Professional Documents
Culture Documents
Roger Stone Search Warrants - Compressed
Roger Stone Search Warrants - Compressed
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 21, 2017 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, D.C. Hon. Beryl A. HoweJL,,-Chief U.S. District Judge
· Printed name and title
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 2 of 21
ATTACHMENT A
Property to Be Searched
This warrant applies to information associated with the Twitter profile with usemarnes:
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the
a. All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
b. All past and current usernames, account passwords, and names associated with
the account;
c. The dates and times at which the account and profile were created, and the
d. All IP logs and other documents showing the IP address, date, and time of each
e. All data and information associated with the profile page, including photographs,
f. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 4 of 21
g. All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account
h. All photographs and images in the user gallery for the account;
1. All location data associated with the account, including all information collected
J. All information about the account's use of Twitter's link service, including all
longer website links that were shortened by the service, all resulting shortened
links, and all information about the number of times that a link posted by the
k. All data and information that has been deleted by the user;
I. A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user's "following" list and "followers" list);
q. All records of Twitter searches performed by the account, including all past
r. All information about connections between the account and third-party websites
and applications;
2
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 5 of 21
regarding the user or the user's Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.
3
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 6 of 21
All information described above in Section I that constitutes fruits, evidence, and
with computers) involving since March 1, 2016 including, for each user ID identified on
d. Evidence indicating how and when the Twitter account was accessed or used,
and events relating to the crime under investigation and to the Twitter account
owner;
f. The identity of the person(s) who created or used the user ID, including
g. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.
4
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 7 of 21
AO 106 (Rev. 04/10) Application fora Search Warrant
See Attachment A.
located in the - - -
Northern
- - - - - District of - - - - -
California
- - - - - - - , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
(y{ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers
Date: 08/07/2017
Judge's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 8 of 21
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Mickey Robinson, being first duly sworn, hereby depose and state as follows:
1") and (hereafter "Target Account 2") and that is stored at premises owned,
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(1 )(A).
FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2012. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
federal financial crimes. I have conducted and participated in various investigations involving
multiple threat countries as well as national security threats and applicable criminal violations.
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 9 of 21
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that certain individuals with whom Target Account 1 was in
communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in
connection with computers), and that communications related to these violations will be found
on the Target Accounts. There is therefore probable cause to search the information described
in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as
described in Attachment B.
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
Disseminate Hacked Information.
United States Intelligence Community, the Russian military intelligence (General Staff Main
2
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 10 of 21
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
7. The public and unclassified intelligence report assessed that the GRU used a
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
10. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
3
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 11 of 21
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from
the DNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
4
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 12 of 21
Account 1] thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released
the personal cellphone numbers and email addresses from the files of the Democratic
15. On August 13, 2016, Stone posted a tweet using Target Account 1 calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
16. On August 14, 2016, Stone sent a private message on Twitter using Target
Account 1 to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle reinstated
17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating:
"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
18. On August 16, 2016, Stone sent a private message using Target Account 1
asking Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016
presidential elections.
Account 1] paying you back." Guccifer also sent a private message to Target Account 1 stating
"i 'm pleased to say u r great man. please tell me if I can help u anyhow. it would be a great
pleasure to me."
1
These messages were release by Stone on March I 0, 2017, as described further below in paragraph 28.
5
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 13 of 21
20. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
21. On August 21, 2016, using Target Account 1, Stone directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
6
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 14 of 21
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of Wikileaks' 1O,..year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
27. Wikileaks continued to release John Podesta's hacked emails throughout October
10-14, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 C-
SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
7
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 15 of 21
28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged
he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.
29. On or about May 12, 2017, United States Magistrate Judge Michael S.
Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b)
requiring Twitter to disclose certain records, including subscriber and user activity information,
associated with the Target Accounts described above (Case number 17-GJ-0835). On or about
May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts
30. As described above, it appears that Stone has used the private messaging function
of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience
that individuals with multiple accounts on the same service, such as Stone has on Twitter, often
use both accounts for their communications. A review of Target Account 2's publicly available
information indicates that it has been in use since November 2015. Stone also appears to
comment using Target Account 2 frequently. Stone also often publicly "Retweets" messages
using Target Account 2 which originated from Target Account 1. Therefore there is probable
cause to believe that messages pertaining to the investigation, including messages to individuals
regarding the hack, as well as communications with Guccifer 2.0, will be found on Target
8
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 16 of 21
31. Twitter owns and operates a free-access social-networking website of the same
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
32. Upon creating a Twitter account, a Twitter user must create a unique Twitter
username and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.
33. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
34. A Twitter user can post a personal photograph or image (also known as an
"avatar") to his or her profile, and can also change the profile background or theme for his or her
account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.
9
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 17 of 21
35. Twitter also keeps IP logs for each user. These logs contain information about the
· user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
36. As discussed above, Twitter users can use their Twitter accounts to post "Tweets"
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. TwiUer users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
37. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that the user has shared on Twitter,
38. Twitter users can also opt to include location data in their Tweets, which will
reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
39. When Twitter users want to post a Tweet that includes a link to a website, they
can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
40. A Twitter user can "follow" other Twitter users, which means subscribing to
those users' Tweets and site updates. Each user profile page includes a list of the people who are
10
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 18 of 21
following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
41. In addition to posting Tweets, a Twitter user can also send DMs to one of his or
her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the inboxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
42. Twitter users can configure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
43. Twitter includes a search function that enables its users to search all public
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
11
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 19 of 21
44. Twitter users can connect their Twitter accounts to third-party websites and
applications, which may grant these websites and applications access to the users' public Twitter
profiles.
45. If a Twitter user does not want to interact with another user on Twitter, the first
user can "block" the second user from following his or her account.
46. In some cases, Twitter users may communicate directly with Twitter about issues
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, a:s well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
47. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the "who, what, why, when; where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
"tweets" (status updates) and "tweeted"photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
12
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 20 of 21
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
48. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information.
49. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
13
Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 21 of 21
CONCLUSION
50. Based on the forgoing, I request that the Court issue the proposed search warrant.
51. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
52. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
Special Agent
Federal Bureau of Investigation
-z-~
Subscribed and sworn to before me on this _1_ day of August, 2017.
Th~i11:t~
Chief United States District Judge
14
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 1 of 23
See Attachment A.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before September 25, 2017 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon . Beryl A. Howell , Chief U.S. District Judge
- -- -- - -- -- -- - -
Printed name and title
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 2 of 23
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 3 of 23
AO 106 (Rev. 04/ 10) Application for a Search Warrant
See Attachment A
District of
located in the
- - -Northern
-----
person or describe the property to be seized):
- - - - -California
- - - - - - - , there is now concealed (identify the
See Attachment B
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a) , 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 4 l (c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed fo r use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
IAaron Zelinsky {AS9 Amy Anderson , Special Agent. FBI
Printed name and title
City and state: Washington, D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 4 of 23
Case No.
INFORMATION AS SOCIATED WITH THE
EMAIL ACCOUNT
Filed Under Seal
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
Corp. , d/b/a Hotmail, an email provider headquartered at One Microsoft Way, Redmond, WA
the Government is described in the following paragraphs and in Attachments A and B. This
affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a),
FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.
I have conducted and participated in various investigations involving multiple threat countries as
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers) and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States). As set forth below,
Roger Stone used Twitter' s private direct messaging function to message Wikileaks, Julian
Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to disseminate hacked
information. Stone also repeatedly used Twitter' s private direct messaging function to instruct
individuals to email him on the Target Account to continue conversations begun on Twitter' s
private direct messaging system. These conversations included discussion of information related
to the Campaign and potential derogatory information concerning a presidential candidate in the
Republican primary. There is therefore probable cause to search the information described in
Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described
in Attachment B.
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
2
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 6 of 23
§ 27 11(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
Disseminate Hacked Information.
United States Intelligence Community, the Russian military intelligence (General Staff Main
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
7. The public and unclassified intelligence report assessed that the GRU used a
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLe~ to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and Wikileaks.
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 20 15. Although Stone had no
3
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 7 of 23
official relationship with the Campaign thereafter, Stone maintained his suppo1i for Trump and
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
10. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from
theDNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: " It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
4
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 8 of 23
October surprise, what would be your forecast on that given what Julian Assange has intimated
he ' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
14. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
15. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0' s
16. On August 14, 2016, Stone sent a private message on Twitter using
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle
17. On August 15, 20 16, Guccifer 2.0 replied to Stone on Target Account 1, stating:
"wow. thank u for writing back, and thank u for an article about me! !! did you find anything
1 These messages were released by Stone on March 10, 2017, as described further below in paragraph 28.
5
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 9 of 23
18. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.
19. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
20. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
21. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange] ,
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
6
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 10 of 23
22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of Wikileaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
27. Wikileaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 20 16, John Podesta-referring back to Stone's August 21 , 2016 C-
SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there' s at least a reasonable belief that [Assange] may have passed this information on to
7
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 11 of 23
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who' s traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Hurna ALeJiu auJ Cheryl Mill:s, the Clinton ai<le:s, thought wtm::
28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.
29. , On March 27, 2017, CNN reported that a representative of Wikileaks, writing
from an email address associated with Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
C. Roger Stone's Private Twitter Direct Messages with Wikileaks and Julian Assange.
30. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr. While the full review of that returned information is ongoing,
the initial review indicates that, contrary to Stone' s representation to CNN that he "never
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
8
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 12 of 23
Wikileaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
31. For example, on October 13, 2016, while Wikileaks was in the midst of releasing
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@Wikileaks. This account is the official Twitter account of Wikileaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending wikileaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
32. Less than an hour later, @Wikileaks responded by direct message: "We
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
34. On November 9, 2016, one day after the presidential election, @Wikileaks sent a
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
35. In addition, @RogerJStoneJr has also recently exchanged direct messages with
Julian Assange, the founder of Wikileaks. For example, on June 4, 2017, @RogerJStoneJr
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
9
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 13 of 23
information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumped-
up sexual assault charges dropped I don't know of any crimt:: you nt::t::c.l lo be pardoned for - best
regards. R." That same day, @J ulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
@Wikileaks, reading: "I am doing everything possible to address the-issues at the highest level
of Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this
37. Using the direct messaging function associated with the account @RogerJStoneJr,
Stone sent direct messages to individuals instructing them to email the Target Account to
continue conversations began via Twitter direct message. For example, on August 8, 2015, an
individual sent @RogerJStoneJr a direct message asking ifhe had "a few minutes this afternoon
to talk about all of today' s drama with Trump." Stone responded the next day: "Sorry I missed
reading: "Just got some stuff from the campaign you may want to respond to." That same day,
10
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 14 of 23
arrange an interview. @RogerJStoneJr replied, "Okay - what do you need from me." The
individual replied, " Your email address. Twitter too public." Stone replied with the Target
Account.
@RogerJStoneJr containing a " White Paper," regarding the "Most likely questions to be asked of
41 . On February 17, 2016, an individual sent a direct message to Stone reading: "Mr.
Stone I have a delightful story about one foul tempered governor currently pretending to be Ned
Flanders up on the stage. Interested?" @RogerJStoneJr responded on Friday, February 19, 2016:
@RogerJStoneJr reading: " Im trying to get a list of upcoming Trump events so I can Fly out and .
Film these Anti-Trump protesters. To show the American people that these are the people that
are actually creating the Chaos. No one is showing whats really going on outside at these events
honestly and quite frankly its pissing me off." The next day, @RogerJStoneJr responded: "Email
me at [Target Account]."
43. On April 30, 2016, an individual sent a private direct message to @RogerJStoneJr
stating: "Give me a shout if you need a story moved. My followers are RTing fiends! lol."
@RogerJStoneJr asking for a "contact info so I can stay in touch in a more appropriate way than
11
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 15 of 23
45. In my training and experience, I have learned that Microsoft provides a variety of
on-line services, including electronic mail ("email") access, to the public. Microsoft allows
subscribers to obtain email accounts at the domain name Hotmail.com, like the email account
listed in Attachment A. Subscribers obtain an account by registering with Hotmail. During the
registration process, Hotmail asks subscribers to provide basic personal information. Therefore,
the computers of Microsoft are likely to contain stored electronic communications (including
retrieved and unretrieved email for Hotmail subscribers and information concerning subscribers
and their use of Hotmail services, such as account access information, email transaction
information may constitute evidence of the crimes under investigation because the information
46. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my- training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account' s user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
12
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 16 of 23
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
· (including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage
of the account. In addition, email providers often have records of the Internet Protocol address
(" IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access
48. In my training and experience, in some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
49. This application seeks a warrant to search all responsive records and information
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
communications and any records or other information pertaining to the customers or subscribers
13
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 17 of 23
control, regardless of whether such communication, record, or other information is stored, held,
may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience,
the information stored in connection with an email account can indicate who has used or
controlled the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the Internet Protocol
(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
'
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
14
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 18 of 23
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Hotmail to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
the items described in Section II of Attachment B. The items identified in Attachments A and B
will also be screened by reviewers not on the prosecution team to identify andilter out privileged
material.
CONCLUSION
52. Roger Stone used the @ RogerJStoneJr to communicate directly with Wikileaks
during the campaign, even though he publicly claimed to have "never" communicated with
Wikileaks. He also sent private messages to Julian Assange and Guccifer 2.0, the entity which
claimed responsibility for the DNC hack. Using @RogerJStoneJr, Stone has repeatedly
the Campaign, on the Target Account. There is therefore probable cause to believe that
evidence of the DNC hack and the hacking of other emails associated with the 2016 election will
53. Based on the forgoing, I request that the Court issue the proposed search warrant.
15
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 19 of 23
54. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
55. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~f~e
~so~
Special Agent
Federal Bureau of Investigation
~d!f/k-d/
The Honorable Beryl A. Howell
Chief United States District Judge
16
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 20 of 23
ATTACHMENT A
Property to Be Searched
17
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 21 of 23
ATTACHMENT B
2
Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 23 of 23
(c) Evidence indicating how and when the account was accessed or used, to
determine the geographic and chronological context of account access, use, and
events relating to the crimes under investigation and. to the account owner;
(d) Evidence indicating the account owner' s state of mind as it relates to the crimes
under investigation;
(e) The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s).
