Russian International Affairs Council (RIAC).456 Mifsud had described Timofeev as having connections with the Russian Ministry of Foreign Affairs (MFA),457 the executive entity in Russia responsible for Russian foreign relations.458 Over the next several weeks, Papadopoulos and Timofeev had multiple conversations over Skype and email about setting “the groundwork” for a “potential” meeting between the Campaign and Russian government officials.459 Papadopoulos told the Office that, on one Skype call, he believed that his conversation with Timofeev was being monitored or supervised by an unknown third party, because Timofeev spoke in an official manner and Papadopoulos heard odd noises on the line.460 Timofeev also told Papadopoulos in an April 25, 2016 email that he had just spoken “to Igor Ivanov[,] the President of RIAC and former Foreign Minister of Russia,” and conveyed Ivanov’s advice about how best to arrange a “Moscow visit.”461 After a stop in Rome, Mifsud returned to England on April 25, 2016.462 The next day, Papadopoulos met Mifsud for breakfast at the Andaz Hotel (the same location as their last 453 Papadopoulos 9/19/17 302, at 7. 454 4/12/16 Email, Mifsud to Papadopoulos (5:44:39 a.m.) (forwarding Libya-related document); 4/12/16 Email, Mifsud to Papadopoulos & Obaid (10:28:20 a.m.); Papadopoulos Internet Search History (Apr. 11, 2016 10:56:49 p.m.) (search for “andaz hotel liverpool street”); 4/12/16 Text Messages, Mifsud & Papadopoulos. 455 See, e.g., 4/18/16 Email, Mifsud to Papadopoulos (8:04:54 a.m.). 456 Papadopoulos 8/10/17 302, at 5. 457 Papadopoulos Statement of Offense ¶ 11. 458 During the campaign period, Papadopoulos connected over LinkedIn with several MFAaffiliated individuals in addition to Timofeev. On April 25, 2016, he connected with Dmitry Andreyko, publicly identified as a First Secretary at the Russian Embassy in Ireland. In July 2016, he connected with Yuriy Melnik, the spokesperson for the Russian Embassy in Washington and with Alexey Krasilnikov, publicly identified as a counselor with the MFA. And on September 16, 2016, he connected with Sergei Nalobin, also identified as an MFA official. See Papadopoulos LinkedIn Connections (b) (7)(A), (b) (7)(E) (b)(7)(E)-2 459 Papadopoulos Statement of Offense ¶ 11. 460 Papadopoulos 8/10/17 302, at 5; Papadopoulos 9/19/17 302, at 10. 461 4/25/16 Email, Timofeev to Papadopoulos (8:16:35 a.m.). 462 4/22/16 Email, Mifsud to Papadopoulos (12:41:01 a.m.). 88 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) meeting).463 During that meeting, Mifsud told Papadopoulos that he had met with high-level Russian government officials during his recent trip to Moscow. Mifsud also said that, on the trip, he learned that the Russians had obtained “dirt” on candidate Hillary Clinton. As Papadopoulos later stated to the FBI, Mifsud said that the “dirt” was in the form of “emails of Clinton,” and that they “have thousands of emails.”464 On May 6, 2016, 10 days after that meeting with Mifsud, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information that would be damaging to Hillary Clinton.465 e. Russia-Related Communications With The Campaign While he was discussing with his foreign contacts a potential meeting of campaign officials with Russian government officials, Papadopoulos kept campaign officials apprised of his efforts. On April 25, 2016, the day before Mifsud told Papadopoulos about the emails, Papadopoulos wrote to senior policy advisor Stephen Miller that “[t]he Russian government has an open invitation by Putin for Mr. Trump to meet him when he is ready,” and that “[t]he advantage of being in London is that these governments tend to speak a bit more openly in ‘neutral’ cities.”466 On April 27, 2016, after his meeting with Mifsud, Papadopoulos wrote a second message to Miller stating that “some interesting messages [were] coming in from Moscow about a trip when the time is right.”467 The same day, Papadopoulos sent a similar email to campaign manager Corey Lewandowski, telling Lewandowski that Papadopoulos had “been receiving a lot of calls over the last month about Putin wanting to host [Trump] and the team when the time is right.”468 Papadopoulos’s Russia-related communications with Campaign officials continued throughout the spring and summer of 2016. On May 4, 2016, he forwarded to Lewandowski an email from Timofeev raising the possibility of a meeting in Moscow, asking Lewandowski whether that was “something we want to move forward with.”469 The next day, Papadopoulos forwarded the same Timofeev email to Sam Clovis, adding to the top of the email “Russia update.”470 He included the same email in a May 21, 2016 message to senior Campaign official Paul Manafort, under the subject line “Request from Russia to meet Mr. Trump,” stating that “Russia has been eager to meet Mr. Trump for quite sometime and have been reaching out to me 463 Papadopoulos Statement of Offense ¶ 14; 4/25/16 Text Messages, Mifsud & Papadopoulos. 464 Papadopoulos Statement of Offense ¶ 14. 