(f) The identity of any person(s)- including records that help reveal the person(s)'
whereabouts-who communicated with the account about any matters relating to
activities conducted by Roger Stone on behalf of, for the benefit of, any
individual associated with hacks of the DNC or individual email addresses
associated with the Clinton Campaign.
3
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 1 of 25
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 2 of 25
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google account:
that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
17
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 3 of 25
ATTACHMENT B
I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;
c. All internet search data including all queries and location data;
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l. Google Talk and Google Hangouts conversation logs associated with the
account.
19
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 5 of 25
06 (Rev. 04/10) Application for a Search Warrant
See Attachment A.
located in the - - -Northern
- ---- District of California
------=-='-=--'=- - - - , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B.
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1 )(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Date: 10/17/2017
Judge's s ignature
City and state: Washington , D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 6 of 25
FILED
OCT 17 2017
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia
FOR THE DISTRICT OF rnr f Th1fRT /:;.
Case: 1:17-mj-00760
IN THE MATIER OF THE SEARCH OF
Assigned To : Howell, Beryl A
INFORMATION ASSOCIATED WITH
Assign. Date : 10/1 7/2017
Description: Search and Seizure Warrant
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy Anderson, being first duly sworn, hereby depose and state as follows :
Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043 .
The information to be disclosed by Google and searched by the government is described in the
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.
I have conducted and participated in various investigations involving multiple threat countries as
3. The facts in this affidavit come from ~y personal observations; my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 7 of 25
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there.is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with co.mputers), 18
U.S.C. § 2 (aiding and abetting), and 18 U.S.C. § 371 (conspiracy to commit an offense against
5. As set forth below, Roger STONE communicated directly via Twitter with
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used _by Russian intelligence to
disseminate hacked information. STONE, using his Account, also emailed instructions
to Jerome CORSI to " Get to Assange" in person at the Ecuadorian Embassy and "get pending
WikiLeaks emails[.]" CORSI emailed STONE back on his Account that it was "Time
to let more than Podesta to be exposed" (before any of Podesta' s were leaked). After Podesta's
emails were leaked, CORSI emailed STONE "talking points" about Podesta to the Target
Account. CORSI also emailed the Target Account to convey information "from a very trusted
source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. In addition,
STONE used the Target Account to continue conversations via email that he began on Twitter
and forwarded emails, including at least one related to WikiLeaks, from his account to
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
2
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 8 of 25
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 7.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
Disseminate Hacked Information.
United States Intelligence Community, the Russian military intelligence (General Staff Main
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003 .
8. The public and unclassified intelligence report assessed that the GRU used a
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
3
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 9 of 25
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
11. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
12. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote_: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets froni Guccifer 2.0 in the article and
wrote: "Here' s Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
Organizat_ion. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
4
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 10 of 25
October surprise, what would be your forecast on that given what Julian Assange has intimated
he' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling wha~ the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
15. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
16. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
17. On August 14, 2016, Stone sent a private message on Twitter using
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user' s Twitter handle
18. On August 15, 2016, Guccifer 2.0 replied to Stone at@RogerJStoneJr, stating:
"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
1 · ~~MA
These messages were released by Stone on March I 0, 2017, as described further below in paragraph 28-:
5
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 11 of 25
19. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the ' rigg[ing]' of the 2016 presidential
elections.
20. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
21. On August 18, 2016, Paul Manafort, Stone' s longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
22. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John
Podesta, Hillary Clinton' s presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a " ' mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
23. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
6
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 12 of 25
25. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
26. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
27. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta' s personal email account.
28. WikiLeaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 2016, John Podesta - referring back to Stone' s August 21 , 2016 C-
SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there' s at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: " I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
7
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 13 of 25
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
29. On March 10, 2017, Stone spoke with The Washington Times and acknowledged
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.
30. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
C. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
31. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
WikiLeaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
32. For example, on October 13, 2016, while WikiLeaks was in the midst ofreleasing
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
8
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 14 of 25
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
33. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
34. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!
The more you \"correct\" me the more people think you're lying. Your operation leaks like a
35. On November 9, 2016, one day after the presidential election, @wikileaks sent a
followed up with another message less than a minute later: "We are now more free to
communicate."
36. In addition, @RogerJStoneJr has also recently exchanged direct messages with
Julian Assange, the founder of WikiLeaks. For example, on June 4, 20 17, @RogerJStoneJr
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumped-
9
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 15 of 25
up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best
regards. R." That same day, @JulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
@wikileaks, reading: " I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
D. Roger Stone's Emails Regarding WikiLeaks, Julian Assange, Russia, and John
Podesta
38. On September 11 , 2017, Chief Judge Beryl A. Howell of the District of Columbia
Account"). Emails recovered pursuant to that search warrant indicated the following:
39. On July 25, 20 16, STONE sent an email from his Account to JEROME
CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
tweeted about "Podesta's time in the barrel"), CORSI emailed the Account, " Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much
10
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 16 of 25
of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to Julian ASSANGE, the founder ofWikiLeaks, who resided
41. On or about August 16, 2016, CORSI emailed the Target Account link to a piece
CORSI had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to
Derail Hillary."
42. On or about August 31 , 2016, CORSI emailed the Account: "Did you get
Account to the Target Account with the subject line "Comment on WikiLeaks?" The email,
from a reporter, asked STONE for any comment on the "lack of an 'October surprise' release
45. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.
46. On or about October 12, 2016, the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
Target Account and the Account, with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that, "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
the Clinton Foundation." CORSI followed up several minutes later with another email to the
11
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 17 of 25
Target Account and the Account titled, "Podesta talking points," with the text "sent a
second time just to be sure you go it." STONE emailed CORSI back via the Account,
47. On or about October 17, 2016, CORSI emailed the Target Account and the
Account with the subject, "Fwd: AS SAN GE . .. URGENT ... " CORSI wrote, "From a
very trusted source," and forwarded an email with the header information stripped out, showing
only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador
and U .K. He will drop the goods on them if they move to extradite him. My guess is that he has a
set of dead man files that include Hillary. It's what they used to call a ' Mexican stand off[.]'
Only hope is that if Trump speaks out to save him[.] Otherwise he'd dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
the Account, CORSI, and with the subject line, "in case you need
his mail ... ...... " Attached to the message was a scan of a business card for John Podesta.
Several hours later, replied to all recipients, including the Target Account, "Ha ...
49. I know from my training and experience that the term "phishing" is used to refer
to the practice of sending emails purporting to be from a reputable party in order to induce
individuals to reveal personal information, including passwords. Public reports indicate that
12
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 18 of 25
50. STONE has also used Target Account to continue conversations began via
Twitter direct message. For example, on August 18, 2016, an individual sent @RogerJStoneJr a
direct message asking "know where to send information to" regarding "Presidential polls and
concerning an offer for "$500 for a 30 minute phone call," stating that "My audience would be
fascinated by discussion." The individual then direct messages Stone, "Hi Roger! I'm striking
out with your rep. Hoping we can swing something this week. My offer still stands."
52. Google provides numerous free services to the users with a Google profile. Some
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user' s Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view, and share videos. Google also retains a record of searches conducted by the user,
as well as location data for the use of some of the services described above. All of these services
13
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 19 of 25
can help to show the state of mind of an individual at the time the search was made, as well as
the individuals potential advance knowledge of events, as they search to see if the anticipated
event has occurred. Individuals who communicate via Gmail also often use other Google
products, including Google Talk, to communicate, and Google Drive to store or transfer, open, or
edit files.
54. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
locate the items described in Section II of Attachments B. The items identified in Attachments A
and B will also be screened by reviewers not on the prosecution team to identify and filter out
privileged material.
CONCLUSION
55. STONE instructed CORSI via the Account to "Get to Assange" at the
Ecuadorian Embassy regarding upcoming leaks, and CORSI emailed Stone on the
Account that it was "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC." CORSI later emailed STONE "talking points" about Podesta to the
Target Account, and also emailed the Target Account to convey information "from a very
trusted source" regarding ASSANGE, WikiLeaks, and potential disclosure. STONE also used
14
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 20 of 25
the Target Account to continue conversations via email that he began on Twitter and forwarded
emails related to WikiLeaks from the Account to the Target Account. There is
therefore probable cause to believe that evidence of the DNC hack and the hacking of other
emails associated with the 2016 election will be found in the information associated with the
Target Account.
56. Based on the forgoing, I request that the Court issue the proposed search warrant.
57. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
15
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 21 of 25
58. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
Special Agent
Federal Bureau of lnvestigati_o n
~le~
The Honorable Beryl A. Howell
Chief United States District Judge
16
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 22 of 25
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google account:
that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
17
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 23 of 25
ATTACHMENT B
I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(±), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and-the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c. All internet search data including all queries and location data;
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
1. Google Talk and Google Hangouts conversation logs associated with the
account.
19
Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 25 of 25
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate 'in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
20
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 1 of 31
AO 106 (Rev. 04/ 10) Application for a Search Warrant
FILED
UNITED STATES DISTRICT COURT NOV -s 2017
for the
Clerk, U.S. District & Bankruptcy
District of Columbia Courts for the District of Columbia
See Attachment A.
located in the Northern
- - - ' - - - - - -- District of _ _ __ California
__.:....c.;c.:,c.;:_;_:--=-- --- , there is now concealed (identi.fj, the
p erson or describe the property to be seized) :
See Attachment 8.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more) :
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers
18 U.S.C. § 371, § 2 Conspiracy Against the United States, Aiding and Abetting
50 U.S.C. § 30121 Foreign Contribution Ban
The application is based on these facts:
Date: 11/6/2017
City and state: Washington , D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 2 of 31
FILED
IN THE UNITED STATES DISTRICT COURT
NOV -s 2017
FOR THE DISTRICT OF COLUMBIA Clerk us 0 . .
Courts fo.r the ';~ntc~ & Bankruptcy
is net ot Columbia
IN THE MATTER OF THE SEARCH OF Case: 1: 17-mj-00821
INFORMATION AS SOCIA TED WITH THE Ass!gned To : Howell, Beryl A
TWITTER ACCOUNT AND Assign. Date : 11/6/2017
Description: Search and Seizure Warrant
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
information associated with the Twitter Accounts (hereafter "Target Account 1")
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(I )(A).
directly with the Special Counsel's Office. I have been a Special Agent with the FBI since 2010.
Since then, l have conducted national security investigations of foreign intelligence services,
espionage, and counter proliferation matters. I have training and experience related to espionage,
foreign intelligence services, and national security investigations. I have conducted and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that certain individuals with whom the Target Accounts were
in communication have committed violations of 18 U..S.C. § I 030 (fraud and related activities in
connection with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S .C. § 2 (aiding
and abetting), 18 U.S.C. § 371 (conspiracy to commit an offense against the United States), and
that communications related to these violations will be found on the Target Accounts. There is
therefore probable cause to search the information described in Attachment A for evidence of
about July 17, 2016, Target Account 1, belonging to WikiLeaks, exchanged numerous direct
messages concerning hacked information with Guccifer 2.0, which was a Twitter account used
by the Russian Government to release data obtained through hacking accounts of U.S. users.
Target Account 1 also sent direct messages via Twitter concerning a "guessed" password for the
the founder of WikiLeaks. Beginning no later than on or about July 2016, former Campaign
adviser Roger Stone was in contact with Assange via an intermediary regarding upcoming leaks
communicated directly with Stone beginning no later than on or about April 7, 2017. Stone
stated to Target Account 2 that he was "doing everything possible to address the issues [related
2
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 4 of 31
to WikiLeaks] at the highest level of Government," and that he and Target Account 2 "must be
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraph 9.
PROBABLE CAUSE
it frequently has been used to release hacked information, including during the 2016 election.
Target Account 2 is the public account of Julian Assange. Target Account 2 has over 500,000
followers, but only follows one account, Target Account 1. Target Account 2 frequently
profile of Target Account 2, Assange currently is the "Publisher @WikiLeaks [Target Account
1]." Target Account 2's profile contains a link to the website " IamWikiLeaks.org\donate."
systems when he sixteen years old, in 1987. On or about December 1996, Assange pied guilty in
Australia to twenty-five charges related to hacking secure computer systems. In 2006, Assange
and others established WikiLeaks, and he previously described himself as WikiLeaks's Editor-
3
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 5 of 31
in-Chief. Assange has stated in public interviews that he is deeply involved in running
WikiLeaks. Referring to the DNC emails, Assange stated in an August, 2017 interview that, "We
had quite some difficulties to overcome, in terms of the technical aspects, and making sure we
were comfortable with the forensics," and that "You have to get close and interact with it, then
you start to get a feel." Assange indicated that only a small number of people, including himself,
worked on the release of the DNC emails. Assange stated in August 20 16 to a news organization
that, "We are working around the clock. We have received quite ·a lot of material."
actively involved in U.S. politics sine~ 1975. Stone officially worked on the presidential
campaign of Donald J. Trump (the "Campaign") until August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
Stone's public departure from the Campaign, Stone continued to correspond with individuals
related to the Campaign, including Paul Manafort (who worked for a time as Campaign
manager), Rick Gates (a campaign adviser), and Jason Miller (Campaign spokesman). As
discussed further below, Stone made a number of public references to WikiLeaks, Julian
B. The DNC Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
Disseminate Hacked Information.
10. According to the public and unclassified intelligence report prepared by the
United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence
4
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 6 of 31
Directorate or "GRU") probably began cyber operations aimed at the U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other
Democratic Party officials and political figures. By in or about May 2016, the GRU had
exfi ltrated large volumes of data from the DNC. The DNC headquarters is located at 43 0 South
a. The GRU used a Twitter account, "Guccifer 2.0" and the website
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in
multiple contradictory statements and false claims about hi s likely Russian identity
c. Content that was taken from e-mail accounts targeted by the GRU in
d. The GRU relayed material it acquired from the DNC and senior
Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its
Russia Today) has actively collaborated with WikiLeaks. RT's editor-in-chief visited
2013, where they discussed renewing his broadcast contract with RT, according to
Russian and Western media. Russian media has subsequently announced that RT had
5
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 7 of 31
become "the only Russian media company" to partner with WikiLeaks and had received
called "Julian Assange Special: Do WikiLeaks Have the E-Mail That'll Put Clinton in
Prison?" and an exclusive interview with Assange entitled "Clinton and ISIS Funded by
12. On or about June 14, 2016, the Washington Post reported that "Russian
government hackers" had penetrated the DNC computer network and stole opposition research
on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.
13. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack
14. As detailed further below, on or about June 22, 2016, Guccifer 2.0 and Target
Account 1 initiated communication via Twitter private messaging regarding the transfer and
release of hacked information, including the hacked email accounts related to the DNC.
15. On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from
the DNC. Using Target Account 1, WikiLeaks publicly tweeted: "WikiLeaks releases thousands
of documents about Clinton and internal deliberations" and linked to a Washington Post article
I 6. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers
and email addresses from the files of the Democratic Congressional Campaign Committee
(DCCC).
17. On or about August 21, 20 16, Roger Stone directed a publicly-available tweet at
John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon
6
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 8 of 31
the [sic] Podesta's time in the barrel. #CrookedHi llary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a '" mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
18. On or about September 13, 2016, Target Account 1 tweeted a public message
stating, "678.4 MB of new ' DNC documents' from @Guccifer_2," with a link to a publicly
available file.
19. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
20. Approximately a half hour later, at 4:32 P.M., Target Account 1 sent out a Tweet
reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing
a link to approximately 2,050 emai ls that had been hacked from John Podesta's personal emai l
account. WikiLeaks, via Target Account 1, continued to release John Podesta's hacked emails
California issued a search warrant for the Twitter Account associated with Guccifer 2.0. The
7
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 9 of 31
22. On or about June 22, 2016, WikiLeaks sent Guccifer 2.0 sent a direct message
(OM) stating "Do you have secure communications?" Target Account 1 stated, "Send any new
material here for us to review and it will have a much higher impact than what you are doing. No
other media will release the full material." Guccifer 2.0 replied, "what can u suggest for a secure
connection? Soft, keys, etc? I'm ready to cooperate with you, but I need to know what's in your
archive 80gb? Are there only HRC emails? Or some other docs? Are there any DNC docs? If it's
not secret when you are going to release it?" Target Account 1 wrote back, "You can send us a
message in a .txt file here," and attached a web link. Guccifer 2.0 responded, "do you have
GPG?" I know from my training and experience that "GPG" refers to a program for exchanged
encrypted information.
23. On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, "How can
we chat? Do u have jabber or something like that?" I know from my training and experience that
"Jabber" is an instant messaging service. Target Account 1 wrote back, "Yes, we have
everything. We' ve been busy celebrating Brexit. You can also email an encrypted message to
[email protected]. They key is here." 1 A web link was attached to the message. I know from
my training and experience that an encryption "key" is a string of information created for
24. On or about June 27, 2016, Guccifer 2.0 wrote to Target Account 1, "Hi, [I]'ve
just sent you an email with a text message encrypted and an open key." Target Account 1 wrote
back, "Thanks." Guccifer 2.0 replied, "waiting for ur response. I send u some interesting piece."
1
Target Account I sent each sentence as a separate message, though close in time. These messages have been
consolidated into a single quote for ease of reading. The same is done below with other close in time messages.
8
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 10 of 31
25. On or about July 4, 2016, Guccifer 2.0 wrote to Target Account 1, "hi there,
26. On or about July 6, 2016, Guccifer 2.0 wrote to Target Account 1, "have u
received my parcel?" Target Account 1 responded, "Not unless it was very recent. [we haven't
checked in 24h]." 2 Guccifer 2.0 replied, "I sent it yesterday, an archive of about 1 gb. via
[website link]. [A]nd check your email." Target Account 1 wrote back, "Wil[l] check, thanks."
Guccifer 2.0 responded, " let me know the results." Target Account 1 wrote back, "Please don't
make anything you send to us public. It' s a lot of work to go through it and the impact is severely
reduced if we are not the first to publish." Guccifer 2.0 replied, "agreed. How much time will it
take?" Target Account 1 responded, " likely sometime today." Guccifer 2.0 wrote back, "will u
announce a publication? and what about 3 docs [I] sent u earlier?" Target Account 1 responded,
" I don' t believe we received them. Nothing on 'Brexit' for example." Guccifer 2.0 wrote back,
"wow. have you checked ur mail?" Target Account 1 replied, "At least not as of 4 days ago . . . .
For security reasons mail cannot be checked for some hours." Guccifer 2.0 wrote back, "fuck, [I]
sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I]
spent the whole day uploading 1 gb." I know from my training and experience that the term "gb"
27. Target Account 1 wrote back, "We can arrange servers l00x as fast. The speed
restrictions are to anonymise the path. Just ask for custom fast upload point in an email."
Guccifer 2.0 wrote, "will u be able to check ur email?" Target Account 1 responded, "We're
best with very large data sets. e.g. 200gb. these prove themselves since they're too big to fake. "
2
The brackets appear in the original message.
9
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 11 of 31
Guccifer 2.0 responded, "or shall I send brexit docs via submission once again?" Target
28. On or about that same day, Guccifer 2.0 wrote, "can u confirm u received dnc
emails?" Target Account 1 wrote back several messages later, "for security reasons we can 't
confirm what we' ve received here. e.g., in case your account has been taken over by us
intelligence and is probing to see what we have." Guccifer 2.0 responded, "then send me an
encrypted email." Target Account 1 wrote back, "we can do that. but the security people are in
another time zone so it will need to wait some hours." Target Account 1 wrote, "what do you
think about the FBl ' s failure to charge? To our mind the clinton foundation investigation has
always been the more serious. we would be very interested in all the emails/docs from there. She
set up quite a lot of front companies. e.g in sweden." Guccifer 2.0 responded, "ok, [l]'ll be
waiting for confirmation. [A]s for investigation, they have everything settled, or else I don' t
know how to explain that they found a hundred classified docs but fail to charge her. " Target
Account 1 responded, "She' s too powerful to charge at least without something stronger. [A]s
far as we know, the investigation into the clinton foundation remains open[.] [W]e hear the FBI
are 4nhappy with Loretta Lynch over meeting Bill, because he' s a target in that investigation."
29. On or about that same day, Guccifer 2.0 wrote to Target Account 1, "[D]o you
have any info about marcel lazar? There've been a lot of rumors of late." "Marcel Lazar" is the
name of a Romanian Hacker who used the pseudonym "Guccifer," and who pied guilty on May
25, 2016 in the Eastern District of Virginia to hacking the personal accounts of a variety of
victims, including a former U.S. president. According to publicly available reporting, in May
20 16, Lazar also claimed to have hacked the email served belonging to then-candidate Clinton.
Lazar stated, " For me, it was easy ... easy for me, for everybody." Lazar's claims have not been
10
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 12 of 31
substantiated, and the undersigned is not aware of evidence indicating Lazar accomplished the
hack.
30. Target Account 1 wrote back, "the death? [A] fake story." Target Account 1
messaged: "His 2013 screen shots of Max Blumenthal's inbox prove that Hillary secretly deleted
at least one email about Libya that was meant to be handed over to Congress. So we were very
interested in his co-operation with the FBI." Guccifer 2.0 wrote back, "some dirty games behind
the scenes [I] believe[.] Can you send me an email now?" Target Account 1 wrote back, "No;
we have not been able to activate the people who handle it. Still trying." Guccifer 2.0 replied,
"what about tor submission? [W]ill u receive a doc now?" Target Account 1 replied, "We will
get everything sent on [weblink]." [A]s long as you see \"upload succseful\" at the end. [I]fyou
have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the
DNC is approaching and she will solidify bernie supporters behind her after." Guccifer 2.0
31. Target Account 1 wrote, " [W]e think the public interest is greatest now and in
early october." Guccifer 2.0 responded, "do u think a lot of people will attend bernie fans rally in
philly? Will it affect the dnc anyhow?" Target Account 1 wrote, "bernie is trying to make his
own faction leading up to the DNC. [S]o he can push for concessions (positions/policies) or, at
the outside, if hillary has a stroke, is arrested etc, he can take over the nomination. [T]he question
is this: can bemies supporters+staff keep their coherency until then (and after). [O]r will they
dis[s]olve into hillary's camp? [P]resently many of them are looking to damage hilary [sic]
inorder [sic] to increase their unity and bargaining power at the DNC. Doubt one rally is going to
be that significant in the bigger scheme. [I]t seems many of them will vote for hillary just to
11
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 13 of 31
32. On or about that same day, Guccifer 2.0 sent Target Account 1 a message
reading, "sent brexit docs successfully." Target Account 1 responded, ":)))." Target Account 1
wrote back, "we think trump has only about a 25% chance of winning against hillary so conflict
between bernie and hillary is interesting." Guccifer 2.0 responded, "so it is." Target Account 1
wrote, "also, it' s important to consider what type of president hillary might be. If bernie and
trump retain their groups past 2016 in significant number, then they are a restraining force on
hillary."
33. On or about July 7, 2016, Target Account 1 wrote, "All good?" Guccifer 2.0
responded, "yeah, what about u? is smth wrong?" I know from my training and experience that
"smth" is used as an abbreviation for "something." Target Account 1 wrote back, "No. All
good." Guccifer 2.0 wrote back, "are working with the emails [I] sent u? [C]heck ur email. [I]
sent u a check archive from another email box. fuck, mail undelivered. [D]o you have another
way to receive large volumes of data? [B]esides for tor submission form?"
34. On or about July 11, 2016, Guccifer 2.0 wrote to Target Account 1, "sent it via
35. On or about July 13, 2016, Guccifer 2.0 wrote, "r u there?" On or about July 14,
2016, Guccifer 2.0 wrote, "ping. Check ur email. sent u a link to a big archive and a pass."
Target Account 1 replied, "great, thanks; can' t check until tomorrow though ."
36. On or about July 17, 2016, Guccifer 2.0 wrote, "what bout now?" On or about
July 18, 2016, Target Account 1 responded, "have the 1Gb or so archive." Guccifer 2.0
responded, "have u managed to extract the files?" Target Account 1 responded, "yes. turkey
coup has delayed us a couple of days. [O]therwise all ready[.]" Guccifer 2.0 responded, "so
when r u about to make a release?" Target Account 1 wrote back, "this week. [D]o you have
12
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 14 of 31
any bigger datasets? [D]id you get our fast transfer details?" Guccifer 2.0 wrote back, "i'll check
it. did u send it via email? Target Account 1 responded , "yes." Guccifer 2.0 replied, "to [web
link]. [I] got nothing." Target Account 1 wrote, "check your other mail? this was over a week
ago." Guccifer 2.0 wrote back, "oh, that one, yeah, [I] got it."
37. On or about July 18, 20 16, Target Account 1 wrote, "great. [D]id it work?"
Guccifer 2.0 wrote back, " [I] haven't tried yet." Target Account 1 responded, "Oh. We arranged
that server just for that purpose. Nothing bigger?" Guccifer 2.0 wrote back, "let's move step by
step, u have released nothing of what [I] sent u yet." Target Account 1 replied, "How about you
transfer it all to us encrypted. [T]hen when you are happy, you give us the decrypt key. [T]his
way we can move much faster. (A]lso it is protective for you if we already have everything
because then there is no point in trying to shut you up." Guccifer 2.0 wrote back, "ok, i' ll ponder
it."
D. Contacts Involving the Julian Assange, Roger Stone, and the Target Accounts
38. Approximately eight days after the last communication between Guccifer 2.0 and
WikiLeaks described above, on or about July 25, 2016, Stone sent an email to Jerome Corsi, an
author and political commentator, with the subject line, "Get to Assange." 3 The body of the
message read: "Get to Assange [a]t Ecuadorian Embassy in London and get the pendin~
39. On or about A:ugust 2, 2016, Corsi emailed Stone, " Word is friend in embassy
plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging
3
1. On August 7, 20 17, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for
Roger Stone's Twitter account, @RogerJStoneJr. On September 11, 2017, Chief Judge Beryl A. Howell of the
District of Columbia issued a search warrant for Stone's Hotmail address, The relvant
results of those search warrants are summarized in the paragraphs which fo llow.
13
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 15 of 31
... Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting
HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump
focus, setting stage for Foundation debacle." Based on my training, experience, and review of
materials in this case, it appears that Corsi's reference to a "friend in embassy [who] plans 2
more dumps" refers to Julian Assange (the user of Target Account 2), the founder of
40. On or about August 16, 2016, Corsi emailed Stone a link to a piece Corsi had
written about Stone titled, "Trump Adviser: Wikileaks Plotting Email Dump to Derail Hillary."
41. As discussed above, on or about August 21, 2016, Roger Stone directed a
stating: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary."
42. On or about August 31, 2016, Corsi emailed Stone: "Did you get the PODESTA
43. On or about September 6, 2016, Corsi emailed: "Roger[,] Is NY Post going to use
44. On or about October 7, 2016, WikiLeaks began releasing emails hacked from
45. WikiLeaks continued to release John Podesta' s hacked emails throughout October
I 0-21, 2016. On October 12, 2016, John Podesta argued publicly that " [it is] a reasonable
assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there' s at least a reasonable belief that [Assange] may have passed this
14
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 16 of 31
information on to [Stone]." Commenting to the Miami Herald on or about that same date, Stone
responded: "I have never met or spoken with Assange, we have a mutual friend who ' s traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I .have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
46. On or about that same day, October 12, 2016, Corsi emailed Stone on both the
with a subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER
STONE podesta talking points Oct 12 2016.docx." The "talking points" included the statement
that, "Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation." Corsi followed
up several minutes later with another email titled, "Podesta talking points," with the text "sent a
second time just to be sure you go it." Stone emailed Corsi back, "Got them and used them."