465 This information is contained in the FBI case-opening document and related materials. The information is law-enforcement sensitive (LES) and must be treated accordingly in any external dissemination. The foreign government conveyed this information to the U.S. government on July 26, 2016, a few days after WikiLeaks’s release of Clinton-related emails. The FBI opened its investigation of potential coordination between Russia and the Trump Campaign a few days later based on the information. 466 4/25/16 Email, Papadopoulos to S. Miller (8:12:44 p.m.). 467 4/27/16 Email, Papadopoulos to S. Miller (6:55:58 p.m.). 468 4/27/16 Email, Papadopoulos to Lewandowski (7:15:14 p.m.). 469 5/4/16 Email, Papadopoulos to Lewandowski (8:14:49 a.m.). 470 5/5/16 Email, Papadopoulos to Clovis (7:15:21 p.m.). 89 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) to discuss.”471 Manafort forwarded the message to another Campaign official, without including Papadopoulos, and stated: “Let[’]s discuss. We need someone to communicate that [Trump] is not doing these trips. It should be someone low level in the Campaign so as not to send any signal.”472 On June 1, 2016, Papadopoulos replied to an earlier email chain with Lewandowski about a Russia visit, asking if Lewandowski “want[ed] to have a call about this topic” and whether “we were following up with it.”473 After Lewandowski told Papadopoulos to “connect with” Clovis because he was “running point,” Papadopoulos emailed Clovis that “the Russian MFA” was asking him “if Mr. Trump is interested in visiting Russia at some point.”474 Papadopoulos wrote in an email that he “[w]anted to pass this info along to you for you to decide what’s best to do with it and what message I should send (or to ignore).”475 After several email and Skype exchanges with Timofeev,476 Papadopoulos sent one more email to Lewandowski on June 19, 2016, Lewandowski’s last day as campaign manager.477 The email stated that “[t]he Russian ministry of foreign affairs” had contacted him and asked whether, if Mr. Trump could not travel to Russia, a campaign representative such as Papadopoulos could attend meetings.478 Papadopoulos told Lewandowski that he was “willing to make the trip off the record if it’s in the interest of Mr. Trump and the campaign to meet specific people.”479 Following Lewandowski’s departure from the Campaign, Papadopoulos communicated with Clovis and Walid Phares, another member of the foreign policy advisory team, about an offthe-record meeting between the Campaign and Russian government officials or with Papadopoulos’s other Russia connections, Mifsud and Timofeev.480 Papadopoulos also interacted 471 5/21/16 Email, Papadopoulos to Manafort (2:30:14 p.m.). 472 Papadopoulos Statement of Offense ¶ 19 n.2. 473 6/1/16 Email, Papadopoulos to Lewandowski (3:08:18 p.m.). 474 6/1/16 Email, Lewandowski to Papadopoulos (3:20:03 p.m.); 6/1/16 Email, Papadopoulos to Clovis (3:29:14 p.m.). 475 6/1/16 Email, Papadopoulos to Clovis (3:29:14 p.m.). Papadopoulos’s email coincided in time with another message to Clovis suggesting a Trump-Putin meeting. First, on May 15, 2016, David Klein— a distant relative of then-Trump Organization lawyer Jason Greenblatt—emailed Clovis about a potential Campaign meeting with Berel Lazar, the Chief Rabbi of Russia. The email stated that Klein had contacted Lazar in February about a possible Trump-Putin meeting and that Lazar was “a very close confidante of Putin.” DJTFP00011547 (5/15/16 Email, Klein to Clovis (5:45:24 p.m.)). The investigation did not find evidence that Clovis responded to Klein’s email or that any further contacts of significance came out of Klein’s subsequent meeting with Greenblatt and Rabbi Lazar at Trump Tower. Klein 8/30/18 302, at 2. 476 Papadopoulos Statement of Offense ¶ 21(a). 477 (b) (3) 478 6/19/16 Email, Papadopoulos to Lewandowski (1:11:11 p.m.). 479 6/19/16 Email, Papadopoulos to Lewandowski (1:11:11 p.m.). (b)(3)-1 480 Papadopoulos Statement of Offense ¶ 21; 7/14/16 Email, Papadopoulos to Timofeev (11:57:24 p.m.); 7/15/16 Email, Papadopoulos to Mifsud; 7/27/16 Email, Papadopoulos to Mifsud (2:14:18 p.m.). 90 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) directly with Clovis and Phares in connection with the summit of the Transatlantic Parliamentary Group on Counterterrorism (TAG), a group for which Phares was co-secretary general.481 On July 16, 2016, Papadopoulos attended the TAG summit in Washington, D.C., where he sat next to Clovis (as reflected in the photograph below).482 George Papadopoulos (far right) and Sam Clovis (second from right) Although Clovis claimed to have no recollection of attending the TAG summit,483 Papadopoulos remembered discussing Russia and a foreign policy trip with Clovis and Phares during the event.484 Papadopoulos’s recollection is consistent with emails sent before and after the TAG summit. The pre-summit messages included a July 11, 2016 email in which Phares suggested meeting Papadopoulos the day after the summit to chat,485 and a July 12 message in the same chain in which Phares advised Papadopoulos that other summit attendees “are very nervous about Russia. So be aware.”486 Ten days after the summit, Papadopoulos sent an email to Mifsud listing Phares and Clovis as other “participants” in a potential meeting at the London Academy of Diplomacy.487 Finally, Papadopoulos’s recollection is also consistent with handwritten notes from a 481 Papadopoulos 9/19/17 302, at 16-17; 9th TAG Summit in Washington DC, Transatlantic Parliament Group on Counter Terrorism. 