47. On or about the next day, October 13, 20 I 6, Stone sent a private direct message to
Target Account 1 stating, "Since I was all over national TV, cable and print defending
wikileaks and assange against the claim that you are Russian agents and debunking the false
charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking
me- cordially R." Target Account 1 responded, "We appreciate that. However, the false claims
of association are being used by the democrats to undermine the impact of our publications.
48. On or about October 16, 2016, Roger Stone wrote to Target Account 1, "Ha! The
more you \"con-ect\" me the more people think you're lying. Your operation leaks like a sieve.
15
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 17 of 31
49. On or about October 17, 2016, Corsi emailed Stone with the subject, "Fwd:
ASSANGE ... URGENT . .. " Corsi wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is he has a set of dead man files that include Hillary. It's
what they used to call a ' Mexican stand offt.]' Only hope is if Trump speaks out to save him[ .)
Otherwise he's dead anyway, once he' s dropped what he has. If HRC wins, Assange can kiss his
life away. Interesting gambit Assange has to play out. He' s called Podesta's bluff and raised him
the election."
" Happy?" and then wrote, "We are now more free to communicate."
52. On or about March 27, 2017, Target Account 1 wrote to Roger Stone, "FYI,
while we continue to be unhappy about false \"back channel\" claims, today CNN deliberately
53. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: " Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true. "
16
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 18 of 31
54. On or about April 7, 2017, Roger Stone wrote to Target Account 1, " I am JA's
only hope for a pardon the chances of which are actually (weirdly) enhanced by the bombing in
Syria (which I opposed) . You have no idea how much your operation leaks. Discrediting me
only hurts you. Why not consider saying nothing? PS- Why would anyone listen to that asshole
Daniel Ellsberg." Based on my training, experience, and review of materials in this case, I
believe that "JA" refers to Julian Assange, the user of Target Account 2.
55. On or about April 19, 2017, Assange, using Target Account 2, wrote to Stone,
"Ace article in infowars. Appreciated. But note that U.S. intel is engages in slight of hand
maoevers [sic]. Listen closely and you see they only claim that we received U.S. election leaks
\"not directly\" or via a \"third party\" and do not know \"when\" etc. This line is Pompeo appears
to be getting at with his \"abbeted\". This correspnds to the same as all media and they do not
56. On or about June 4, 2017, Roger Stone wrote back to Target Account 2, "Still
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." Target Account 2
responded, "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
57. On or about June 10, 2017, Roger Stone wrote to Target Account 2, "I am doing
everything possible to address the issues at the highest level of Government. Fed treatment of
17
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 19 of 31
you and Wikileaks is an outrage. Must be circumspect in this forum as experience demonstrates
it is monitored. Best regards R ." Target Account 2 wrote back, "Appreciated. Of course it is!"
58. During the events described above, Target Account 1 also engaged in a separate
1 publicly tweeted, " ' Let's bomb Iraq' Progress for America PAC to launch 'PutinTrump.org' at
sent a private message to a high level individual associated with the Campaign (the "high-level ·
Campaign individual"). 4 The message stated: "A PAC run anti-Trump site ' ' is
about to launch. The PAC is a recycled pro-Iraq war·PAC. We have guessed the password. It is
'. See 'About ' for who is behind it. Any comments?"
September 21 , 2016, the website " " was launched. The website was run by
individuals who stated they wanted to focus attention to what they described as the "dangerous
hours after PutinTrump.org went " live" according to publicly available press accounts), the high-
4
These records were obtained via a search warrant signed by Chief Judge Beryl A. Howell of the District of
Columbia on October 12, 2017.
18
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 20 of 31
level Campaign individual sent Target Account 1 a private message: "Off the record I don't
62. Twitter owns and operates a free-access social-networking website of the same
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
63. Upon creating a Twitter account, a Twitter user must create a unique Twitter
usemame and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
usemame, password, and name without having to open a new Twitter account.
64. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
65. A Twitter user can post a personal photograph or image (also known as an
"avatar") to his or her profile, and can also change the profile background or theme for his or her
19
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 21 of 31
account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.
66. Twitter also keeps IP logs for each user. These logs contain information about the
user's logins to Twitter including, for each access, the IP address assigned to the user and the
67. As discussed above, Twitter users can use their Twitter accounts to post "Tweets"
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user' s username (i.e., a list
68. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that the user has shared on Twitter,
69. Twitter users can also opt to include location data in their Tweets, which will
reveal the users' locations at the time they post each Tweet. Thi s "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
70. When Twitter users want to post a Tweet that includes a link to a website, they
can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
20
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 22 of 31
71 . A Twitter user can "follow" other Twitter users, which means ~ubscribing to
those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that _user (i.e., the user' s "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into " lists" that display on the right
side of the user' s home page on Twitter. Twitter ilso provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
72. In addition to posting Tweets, a Twitter user can also send DMs to one of his or
her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the in boxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
73. Twitter users can configure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
74. Twitter includes a search function that enables its users to search all public
Tweets for keywords, usemames, or subject, among other things. A Twitter user may save up to
25 past searches.
21
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 23 of 31
75. Twitter users can connect their Twitter accounts to third-party websites and
applications, which may grant these websites and applications access to the users' public Twitter
profiles.
76. If a Twitter user does not want to interact with another user on Twitter, the first
user can "block" the second user from following his or her account.
77. In some cases, Twitter users may communicate directly with Twitter about issues
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
78. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user' s account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This " user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
22
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 24 of 31
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner' s motive and intent to commit a crime (e.g., information indicating a criminal
79. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information.
80. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
23
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 25 of 31
CONCLUSION
81. Based on the forgoing, I request that the Court issue the proposed search warrant.
82. Pursuant to 18 U.S .C. § 2703(g), the presence of a law enforcement officer is not
83. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~AmyArson~
Special Agent
Federal Bureau of Investigation
&~~
The Honorable Beryl A. Howell
Chief United States District Judge
24
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 26 of 31
ATTACHMENT A
Property to Be Searched
All information that is associated with the Twitter profile with usernames from the period
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following information to the
a. All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
b. All past and current usernames, account passwords, and names associated with
the account;
c. The dates and times at which the account and profile were created, and the
d. All IP logs and other documents showing the IP address, date, and time of each
e. All data and information associated with the profile page, including photographs,
f. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 28 of 31
g. All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account
h. All photographs and images in the user gallery for the account;
1. All location data associated with the account, including all information collected
J. All information about the account' s use ofTwitter's link service, including all
longer website links that were shortened by the service, ·all resulting shortened
links, and all information about the number of times that a link posted by the
k. All data and information that has been deleted by the user;
I. A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user' s "following" list and "followers" list);
o. All information on the " Who to Follow" list for the account;
q. All records of Twitter searches performed by the account, including all past
r. All information about connections between the account and third-party websites
and applications;
2
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 29 of 31
regarding the user or the user' s Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.
3
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 30 of 31
All information described above in Section I that constitutes fruits, evidence, and
with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting) since
March 1, 2016 including, for each user ID identified on Attachment A, information pertaining to
111. any other individual related to the 2016 United States election.
e. Evidence indicating how and when the Twitter account was accessed or used,
and events relating to the crime under investigation and to the Twitter account
owner;
4
Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 31 of 31
g. The identity of the person(s) who created or used the user ID, including
h. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.
5
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 1 of 35
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal Qdentifu the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before January 2, 2018 fuot to exceed t 4 days)
ilf in the daytime 6:00 a.m. to 10:00 p.m. ü at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the propefty was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. BervlA. Howell
(United States Magisffate Judge)
üPursuant to 18 U.S.C. $ 3103a(b), I find that immediate notification may have an adverse result listed in l8 U.S'C'
$ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized þheck the appropriate box)
fl for_days (nottoexceed30) il until,thefactsjustifying,thelaterspecificdateof
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 2 of 35
Return
Case No.: Date and time warrant executed Copy of warrant and inventory left with
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing ffi cer's s ignature
See Attachment A.
located in the Northern District of California , there is now concealed (dentifu the
person or describe Íhe property to be seized)i
See Attachment B.
This warrant is sought pursuant to l8 U.S.C. $$ 2703(a), 2703(bX1XA), and 2703(cXlXA).
The basis for the search under Fed. R. Crirn. P. a I (c) is (check one or more):
devidence of a crime;
dcontraband, fruits of crime, or other items illegally possessed;
dproperry designed for use, intended for use, or used in committing a crime;
ü a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section
18 U.S.C. S 1030 F ra ud a nd re ated activiti es h !#{:&3:iííK33i 0r,"'.,
I
18 U.S.C. S 371; 2 Conspiracy against the United States; Aídíng and abetting
52 U.S.C. S 30121 Foreign contribution ban
The application is based on these facts:
City and s1¿1s; Washington, D'C Hon. BerylA. Howell, Chief U.S. District J udge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 4 of 35
FTI.EÞ
IN THE UNITED STATES DISTRICT COURT DEC Ig 20t7
FOR THE DISTzuCT oF'r-oT IT]\IRIÁ
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Amy A. Anderson, being first duiy sworn, hereby depose and state as follows:
information associated with the following email account (hereafter the Target Account),
Google;
The information to be disclosed by Google (hereafter "the Provider") and searched by the
government is described in the following paragraphs and in Attachments A and B. This affidavit
FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2010. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to espionage and foreign intelligence services national security investigations.
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 5 of 35
I have conducted and participated in various investigations involving multiple threat countries as
3. The facts in this affidavit come fi'om my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause ftrr the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contáins communications relevant to
violations of 18 U.S.C. $ 1030 (fraud and related activities in connection with computers), 52
U.S.C. $ 30121 (foreign contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as deftned by 18 U.S.C. ç2711. /d. $$ 2703(a), (bX1XA), & (cX1XA).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a courl) . . . that has jurisdiction over the offense being investigated." 18 U.S.C.
$ 2711(3XAXi). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 1 1.
SUMMARY
Assange" in person at the Ecuadorian Embassy and "get pending Wikileaks emails[.]" On or
about August I,2016, STONE also instructed CORSI to have (the user of
tlre Target Account) contact Julian ASSANGE. On or about August 2,2016, CORSI responded
2
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 6 of 35
to STONE that the "word is fi'iend in embassy IASSANGE] plans 2 more dumps. One shortly
after I'm b ack. 2nd in October. Impact planned 1o be. very .damaging. .. . Time to let Podesta to be
exposed as in bed w enemy if they are not ready to drop I{RC." Information disclosures
subsequently occurred on or about the times CORSI predicted: On or about August 12,2016, the
day CORSI was scheduled to return to the United States ("shortly after I'm back"), Guccifer 2.0
(DCCC). On October 7 ,2016 ("in October"), Wikileaks began releasing emails hacked from
emailed Stone to congratulate him on "tak[ing] the country back," and stating, "You deserve a
lot of credit and working with you and Jeri Corsi, who is with me now in London has been a
great joy." On or about January 7,2017, using the Target Account emailed
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
described further below, STONE also maintained contact with individuals employed by the
J
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 7 of 35
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
.GATES
publicly-available sources, from2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a"/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described fuither below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
iii.
10.
4
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 8 of 35
United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June
2016. By March 20I6,the Russian military intelligence (General Staff Main Intelligence
Directorate or "GRU") probably began cyber operations aimed atthe U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other
Democratic Party officials and political figures. By in or about }/ray 20ï6, the GRU had
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South
DCleaks.com to release the U.S. victim data obtained in cyber operations publicly and in
multiple contradictory statements and false claims about his likely Russian identity
c. Content that was taken from e-mail accounts targeted by the GRU in
5
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 9 of 35
d. The GRU relayed material it acquired from the DNC and senior
Russia Today) has actively collaborated with Wikileaks. RT's editor-in-chief visited
z}I3,where they discussed renewing his broadcast contract with RT, according to
Russian and Vy'estern media. Russian media has subsequently announced that RT had
become "the only Russian media company" to partner with V/ikileaks and had received
13. On or about June 14, 2016, the Washington Post reported that "Russian
government hackers" had penetrated the DNC computer network and stole opposition research
on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.
14. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack
15. On or about JuIy 22,20ì6,V/ikileaks published about 20,000 emails stolen from
the DNC.
16. On or about August 12,2016, Guccifer 2.0 released personal cellphone numbers
and email addresses from the files of the Democratic Congressional Campaign Committee
(DCCC).
referring to John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it
6
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 10 of 35
will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that
,same day, Stone reiterated that because of the work of a "imutual acquaintancel.of both his and
[Assange], the public fcould] expect to see much more from the exiled
whistleblower in the form
of strategically-dun'rped Clinton email batches." He added: "'Well, first of all, I think Julian
Assange is a hero... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
18. On Friday, October 7,2016,at approximately 4:03 P.M., the V/ashington Post
published an article containing a recorded conversation from a2005 Access Hollywood shoot in
lg. Approximately a half hour later, at 4:32 P.M., Wikileaks sent out a public Tweet
reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing
a link to approxim ately 2,050 emails that had been hacked from John Podesta's personal email
account. V/ikileaks continued to release John Podesta's hacked emails throughout October 10-
14,2016.
C. Roger STONE's Private Twitter Messagbs with Guccifer 2.0, Wikileaks, and Julian
ASSANGE.
ooDear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0."
7
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 11 of 35
22. On August 12,2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the,leal #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
'¿3. On August l3,2olti, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 hadbeen banned from Twitter. The next day, Guccifer 2.0's
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter
handle
"wow. thank u for writing back, and thank u for an article about me!!! did you find an¡hing
26. On August 16,2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.
27. On August 17,2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a greatpleasure to me."
28. On August 18,2016, Paul Manafoft, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
I On or about August7,2017, Chief Judge Beryl A. Howell issued a search warant for the Twitter account
@RogerJStoneJr.
8
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 12 of 35
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukrairre.
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
30. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
tweeted regarding an announcement Julian Assange had scheduled for the next day from the :
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of V/ikileaks' 1O-year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load."
coming. #Lockthemup."
emails that had been hacked from John Podesta's personal email account.
35. On or about October 12,2016, John Podesta - referring back to Stone's August
2I,2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that fStone] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
9
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 13 of 35
think there's at least a reasonable belief that fAssange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have aclvanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
36. On or about the next day, Octòber 13, 2016, @RogerJStoneJr sent a private direct
message to the Twitter account @Wikileaks. The message read: "Since I was all over national
TV, cable and pri.nt defending Wikileaks and assange against the claim that you are Russian
agents and debunking the false charges of sexual assault as trumped up bs you may want to
rexamine the strategy of attacking me- cordially R." Less than an hour later, @wikileaks
responded by direct message: "We appreciate that. However, the false claims of association are
being used by the democrats to undermine the impact of our publications. Don't go there if you
The more you \"correct\" me the more people think you're lying. Your operation leaks like a
38. On November 9,2016, one day after the presidential election, @wikileaks sent a
communicate."
10
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 14 of 35
39 . On March 70, 2Al7 , Stone spoke with The Washington Times and acknowledged
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.
writing from an email address associated with'Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since I never communicated with Wikileaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope oftheir subsequent disclosures. So I am clairvoyant orjust a good guesser because the
an address associated with Julian Assange in numerous public reports, stating: "Still nonsense.
As a journalist it doesn't matter where you get information only that it is accurate and authentic.
The New York Times printed the Pentagon Papers which were indisputably stolen from the
government and the courts ruled it was legal to do so and refused to issue an order restraining the
paper from publishing additional articles. If the US government moves on you I will bring down
the entire house of cards. V/ith the trumped-up sexual assault charges dropped I don't know of
any crime you need to be pardoned for - best regards. R." That Same day, @JulianAssange
responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
11
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 15 of 35
42. On or about June i0, 2017, @RogerJStoneJr sent a direct message to @wikileaks,
reading: "l am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this
44. On or about June 20, 20|6, , using the Target Account, emailed
STONE and Paul MANAFORT, the Campaign Chairman, asking to "know imrnediately how I
can help" the Campaign. also wrote that his "research on Rhodes House" was
previous tweet on or about October T3,2015 that, "In 1969, Bill Clinton was expelled from
Oxford for raping nineteen-year-old ." Rhodes House is the headquarters of the
discussed below.
45. On or about luly 7,2016, , using the Target Account, emailed Stone
that he had "my tickets to Cleveland[.] [D]o you have my credential pack?" appears
an email to STONE and CORSI with the subject line: "Fwd: The Bill Gates of Turkey wants to
createa campaign for Donald J Trump in Turkey." wrote: "Do you want to have a
talk about this? Turkey is for Trump!" Below was a forwarded message sent to the Target
12
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 16 of 35
Account from an individuat who stated that he had been contacted by the "Bill Gates of Turkey,
47. On or about that same day, .Tuly 25,2016, (approximately three days after
Wikileaks began releasing emaiis hacked from the DNC), emailed Roger
STONE with the subject line, "You need to get to Assange." The body of the message read: "At
Ecuadorian Embassy in London and get the pending wikileaks emails...they deal with
Foundation, allegedly."
minutes later STONE called CORSI and they spoke for 26 minutes.
49. Less than two hours after the phone call to CORSI, STONE emailed CORSI at
with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending Wikileaks emails...they deal with Foundation,
allegedly." It appears that STONE cut and pasted the email from to CORSI.
conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if
that happens. That will be next."
51. On or about July 28, 2016, Roger STONE called Richard GATES (then the
deputy-chair of the Campaign). The two spoke for approximately twelve minutes.
52. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the
Campaign) called STONE. The two spoke for approximately one hour and seven minutes. The
Government has analyzedtoll records from January 1,2016 to November 9,2016. Sixty-seven
13
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 17 of 35
minutes is the longest call (by almost a halÊhour) that took place between STONE and
53. On or about July 31,2016, STONE called GATES and the two spoke for
approximately 5 minutes. Approximately ninety minutes later, STONE emailed CORSI at with
the subject [ine, "Call me MON."'l'he tsody read: should see Assange[.]
should find Bemie sanders brother who called Bill a Rapist - turn him for Trump[.]
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE: "V,/ith family, 25th
wedding anniversary Aug 9. Return Home Aug12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2ndinOct. Impact planned to be very damaging . . .Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
o'friend in embassy
case, it appears that CORSI's reference to a [who] plans 2 more dumps"
refers to Julian ASSANGE; the founder of Wikileaks, who resided in Ecuador's London
Embassy in2016. As discussed above, Guccifer released information hacked from the DCCC on
August 12,2016 (the date CORSI identified as when he would "return home.").
55. On or about August 16,2016, CORSI, emailed STONE a link to a piece CORSI
had written about STONE titled, "Trump Adviser: Wikileaks Plotting Email Dump to Derail
Hillary."
T4
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 18 of 35
56. On or about August 3I,2016, CORSI, using emailed STONE: "Did you get the
58. On or about October 7,2016, Wikileaks began releasing the Podesta emails.
59. On or about October 12,2016,the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE with the
subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that,
financially Podesta personally and the Clintons through the Clinton Foundation." CORSI
followed up several minutes later with another email to STONE titled, "Podesta talking points,"
with the text "sent a second time just to be sure you go it." STONE emailed CORSI, "Got them
60. On or about October 17,2016, CORSI emailed STONE with the subject, "Fwd:
ASSANGE...URGENT..." CORSI wrote, 'oFrom a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he'd dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
15
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 19 of 35
CORSI and STONE with the subject: "Turkey is a'GO'- FULL GREEN LIGHT."
wrote: "My good friend Husyein will be caking [sic] you he is in the Presidents office. The call
is a go. He has all the information you and DJT need for an article and another October surprise."
CORSI emailed back to the'l'arget Account and S'I'ON.tr: "And I have everything in progress
for a phone call tomorrow with DJT. I'm working with Roger Stone to accomplish this Roger
-
is copied above so he is up to date on status."
STONE and CORSI: "The message from President Erdogan has been sent to you for DJT has
just been sent wrapped in an article about baseball as header. If there is a response please let me
know."
emailed Stone. wrote, o'Well, we did it and now have an opportunity of a lifetime to
take the country back. God is good and we are well placed to steer things well. You deserve a lot
of credit and working with you and Jeri Corsi, who is with me now in London has been a great
joy."
(using the Target Account) with the subject line, "in case you need his
mail. . ......." Attached to the message was a scan of a business card for John Podesta. Several
hours later, , using the Target Account, replied to all recipients, "Ha... maybe he
65. I know from my training and experience that the term'ophishing" is used to refer
to the practice of sending emails purporting to be from a reputable party in order to induce
I6
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 20 of 35
individuals to reveal personal information, including passwords. Public reports indicate that
stated that "[it] was so good talking to you earlier in the week it has sustained me all week.
-
Thank you for your contribution to this campaign and to our great country. I look forward to
message read: "Pass this to Donald," and contained an article by CORSI about how Putin
to introduce an individual who was interested in working with the Trump Campaign.
69. On or about }r/ray 25,2016, emailed the Target Account about a book
he was "toying with the idea of writing." wrote back noting that, "Roger Stone is
getting me on the list to go to Cleveland [the site of the Republican National Convention]."
70. On or about August 30, 106 , using the Target Account, emailed
Steve BANNON to report that he had been writing ¿'op-eds" and strategy pieces, "laboring non
stop for the Trump campaign even though I am all the way over here in Oxford."
T7
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 21 of 35
wïote that he had been "in constant touch with the campaign, Roger Stone, and Jeri Corsi."
suggested a "clever idea for . . . the first debate." In his idea, then-candidate Trump
would present then-candidate Clinton with a "Writ of Indictment," for "undeniable crimes
against America, destruction of evidence in the form of mails, and theft of funds to your own
72. In my training and experience, I have learned that the Providers provide avatiety
of on-line services, including electronic mail ("email") and search engines (in the case of Google
and Yahoo), to the public. The Providers allow subscribers to obtain email accounts at the
domain names identified in the email addresses contained in Attachment A. Subscribers obtain
an account by registering with the Providers. During the registration process, the Providers ask
subscribers to provide basic personal information. Therefore, the computers of the Providers are
likely to contain stored electronic communications (including retrieved and unretrieved email)
for their subscribers and information concerning subscribers and their use of services, such as
account access information, email transaction information, and account application information.
In my training and experience, such information may constitute evidence of the crimes under
investigation because the information can be used to identify the account's user or users.
73. In my training and experience, email providers generally ask their subscribers to
provide certain personal identif ing information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
18
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 22 of 35
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
informatio \ may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (l.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage
of the account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access
75. In my training and experience, in some cases, email account users will
communÍcate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a result of the communications. In my training and experience, such information may constitute
I9
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 23 of 35
evidence of the crimes under investigation because the information can be used to identify the
76. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, wh¡t, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
infiormation stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the Internet Protocol
(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may fuither indicate the geographic location of the
account user at a particular time (e.g.,location information integrated into an image or video sent
via email). Last, stored electronic datamay provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit acúme (e.g.,
20
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 24 of 35
77. In my training and experience, information such as search history can help to
show the state of mind of an individual atthe time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
78. I anticipate executing this warrant under the Electronic Communications Privacy
.
Act, in particular 18 U.S.C. $$ 2703(a),2703(b)(l)(A) and 2703(c)(I)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
locate the items described in Section II of Attachment B. The items identified in Attachments A
will also be screened by reviewers not on the prosecution team to identify and filter out
privileged material.
CONCLUSION
regarding upcoming leaks. STONE then instructed CORSI to have (the user of the
Target Account) talk to ASSANGE. CORSI subsequently emailed STONE that'oword is friend
in embassy IASSANGE] plans 2 morc dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." Two releases, one from Guccifer and the other from
2T
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 25 of 35
Wikileaks, occuned at the times predicted by CORSI. CORSI later emailed STONE "talking
points" about Podesta. In January, (using the Target Account), STONE, and
CORSI received an email from an individual regarding Podesta, and wrote back,
using the Target Account, "Ha... maybe he wants to go phishing with us?"
80. Based on the forgoing, I request that the Court issue the proposed search warant.
81. Pursuant to 18 U.S.C. $ 2703(g), the presence of a law enforcement officer is not
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
Respectfully submitted,
E.
Special Agent
Federal Bureau of Investigation
22
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 26 of 35
ATTACHMENT A
This warrant applies to information associated with the following Google account:
1.
that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
23
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 27 of 35
ATTACHMENT B
Particular Things to be Seized
I. Files and Accounts to be produced by the Provider:
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. $ 2703(Ð, the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c All internet search data including all queries and location data;
24
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 28 of 35
a. Any and all records that relate in any way to the account described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of l8 U.S.C. $ 1030
(fraud and related activities in connection with computers), 52 U.S.C. $ 30121 (foreign
contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense against the United
States), and 18 U.S.C. g 2 (aiding and abetting) for the period from January 1,2015 to the
present, including:
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
25
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 29 of 35
Case: 1.17-mj-0o982
IN THE MATTER OF THE SEARCH OF
Assigned To : Howell, BerylA.
TNFORMATION ASSOCI-ATED WITH
Assign. Date : 1211912017
Description: Search and Seizure Warrant
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notiffing any person of the Warrant pursuant to 18 U.S.C. $ 2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further ãrder of the Court.
l. The Court has the inherent power to seal court fìlings when appropriate,
including the Warrant. lJnited States v. Hubbard,650 F.2d 293, 31 5- l6 (D.C. Cir. 1980) (citing
Nixonv. llarner Communications, 1nc.,435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warranf . See lI/ashington Post v. Robinson, 935 F .2d 282,287 -89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is'oa
"district court of the United States . . . that - has jurisdiction over the offense being investigated."
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 30 of 35
offense under investigation occurred within Washington, D.C. See 18 U.S.C. ç 3237.
3. Further, the Court has authority to require non-disclosure of the Warrant under l8
U.S.C. $ 2510(15), and/or "remote computing service," as defined in 18 U.S.C.ç 271l(2). The
Stored Communications Act ("SCA"), 18 U.S.C. çç2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(bXlXA) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 5 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
I Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
$ 2703(bX I )(B), but the Government does not seek to use the proposed Order for any legal
process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 31 of 35
18 U.S.C. $ 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [slc] fìnds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under $ 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under $ 2705(b), the court is required to
issue the non-disclosure order.
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
6. At the present time, law enforcement officers of the FBI are conducting an
investigation into violations related to 1S U.S.C. $ 1030 (fraud and related activities in connection
with computers), 52 U.S.C. $ 30121 (foreign contribution ban), l8 U.S.C. $ 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. $ 2 (aiding and abetting), arising out
of the conduct of Roger Stone, , and others. The investigation in ongoing, and
individuals associated with these offenses are not aware of the investigation. If they are made
awaro of the existence and contents of this search warrant, they may seek to delete additional
information contained in online platforms or otherwise destroy records related to the investigation.
3
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 32 of 35
7 . In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may aleft these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potentialtargets would
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potentia I targetcould quickly and easily destroy or encrypt digital
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notif, the Court and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. ,See l8 U.S.C.