482 9th TAG Summit in Washington DC, Transatlantic Parliament Group on Counter Terrorism. 483 (b) (3) 484 Papadopoulos 9/19/17 302, at 16-17. 485 7/11/16 Email, Phares to Papadopoulos. 486 7/12/16 Email, Phares to Papadopoulos (14:52:29). 487 7/27/16 Email, Papadopoulos to Mifsud (14:14:18). (b)(3)-1 91 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) jomnal that he kept at the time. 488 Those notes, which are reprinted in part below, appear to refer to potential September 2016 meetings in London with representatives of the "office of Putin," and suggest that Phares, Clovis, and Papadopoulos ("Walid/Sam me") would attend without the official backing of the Campaign ("no official letter/no message from Tnunp").489 September: Have an explorato1y meeting te or lose. In September - if allowed they will blast Mr. T1ump. We want the meeting in London/England Walid/Sam me 7ef¥--1~ ~ ~ ,t{ ~ -#f(- h /kefkAW- , . , T{- ,-. >~ A,-. {t'7 • 6l•"f/- ,#r. 1rvv•{ l.<..:f/ ~ t..,-j,.. ( V\. No official letter/no message fromTmmp f'N<~ t1.({.;r,~1 ht; They are talking to us. k ~Jc-/ ~ J 1=t (,,r__,,_/ f'\\1( 4~ w.,.c:» I Set~ ~ l-er!.,v / ~ 11 1 ~'' -It is a lot of dsk. -Office of Putin. -Explore: we are a campaign. off Israel! EGYPT Willingness to meet the FM sp with Walid/Sam -FM coming -Useful to have a session with him. Later communications indicate that Clovis dete1mined that he (Clovis) could not travel. On August 15, 2016, Papadopoulos emailed Clovis that he had received requests from multiple foreign governments, "even Russia[] ," for "closed door workshops/consultations abroad," and asked whether there was still interest for Clovis, Phares, and Papadopoulos "to go on that trip."490 Clovis copied Phares on his response, which said that he could not "travel before the election" but that he "would encomage [Papadopoulos] and Walid to make the trips, if it is feasible. " 491 488 Papadopoulos 9/20/ 17 302, at 3. 489 Papadopoulos declined to assist in deciphering his notes, telling investigators that he could not read his own handw1iting from the journal. Papadopoulos 9/ 19/ 17 302, at 21. The notes, however, appear to read as listed in the column to the left of the image above. 490 8/ 15/ 16 Email, Papadopoulos to Clovis (11:59: 07 a.m.). 491 8/ 15/ 16 Email, Clovis to Papadopoulos (12 :01 :45 p.m.). 92 U.S. Department of Justice ______________________________________________________ Attorney Work Product // May Contain Material Protected Under Fed. R. Crim. P. 6(e) Papadopoulos was dismissed from the Tmmp Campaign in early October 2016, after an interview he gave to the Russian news agency Inte1fax generated adverse publicity.492 f. Trump Campaign Knowledge of "Dirt" Papadopoulos admitted telling at least one individual outside of the Campaign­ specifically, the then-Greek foreign minister-about Russia's obtaining Clinton-related emails. 493 In addition, a different foreign government infonned the FBI that, 10 days after meeting with Mifsud in late April 2016, Papadopoulos suggested that the Tnnnp Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of info1mation that would be damaging to Hillaiy Clinton .494 (This conversation occmTed after the GRU speai-phished Clinton Campaign chaiiman John Podesta and stole his emails, and the GRU hacked into the DCCC and DNC, see Volume I, Sections III.A & III.B, supra.) Such disclosmes raised questions about whether Papadopoulos info1med any Tnnnp Campaign official about the emails. When interviewed, Papadopoulos and the Campaign officials who interacted with him told the Office that they could not recall Papadopoulos' s sharing the info1mation that Russia had obtained "dni" on candidate Clinton in the fo1m of emails or that Russia could assist the Campaign through the anonymous release of info1mation about Clinton. Papadopoulos stated that he could not clearly recall having told anyone on the Campaign and wavered about whether he accmately remembered an incident in which Clovis had been upset after hearing Papadopoulos tell Clovis that Papadopoulos thought "they have her emails."495 The Campaign officials who interacted or con esponded with Papadopoulos have similarly stated, with vaiying degrees of ce1iainty, that he did not tell them. Senior policy advisor Stephen Miller, for example, did not remember hearing anything from Papadopoulos or Clovis about Russia having emails of or di1i on candidate Clinton. 496 Clovis stated that he did not recall anyone, including Papadopoulos, having given him non-public information that a forei n overnment mi ht be in ossession of material