$ 2705(bX2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 33 of 35
10. Based on prior dealings with Google the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and fufthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or
5
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 34 of 35
FTI.EÞ
DEC I g 20r
IN THE trNtrED STATES DISTRICT COURT ctsrk, u,s. Disrricr & Bankrunrcv
FOR THE DISTRICT oF COt.I IMRTA {;ourté for ttreÐistrietof Cotirünlia:
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application arrd affidavit in support thereof (collectively the "Warrant"),
headquartered at 1600 Amphitheatre Parkway, Mountain View, California not to disclose the
The Court finds that the United States has established that a compelling governmental
interest exists tojustiS the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS TIIEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 35 of 35
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until
J /f talf
2
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 1 of 38
See Attachment A.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search wi 11 reveal (identify the person or describe the property to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before March 28, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Be I A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U .S.C. § 3103a(b), I find that immediate notification may have an adverse result Iisted in 18 U .S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) •
until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
- -- - - - - - -- - - - Printed name and title
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 2 of 38
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Apple Accounts:
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
26
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 4 of 38
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, methods of connecting, and means and source of payment
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
27
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 5 of 38
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
,.
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address
28
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 6 of 38
books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g. All records and information regarding locations where the account was accessed,
regarding the account, including contacts with support services and records of actions taken; and
J. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
29
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 7 of 38
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
30
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 8 of 38
AO I 06 (Rev 04/10) App lication for a Search Warran t
See Attachment A.
located in the District of
Northern
- -- - - -- -
person or describe the property to be seized):
- - ----- , there is now concealed (identify the
-- - --California
See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A), and 2703(c)(1 )(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
ref evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
rJ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
&-4 /44~
!Aaron Zelinsky (ASC)
Date: 3/14/2018
Judge 's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 9 of 38
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
with offices located at llnfinite Loop, Cupertino, California 95014. The information to be
disclosed by Apple and searched by the government is described in the following paragraphs and
in Attachments A and B. This affidavit is made in support of an application for a search warrant.
2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of
investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349
(attempt and conspiracy to commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution
5. As set forth below, Roger STONE communicated directly via Twitter with
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used to disseminate hacked
information. STONE, using his Account, also emailed instructions to Jerome CORSI to
"Get to Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]"
CORSI emailed STONE back that it was "Time to let more than Podesta to be exposed" (before
any of Podesta's emails were leaked). After Podesta's emails were leaked, CORSI emailed
STONE "talking points" about Podesta. CORSI also emailed Stone to convey information "from
a very trusted source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures.
BANNON also sent text messages to STONE discussing potential upcoming leaks by
ASSANGE. The Target Accounts are STONE's iCloud accounts, which are registered to the
JURISDICTION
1
Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent
expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id. § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").
2
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 11 of 38
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
------- ----c-0mpetent-jur-isdieti0n?2-as-de-fined--by-l--8--{:1.,.S"G,--§--2'.7-l--l--,-/da-§~-2-70J(aj,fbj(--1-)E-A0,&-(-G-)E-I-)(Aj.
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 271 l(J)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 7.
PROBABLE CAUSE
7. On October 7, 2016, the U.S. Department of Homeland Security and Office of the
Russian activities and intentions during the 2016 presidential election. 2 In the report, the USIC
Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
2
"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 20 I 6, available at ttps://www.dhs.gov/news/2016/10/07 /joint-statement-department-
homeland-security-and-office-director-national.
3
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 12 of 38
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." 3 In the report, the USIC
10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
11. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
12. With respect to hacking activity, the USIC assessed: "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
3 "Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_2017 _ 0 l .pdf.
4
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 13 of 38
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Paiiy officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
13. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with j oumalists.
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
4. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
· hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
5
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 14 of 38
5. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
8. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
6
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 15 of 38
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
9. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
10. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
11. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
12. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
7
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 16 of 38
13. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
15. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of WikiLeaks' 10-year anniversary celebration - Stone told Info wars that his
inten,nediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
16. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
17. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
18. WikiLeaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 C-
SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
8
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 17 of 38
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who ' s traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
19. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
B. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
20. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
21. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
9
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 18 of 38
22. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
23. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!
The more you \"correct\" me the more people think you're lying. Your operation leaks like a
24. On November 9, 2016, one day after the presidential election, @wikileaks sent a
followed up with another message less than a minute later: "We are now more free to
communicate."
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issu~ an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
10
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 19 of 38
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
C. Roger Stone's Private Email and Text Messages Regarding WikiLeaks, Julian
Assange, Russia, and John Podesta
27. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's address,
following:
28. On July 25, 2016, STONE sent an email from his Account to Jerome
CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
tweeted about "Podesta's time in the barrel"), CORSI emailed the Account, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much
of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
11
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 20 of 38
[who] plans 2 more dumps" refers to Julian AS SAN GE, the founder of WikiLeaks, who resided
him a link to a poll indicated that Clinton lea Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night." subsequently
stated to investigators that, around the same time, STONE told him he had gone to London to
interviewed by the FBI and would have to divulge the conversation about meeting AS SAN GE.
STONE told he was joking and had not actually met Assange.
31. On or about August 16, 2016, CORSI emailed STONE a link to a piece CORSI
had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to Derail
Hillary."
32. On August 19, 2016, Bannon sent Stone a text message asking ifhe could talk
that morning. On August 20, 2016, Stone replied, "when can u talk???"
33. On or about August 31, 2016, CORSI emailed STONE: "Did you get the Podesta
34. On September 4, 2016, Stone texted Bannon that he was in New York City for a
12
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 21 of 38
37. On September 7, 2016, Bannon texted Stone asking him ifhe could "come by
38. On September 8, 2016, Stone and Bannon texted about arranging a me~ting in
New York.
39. On October 3, 2016, an associate of Stone emailed Stone and asked: "Assange -
what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he doesn't call me
back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled." The
associate forwarded the email to Bannon and wrote: "You should call Roger. See below. You
didn't get from me." Bannon wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the lJ.S. election process." AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next 10 weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
41. Later that day, BANNON emailed STONE, "What was that this morning???"
STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer is a big democrat."
13
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 22 of 38
42. When BANNON spoke with investigators during a voluntary proffer on February
14, 2018, he initially denied knowing whether the October 4, 2017 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
43. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.
44. On or about October 12, 2016, the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
email accounts, with a subject line "Podesta talking points." Attached to the email was a file
labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The "talking points"
included the statement that "Podesta is at the heart of a Russian-government money laundering
operation that benefits financially Podesta personally and the Clintons through the Clinton
Foundation." CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you go it." STONE emailed
CORSI back via the Account, "Got them and used them."
45. On or about October 17, 2016, CORSI emailed the STONE with the subject,
"Fwd: AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded
an email with the header information stripped out, showing only the body text. The email read,
"Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on
them if they move to extradite him. My guess is that he has a set of dead man files that include
Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out
to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins,
14
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 23 of 38
Assange can kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's
with the subject line, "in case you need his mail. ........ " Attached to the
message was a scan of a business card for John Podesta. Several hours later, replied
47. I know from my training and experience that the term "phishing" is used to refer
to the practice of sending emails purporting to be from a reputable party in order to induce
individuals to reveal personal information, including passwords. Public reports indicate that
48. As described above, STONE stated that on October 12, 2016 that he was in
contact with ASSANGE via a "a mutual friend who's traveled to London several times," and that
49. On March 13, 2018, the Washington Post published an article about STONE's
previous claims of contact with Assange. 4 The cited an anonymous source who claimed to have a
conversation with STONE in the "spring of 2016" where STONE indicated that he had learned
from "Julian Assange that his organization had obtained emails that would torment senior
Democrats such as John Podesta," and that the conversation occurred before it became publicly
known that hackers had obtained the "emails of Podesta and of the Democratic National
4
https://www.washingtonpost.com/politics/roger-stone-claimed-contact-with-wikileaks-founder-julian-assange-in-
20 l 6-according-to-two-associates/20 l 8/03/l 3/a263 f842-2604- l l e8-b79d-t3d93 I db7f68_ story.html?hpid=hp_rhp-
top-table-main_ stone-656am%3Ahomepage%2Fstory
15
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 24 of 38
Committee." The article also cited statements that STONE stated he had spoken to
ASSANGE. The article cited STONE denying any advance notice about the hacked emails or
any "contact with Assange." The Article stated that STONE "said he only recalled having one
conversation with anyone in which he alluded to meeting the WikiLeaks founder - a comment he
said he made as a joke to Nunberg." STONE was quoted as stating, "The allegation I met with
50. The article also stated that STONE told the House Intelligence Committee in
September 2017 that his August 21 tweet was meant as a prediction that Podesta's business
opportunities would come under scrutiny after Paul MANAFORT was forced to resign amid
allegations about his work for a pro-Russian party in Ukraine. MANAFORT resigned from the
Campaign on or about August 19, 2016. CORSI's email to STONE about WikiLeaks and "Time
to let more than Podesta to be exposed as in bed w_enemy if they are not ready to drop HRC,"
51. On November 21, 2017, Chief Judge Beryl A. Howell signed an order pursuant to
18 U.S.C. §2703(d) for header information related to the Target Accounts. Pursuant to that
account was in use as of the time of the service of the Order According to Apple, the system has
16
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 25 of 38
been set to a "Full iCloud" backup. I know from my training and experience that a full iCloud
backup can include other databases and messaging features, including third party messaging
programs. Often individuals are unaware that the information is being stored in their iCloud, and
therefore the iCloud may contain additional communications not contained in the standard mail
his iCloud account, including an indication that iCloud storage was "full." STONE also used
in March, 201 7.
associated with STONE. Target Account 2 is registered to "Roger Stone," and according to
information provided by Apple pursuant to the§ 2703(d) order, contains a full iCloud backup as
54. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htlp://images.applc.com/ privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://suppo11.apple.co111/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/;
"iCloud: iCloud storage and backup overview," available at https://suppo1i.apple.com/kb/PT-l l 25 L9; and "iOS
Security," available at lmp://images.app le.com/privacy/docs/iO, Security Guide.pdf.
17
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 26 of 38
55. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the serv,ices include email, instant messaging, and file storage:
a. Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs enables iCloud to be used
to synchronize webpages opened in the Safari web browsers on all of the user's Apple devices.
iWorks Apps, a suite of productivity apps (Pages, Numbers, and Keynote), enables iCloud to be
used to create, store, and share documents, spreadsheets, and presentations. iCloud Keychain
18
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 27 of 38
enables a user to keep website usemame and passwords, credit card information, and Wi-Fi
track the location of, display a message on, and wipe the contents of those devices.
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
h. App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and dow11loaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased .through iTunes Store on iOS devices and on desktop and laptop computers running
56. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
57. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
19
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 28 of 38
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
58. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, and "mail logs" for activity over an Apple-provided email
20
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 29 of 38
account. Records relating to the use of the Find My iPhone service, including connection logs
and requests to remotely lock or erase a device, are also maintained by Apple.
60. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, arid information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
61. Apple provides users with five gigabytes of free electronic space on iCloud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWorks and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
21
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 30 of 38
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, and other data. Records and data associated with third-party apps
may also be stored on iCioud; for example, the iOS app for WhatsApp, an instant messaging
service, can be configured to regularly back up a user' s instant messages on iCloud. Some of
this data is stored on Apple's servers in an encrypted form but can nonetheless be decrypted by
Apple.
62. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
63. The stored communications and files connected to an Apple ID may provide
direct evidence of the offenses under investigation. For example, stored iMessage
communications, voicemails, and emails may contain conversations with foreign government
officials similar to those described above in PAPADOPOULOS 's Linkedin and Gmail accounts.
Based on my training and experience, instant messages, emails, voicemails, photos, videos, and
documents are often created and used in furtherance of criminal activity, including to
64. In addition, the user's account activity, logs, stored electronic communications,
and other data retained by Apple can indicate who has used or controlled the account. This "user
22
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 31 of 38
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, subscriber information, email and messaging logs,
documents, and photos and videos (and the data associated with the foregoing, such as geo-
location, date and time) may be evidence of who used or controlled the account at a relevant
time. As an example, because every device has unique hardware and software identifiers, and
because every device that connects to the Internet must use an IP address, IP address and device
identifier information can help to identify which computers or other devices were used to access
the account. Such information also allows investigators to understand the geographic and
chronological context of access, use, and events relating to the crime under investigation.
65. Account activity may also provide relevant insight into the account owner's state
of mind as it relates to the offenses under investigation. For example, information on the account
may indicate the owner's motive and intent to commit a crime (e.g., information indicating a
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort
additional evidence. For example, the identification of apps downloaded from App Store and
iTunes Store may reveal services used in furtherance of the crimes under investigation or
services used to communicate with co-conspirators. For instance, ifthere are secured and
encrypted communication applications downloaded from the App Store, that can show an
attempt to hide information from investigators. In addition, emails, instant messages, Internet
activity, documents, and contact and calendar information can lead to the identification of co-
23
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 32 of 38
67. Therefore, Apple's servers are likely to contain stored electronic communications
and information concerning subscribers and their use of Apple's services. In my training and
experience, such information may constitute evidence of the crimes under investigation including
CONCLUSION
regarding upcoming leaks, and CORSI emailed Stone on the Account that it was "Time
to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC."
STONE also texted and emailed BANNON about potential forthcoming leaks from ASSANGE
and WikiLeaks. There is therefore probable cause to believe that evidence of the DNC hack and
the hacking of other emails associated with the 2016 election will be found in the information
69. Based on the forgoing, I request that the Court issue the proposed search warrant.
70. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
24
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 33 of 38
71. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
, ·t. 4 - d/{,,. . .
• ----
li-s-Heide
Special Agent
Federal Bureau oflnvestigation
~;/~
The Honorabl Beryl A. Howell
Chief United States District Judge
25
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 34 of 38
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Apple Accounts:
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
26
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 35 of 38
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, methods of connecting, and means and source of payment
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
27
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 36 of 38
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
,.
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address
28
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 37 of 38
books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g. All records and information regarding locations where the account was accessed,
regarding the account, including contacts with support services and records of actions taken; and
J. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
29
Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 38 of 38
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
30
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 1 of 35
See Attachment A.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before May 18, 2018 (not to exceed 14 days)
';$ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the awropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 2 of 35
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Google LLC, an electronic communication and/or remote computing services with
headquarters in Mountain View, California, not to disclose the existence or contents of the Warrant
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Page 1 of2
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 4 of 35
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year unless
Date
41/Y>lf
Page 2 of2
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 5 of 35
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A.
located in the Northern District of _____C,-_a-,.l"'if.=o,..rn~ia..__ _ _ , there is now concealed (identijj, the
person or describe the property to be seized):
See Attachment B.
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
~ evidence of a crime;
ief contraband, fruits of crime, or other items illegally possessed;
r'lf property designed for use, intended for use, or used in committing a crime;
D a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. § 2 aiding and abetting
· et al. see attached affidavit
Reviewed by AUSA/SAUSA:
~44 Appbcant's signature
•Aaron Zelinsky (Special Counsel's Office) Andrew Mitchell, Supervisory Special Agent, FBI
Printed name and title
Date:
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 6 of 35
AFFIDAVIT IN SUPPORT OF AN
APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, having been first duly sworn, hereby depose and state as follows:
the "Target Account 1"), that is stored at premises owned, maintained, controlled or operated by
Attachments A and B. This affidavit is made in support of an application for a search warrant
the government copies of the information (including the content of communications) further
government-authorized persons will review that information to locate the items described in
Attachment B.
2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 7 of 35
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision ofa felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a
false statement); 18 U.S.C. §1651 (perjury); 18 U.S.C. § 1030 (unauthorized access ofa
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"). 1
5. As set forth below, in May 2016, Jerome CORSI provided contact information for
needed to meet with then-candidate Trump "alone." In August 2016, told STONE
that there was an "OCTOBER SURPRISE COMING" and that Trump, "[i]s going to be defeated
unless we intervene. We have critical intel." In that same time period, STONE communicated
directly via Twitter with WikiLeaks, Julian AS SANGE, and Guccifer 2.0. On July 25, 2016,
STONE emailed instructions to Jerome CORSI to "Get to Assange" in person at the Ecuadorian
Embassy and "get pending WikiLeaks emails[.]" On August 2, 2016, CORSI emailed STONE
back that,"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging." On August 20, 2016, CORSI told STONE that they
1
Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent
expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").
2
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 8 of 35
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a comt of
competent jurisdiction" as defined by l8 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisc\iction over the offense being investigated." 18 U.S.C.
§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 8.
PROBABLE CAUSE
7. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 20 l 6 presidential election. In the report, the USIC
Government directed the recent compromises of e mails from US persons and institutions,
including from US poiitical organizations. The recent disclosures of alleged hacked e mails on
sites like DC Leaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
3
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 9 of 35
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the repoti, the USIC
10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
11. The USIC also described, at a high level, some of the techniques that the Russian
government employed during its interference. The USIC summarized the efforts as a "Russian
12. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
4
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 10 of 35
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
13. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Gucci fer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
14. Gucci fer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account
@RogerJStoneJr.
16. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
17. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
5
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 11 of 35
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
.· October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
20. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 12 of 35
21. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
22. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
23. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
24. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work ofa '"mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
25. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
7
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 13 of 35
27. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
28. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
29. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
30. WikiLeaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone'~ August 21, 2016 C-
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
8
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 14 of 35
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
31. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email·(speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
C. · Roger Stone's Private Twitter Direct Messages with WikiLeaks and Jnlian
Assange.
32. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
33. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
9
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 15 of 35
34. On October 16, 2016, @RogerJStoneJr sent a direct message to@wikileaks: "Ha!
The more you \"correct\" me the more people think you're lying. Your operation leaks like a
35. On November 9, 2016, one day after the presidential election, @wikileaks sent a
followed up with another message less than a minute later: "We are now more free to
communicate."
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
JO
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 16 of 35
39. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's address,
warrant for STONE's iCloud account. On April 23, 2018, Chief Judge Beryl A. Howell signed
an order pursuant to 18 U.S.C. §2703(d) for the Target Accounts. Information recovered
II
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 17 of 35
and CORSI exchanged two emails. On or about April 18, 2016, CORSI sent
an email.
three times and sent him two responses. On or about May 2, 2017,
44. On or about May 17, 2016, STONE emailed Jerome CORSI, "send me e-
wrote that he would have to move "our meeting to Wednesday. I am uncomfortable meeting
without Jerry." As described further below, it appears that "Jerry" is Jerome CORSI. STONE
emailed back, "RS[,] Confirming dinner Wednesday at 7PM at Club 21, JC included."
46. On or about that same day, May 17, 2016, n Target Account 1,
emailed CORSI.
4
The period in a email account is not read as a character. Therefore, and
are the same account.
12
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 18 of 35
48. On or about May 17, 2016, messaged STONE, "Hi Roger, I hope
all is well. Our dinner tonight for 7PM is confirmed. I arrive at 4PM. Please suggest a good
restaurant that has privacy. Thank you. See you soon, " STONE responded,
'See e-mail."
49. On or about May 19, 2016, messaged STONE, "Hi Roger, It Was
Great Seeing You Again Last Night At Dinner. Did You Talk To Trump This Morning? Any
News? Thank You. Best, ." STONE responded, "Contact made - interrupted
then-candidate Trump.
CabinetMinister in NYC Sat. June 25. Available for DJT meeting. " According
portfolio in the cabinet dealing with issues concerning defense and foreign affairs.
51. On or about June 25, 2016, messaged Stone, "Roger, Minister left.
Sends greetings from PM. 5 When am I meeting DJT? Should I stay or leave Sunday as planned?
turn out to have been poisoned. Completely out of action for 3 days-apologize to Minister for
me. I would not leave as we hope to schedule the meeting mon or tues."
5 Based on statements here and below, I belie-Ve "PM" refers to the" Prime Minister.
13
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 19 of 35
54. On or about Jun 29, 2016, STONE responded, "Monday meeting collapsed after
DJT cleared his schedule to deal with the money crisis. lam waiting the new schedule. Will try
for Thursday."
will plan to be back in NYC on July 5th for the meeting with DJT on the 6'h at l pm.THAY YOU
the meeting with DJ Trump at 1PM tomorrow. Let's you and I meet at 10.30AM at the St. Regis
Waiting For You Thank You. " STONE wrote back, " - I am down
with a nasty cold. and too ill to travel- I have a1rnnged for Jerri to take u in at I rather than lose
the appointment- please connect with Jerri - Let me know how the meeting goes .DJT
expecting u. R" Based on STONE's contacts and emails described above, investigators believe
59. wrote back, "Thank U Very Much[.] I Have To Meet Trump Alone
After A Brief Introduction by Jerry Thanks Roger." STONE wrote back, "As long as u get the
meeting-lam very sorry I cannot !jtlend- have a high fever and no voice."
lt<:1
60. On July 8, 2oy
-z.o.1~
essaged STONE, "Hi Roger. Have you
rescheduled the meeting with DJT? The PM is putting pressure for a quick decision. Thank you
14
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 20 of 35
61. On or about July 8, 2016, STONE wrote back, "T not in NYC again before the
convention. I have pneumonia and may be hospitalized later today. I can get this back on track
post convention when I can attend. Sorry about the fiasco last week, however you can't just bring
62. On or about July 25, 2016, STONE sent an email from his Account to
Jerome CORSI with the subject line, "Get to Assange." The body of the message read: "Get to
Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with
Foundation, allegedly."
ROGER, I HOPE YOU ARE WELL. HAVE YOU SET UP A NEW MEETING WITH
YOU.
64. On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call
me MON." The body of the email read: " .should see Assange[.] should find
Bernie [S]anders brother who called Bill a Rapist- turn him for Trump[.] should find
tweeted about "Podesta's time in the barrel"), CORSI emailed the STONE, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very
damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
15
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 21 of 35
reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian ASSANGE, the
we have one last shot before moving on. Can you deliver? History will not forgive us. TRUMP
from Jerusalem. Any progress? He is going to be defoated unless we intervene. We have critical
intell. The key is in your hands! Back in the US next week. How is your Pneumonia? Thank you.
back, "Thank You." No additional messages appear in STONE's iCloud between STONE and
68. As described above, on October 7, 2016, WikiLeaks began releasing the emails
70. On October 30, 2016, messaged S~ONE: "Roger, you are doing a
great job !!! I am in NY-met with DJT and helping. Victory is in sight. HK says hello. Thanks,
European country ready to release secret tapes to DESTROY objective. Can we meet ASAP? 4
star General will join. " STONE responded, "Yes let's talk
16
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 22 of 35
STONE responded, "Take care of yourself." wrote back, "Tnaks Xou RGer. Blury
Virson." STONE replied, "You can't die until after we elect Donald."
Permanent Select Intelligence Committee (HPSCI) on September 26, 2017. STONE released his
prepared remarks to the media. In his remarks, Stone stated that he had learned Assange was in
possession of the DNC emails via Twitter, and that he asked a "journalist" to "independently
confirm this report." Stone stated his "intermediary" had "assured me that WikiLeaks would
release this information in October and continued to assure me of this throughout the balance of
August and all of September." Stone denied knowledge in advance of Podesta's emails being
74. On or about November 24, 2017, Credico .texted Stone, "I told you to watch his
Tweets in October not before that I knew nothing about the DNC stuff. I just followed his
Tweets." Stone responded, "U never said anything about the DNC but it was August." Credico
replied, "It was not August because I didn't interview him or meet him until August 261h."
75. Credico and Stone continued to exchange messages, and on December 1, 2017,
Credico wrote: "I don't know why you had to lie and say you had a back Channel now I had to
give all ofmy forensic evidence to the FBI today what a headache. You could have just told him
the truth that you didn't have a back channel they now know that I was not in London until
17
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 23 of 35
September of this year. You had no back-channel and you could have just told the truth. You
want me to cover you for perjury now." 6 Stone responded, "What the fuck is your problem?
Neither ofus has done anything wrong or illegal. You got the best press of your life and you can
get away with asserting for 5th amendment rights ifu don't want talk about[.] And if you turned
over anything to the FBI you're a fool." Credico replied, "You open yourself up to six counts of
perjury. But I'm sure that wasn't sworn testimony so you're probably clear ... You should go
back in a minute your testimony and tell them the truth ... You need to amend your testimony
before I testify on the 15 1h." Stone wrote, "If you testify you're a fool. Because of tromp [sic] I
could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee
you you are the one who gets·indicted for perjury if you're stupid enough to testify." Stone and
Credico continued to correspond, and according to publicly available news reports, on December
13, 2017, Credi co asse1ted his Fifth Amendment right not to testify before the HPSCI.
76. On January 25, 2018, Credico texted Stone, "You lied to the house Intel
committee. But you'll get off because you're friends with Trump so don't worry. I have. all the
forensic evidence. I was not a ba[ck] Channel and I have all those emails from September of
77. Google provides numerous free services to the users with a Google profile. Some
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user's Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
6 Contrary to his statement, Credico had not provided any information tot.he FBI.
18
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 24 of 35
storage, file sharing, and collaborative editing. Google+ Photos (fo1merly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view and share videos. Google also retains a record of searches conducted by the user, as
well as location data for the use of some of the services described above. All of these services
CONCLUSION
78. Based on the forgoing, I request that the Court issue the proposed search warrant.
19
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 25 of 35
79. I further request that the Court order that all papers in support of this application,
including the application, affidavit and search warrant, be sealed until further order of the Court.
These documents discuss an ongoing criminal investigation that is neither public nor known to
all of the targets of the investigation. Accordingly, there is good cause to seal these documents
because their premature disclosure may give targets an opportunity to flee/continue flight from
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates,
~i~
The Honorak~~l A. Howell
Chief United States District Judge
20
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 26 of 35
ATTACHMENT A
Property to Be Searched
by Google, Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View,
CA 94043.
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 27 of 35
ATTACHMENT B
ATTACHMENT B
Particular Things to be Seized
I. Files and Accounts to be produced by Google, Inc. betwceu January 1, 2016 and
the Present.
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and destination
e-mails sent addresses associated with each e-mail, the date and time at which each e-mail was
sent, and the size and length of each e-mail; 1
b. All existing printouts from original storage of all of the electronic mail described
above in Section I.A. above;
c. All internet search data including all queries and location data;
g. All records indicating the services available to subscribers of the electronic mail
address described above in Section I.A.;
I This Search warrant applies on to email sent, received, or drafted on or after May 26, 20 I 7.
2
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 28 of 35
members, contents of posts, comments, and photos, to include date and timestamp;
J. YouTube subscriber information, private videos and files, private messages, and
comments;
le Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l. Google Talk and Google Hangouts conversation logs associated with the account.
3
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 29 of 35
a. Any and all records that relate in any way to the account described in Attachment
A which is evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a false statement); 18 U.S.C. §1651
(pe1jury); 18 U.S.C. § 1030 (unauthorized access ofa protected computer); 18 U.S.C. § 1343
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),, and 52 U.S.C.
§ 30121 (foreign contribution ban) from Jan l, 2015 to the present, including:
All records, information, documents or tangible materials that relate in any way to
communications with foreign government officials or agents of a foreign power,
or discussions with others regarding those actions, or plans or attempts at
undertaking such actions:
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
4
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 30 of 35
The United States ofAmerica, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to non-disclosure,
the proposed Order would direct Google LLC, an electronic communication and/or remote
computing services provider with headquarters in Mountain View, California, not to notify any
other person (except attorneys for Google for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year unless otherwise ordered of the Court.
I. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991 ).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
Page 1 of6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 31 of 35
"district court of the United States ... that- has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in fmtherance of the offense
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
1
Section 2705(b) contains additional requirements for legal process obtained pursuant to
18 U.S.C. § 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any
legal process under that provision.
Page 2 of6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 32 of 35
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an ~rder if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in -
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sicJfinds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Warrant for a period of one year unless othe1wise
6. At the present time, law enforcement officers of the FBI are conducting an
investigation into violations related to 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory
Page 3 of6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 33 of 35
after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C.
§ 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C.
§ 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) arising out of the conduct of various unknown persons that operated and
controlled the subject accounts. It does not appear that these individuals are currently aware of the
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year unless otherwise ordered by the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, ap.d its disclosure may alert these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potential target could quickly and easily destroy or encrypt digital
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that _the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should circumstances
Page 4 of6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 34 of 35
change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed,
the Government will notify the Comt and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the Warrant
will seriously jeopardize the investigation, including by giving the targets an opportunity to flee
from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2}-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
Page 5 of6
Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 35 of 35
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year
Respectfully submitted,
By:-~~~""'\,:.-_-t_-~~-···-·~/-_-_···--~-----
. Ktle Freeny ··
Specia:l Counsel's G
Office (202) 616-0800
Page 6 of6
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 1 of 23
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 2 of 23
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 3 of 23
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR SEARCH WARRANTS
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
1. I make this affidavit in support of an application for search and seizure warrants
under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of
Attachment A), and any baggage associated with him (described further in that warrant's
Attachment A), and the seizure of the electronic devices and media described in Attachment B
(the Target Devices). I anticipate this search will be executed after lands at Logan
seizure of the devices only; the Government will seek a warrant to search any seized devices at a
2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of
investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 4 of 23
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that ROGER STONE, JEROME CORSI and others have
committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C.
§ 1349 (attempt and conspiracy to commit wire fraud) (the "Subject Offenses").
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because, as described
further below, it is anticipated that and his baggage will be located in the District of
Massachusetts on
SUMMARY
6. As set forth below, (the Target Person) was in contact with Roger
STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have
obtained advance lrnowledge of the release by WikiLeaks of illegally hacked emails for the
benefit of the presidential campaign of Donald J. Trump (the "Campaign"). In July 2016,
STONE instructed CORSI to have talk with Julian AS SANGE, the founder of
information.
2
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 5 of 23
7. More specifically, on or about July 25, 2016, STONE emailed CORSI to "Get to
Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or
about July 31, 2016, STONE instructed CORSI to have "see ASSANGE." At the
time, lived in London, where Assange was located at the Ecuadorian Embassy. On
or about August 2, 2016, CORSI told STONE that the "word is friend in embassy [ASSANGE]
plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned to be very
damaging .... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC." Information disclosures subsequently occurred on or about the times CORSI predicted.
articles regarding AS SANGE and alleged Russian involvement in the election. On or about
November 13, 2016, emailed STONE to congratulate him on "tak[ing] the country
back," and stating, "You deserve a lot of credit and working with you and Jeri Corsi, who is with
me now in London has been a great joy." On or about January 7, 2017, emailed
STONE and CORSI to joke about John Podesta going "phishing." As stated below, I know from
my training and experience that the term "phishing" is used to refer to the practice of sending
emails purporting to be from a reputable party in order to trick individuals to reveal to the sender
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the Campaign until August
2015. Although STONE had no official relationship with the Campaign thereafter, STONE
3
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 6 of 23
maintained his support for Trump and continued to make media appearances in support of the
Campaign. As described further below, STONE also maintained contact with individuals
employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy
information, serves as the "Washington Bureau Chief for Infowars.com." According to publicly-
available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for the
website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of books
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
4
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 7 of 23
12. On October 7, 2016, the U.S. Department of Homeland Security and Office of the
Russian activities and intentions during the 2016 presidential election. 1 In the report, the USIC
13. "The U.S. Intelligence Community (USIC) is confident that the Russian
Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities."
assessment of Russian activities and intentions during the 2016 presidential election entitled,
1
"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-department-
homeland-security-and-office-director-national.
5
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 8 of 23
"Assessing Russian Activities and Intentions in Recent US Elections."2 In the report, the USIC
15. "[] Russian President Vladimir Putin ordered an influence campaign in 2016
aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
16. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
17. With respect to hacking activity, the USIC assessed: "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
2
"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_ 2017_ 0 l .pdf.
6
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 9 of 23
18. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with journalists.
actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was
fired in August 2015. Although STONE had no official relationship with the Campaign
thereafter, STONE maintained his support for Trump and continued to make media appearances
WikiLeaks and its release ofDNC-related emails. STONE has also stated that he was in contact
22. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June
23. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
7
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 10 of 23
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." STONE wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." STONE embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." STONE also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard to
the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be a number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with Assange, he had a close
26. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJSTONEJr thanks
that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal
cellphone numbers and email addresses from the files of the Democratic Congressional
8
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 11 of 23
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
28. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJSTONEJr paying
you back." Guccifer also sent a private message to @RogerJSTONEJr stating "i'm pleased to say
u r great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
29. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S.
30. On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
31. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly
soon. And that of course will answer the question of exactly what was erased on that email
server."
9
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 12 of 23
33. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, STONE
34. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
35. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
36. WikiLeaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 2016, John Podesta-referring back to STONE's August 21, 2016
C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the Miami Herald, STONE responded: "I have never met or spoken
with Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
10
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 13 of 23
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
37. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
D. Roger STONE's Private Twitter Direct Messages with WikiLeaks and Julian
Assange.
38. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
39. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account ofWikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
11
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 14 of 23
40. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you/'
"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
42. On November 9, 2016, one day after the presidential election, @wikileaks sent a
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJSTONEJr directly
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
12
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 15 of 23
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
45. On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of
or about October 17, 2017 Chief Judge Howell issued a warrant for STONE's address,
46. On or about May 23, 2016, emailed STONE with the subject,
"Trump Campaign," to offer his assistance to the Campaign. wrote that he was "on
to the notorious Oxford case already!" He also stated that he was "available, literally, as needed,
to contribute in ways the campaign sees fit. I'd like to go to Cleveland and pitch in, raise money
and work for you. Can you use me?" Cleveland, Ohio was the location of the 2016 Republican
48. On or about June 20, 2016, emailed STONE and MANFORT, asking
to "know immediately how I can help" the Campaign. also wrote that his "research
on Rhodes House" was nearing completion. Rhodes House is the headquarters of the Rhodes
13
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 16 of 23
Trust, which provides scholarships to Oxford University, and the "Rhodes House" research
appears to be a reference to STONE' s previous tweet on or about October 13, 2015 that, "In
1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old ."
"Rhodes House" research seems to be the same as the "notorious Oxford case" referenced by
above.
49. On or about July 7, 2016, emailed STONE that he had "my tickets to
50. On or about July 25, 2016, (approximately three days after WikiLeaks began
releasing emails hacked from the DNC), , a commentator who had publicly accused
the Clinton Foundation of fraud, emailed STONE with the subject line, "You need to get to
Assange." The body of the message read: "At Ecuadorian Embassy in London and get the
minutes later STONE called CORSI and they spoke for 26 minutes.
52. Less than two hours after the phone call to CORSI, STONE emailed CORSI with
the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with Foundation,
allegedly." It appears that STONE cut and pasted the email from Ortel to CORSI.
53. On or abou~ July 27, 2016, then-candidate Donald Trump stated in a press
conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if
14
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 17 of 23
54. On or about July 28, 2016, Roger STONE called Richard GATES (then the
55. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the
Campaign) called STONE. They spoke for approximately one hour and seven minutes. The
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven
minutes is the longest call (by almost a half-hour) that took place between STONE and
56. On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call
me MON." The body of the email read: " should see Assange[.] should find
Bernie sanders brother who called Bill a Rapist- turn him for Trump[.] should find
57. On or about August 2, 2016, CORSI emailed STONE: "With family, 25th
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging ... Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
case, it appears that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
refers to AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016. On or about August 12, 2016, Guccifer publicly released information hacked from the
15
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 18 of 23
59. On or about August 13, 2016, emailed CORSI a news article titled,
60. On or about August 16, 2016, emailed CORSI an email with the
subject line, "Vladimir Putin Has Already Won Our Election." The body of email
contained two words: the word "VENONA" and the word "Observer." According to publicly
available information, the "Venona Project" was a top-secret U.S. intelligence effort to gather
and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13,
2016, the Observer had published an article titled, "Vladimir Putin Has Already Won Our
Election" (the subject of the email). The subtitle of the article stated: "It's time to face facts:
Kremlin spies and hackers are undermining American politics." The article further discussed
how, "WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined
DNC emails that were stolen by Russian intelligence." The article also stated that the "Kremlin is
61. On or about August 30, 2016, emailed Steve Bannon, who had
become chief executive of the Campaign when MANAFORT left the Campaign on or about
August 19, 2016, with STONE and CORSI cc'd. wrote offering his assistance and
stating he had been "labouring non stop for the Trump campaign- even tho[u]gh I am all the
way over here in Oxford.... I have been in constant touch with the campaign, Roger Stone and
Jeri Corsi."
62. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.
16
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 19 of 23
wrote, "Well, we did it and now have an opportunity of a lifetime to take the country back. God
is good and we are well placed to steer things well. You deserve a lot of credit and working with
you and Jeri Corsi, who is with me now in London has been a great joy."
STONE, CORSI, and with the subject line, "in case you need his mail. ........ "
Attached to the message was a scan of a business card for John Podesta. Several hours later,
65. I know from my training and experience that the term "phishing" is used to refer
to the practice of sending emails purporting to be from a reputable party in order to trick
individuals to reveal to the sender personal information, including passwords. Public reports
Gmail account. The U.K. email address was also listed in messages sent as a means
of reaching him. A publicly-available database lists the U.K. email address as belonging to
The U.K. email address is housed outside the United States, and investigators
anticipate it may take substantial time to retrieve the messages on the account via a potential
treaty request. In addition, it is possible that emails may have been deleted or no longer
maintained. I know from my training and experienced that users often download and store emails
on their phones, tablets, and laptops, such as the Target Devices. Even if information has been
deleted by the user, the Government may be able to employ forensic tools to recover information
17
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 20 of 23
from his devices. In addition, as described further below, the Target Devices may include a
variety of other stored communications, including voicemail, text message, and other third party
messaging systems which may have used to communicate with CORSI, STONE,
67. I also have probable cause to believe that the person and baggage to be searched
contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above,
I know from my training and experience that individuals often carry electronic devices and
storage media of the type described in Attachment B with them when they travel both on their
persons and in their baggage. These devices and media include but are not limited to cellular
phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives.
69. From my training and experience, I am also aware that personal computer systems
are generally capable of creating, receiving, and otherwise processing computer files such as e-
above, uses computer systems to communicate with CORSI and STONE regarding
WikiLeaks.
enforcement officers, I know that many smartphones (which are included in Attachment B) can
now function essentially as small computers. Smartphones have capabilities that include serving
18
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 21 of 23
as a wireless telephone, digital camera, portable media player, GPS navigation device, sending
and receiving text messages and e-mails, and storing a vast range and amount of electronic data.
Examining data stored on devices of this type can uncover, among other things, evidence that
other agents, I know that computer files or remnants of such files can be recovered months or
years after they have been written, downloaded, saved, deleted, or viewed locally or over the
• Electronic files that have been downloaded to a storage medium can be stored for
years at little or no cost. Furthermore, when users replace their computers, they
can easily transfer the data from their old computer to their new computer.
• Even after files have been deleted, they can be recovered months or years later
computer, the data contained in the file does not actually disappear; rather, that
data remains on the storage medium until it is overwritten by new data, which
might not occur for long periods of time. In addition, a computer's operating
system may also keep a record of deleted data in a "swap" or "recovery" file.
computers' internal hard drives, contain electronic evidence of how the computer
has been used, what it has been used for, and who has used it. This evidence can
take the form of operating system configurations, artifacts from operating system
or application operation, file system data structures, and virtual memory "swap"
19
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 22 of 23
users typically do not erase or delete this evidence because special software is
• Similarly, files that have been viewed over the Internet are sometimes
browser often maintains a fixed amount of hard drive space devoted to these files,
and the files are overwritten only as they are replaced with more recently viewed
CONCLUSION
72. Based on the forgoing, there is probable cause to believe that one or more people
have violated the statutes specified above and that electronic devices and media containing
evidence, fruits, and instrumentalities of those crimes, are contained on the person of
further in that warrant's Attachment A), and for the seizure of the electronic devices and media
73. In addition, I request that the search warrants authorize searches and seizures
I am aware that flight departure and arrival times can vary widely from those announced
because of adverse weather or other delays throughout the airline transportation system. If
because of a flight delay flight landed at 10:01 PM, a warrant without the
20
Case 1:19-mc-00029-CRC Document 29-8 Filed 04/28/20 Page 23 of 23
requested authorization could not be executed for another 8 hours, requiring me to either obtain a
new warrant or to detain and his baggage until 6 AM the next morning. The
requested authorization will allow the searches and seizures to progress as efficiently as possible,
with minimal delay to and any other person with whom he is travelling.
74. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Curtis Heide
Special Agent
Federal Bureau of Investigation
21
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 1 of 58
See Attachment C.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identijj1 the person or describe the property to be seized):
See Attachment D.
YOU ARE COMMANDED to execute this warrant on or before July 26, 2018 ___ (,10110 exceed 14 days)
oif in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
propeiiy was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to ..... Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriale box)
0 for days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued: 1j'l 2;/A?/i'ef f':{J-//J ~-~ 'Judge's signature
City and state: _W_a_sh_i_n~g_to_n_,_D_C_ _ _ _ _ _ __ Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
/
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 2 of 58
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
E.x:ecuting officer's signature
ATTACHMENT C
Property to be Searched
This warrant applies to infonnation associated with the following Apple account:
1.
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
37
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 4 of 58
ATACHMENTD
To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such infmmation is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
38
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 5 of 58
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
39
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 6 of 58
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fiuits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian
Assange, or any individual associated with the Trump Campaign;
g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
40
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 7 of 58
FILED
JUL 12 2018
IN THE UNITED STATES DISTRICT COURT Clerk, us Dis .
Courts ta'r ihe 0\~ct t & Bankruptcy
FOR THE DISTRICT OF COLUMBIA net ot Columbia
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Apple, Inc. ("Apple") an electronic communication and/or remote computing
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opp01tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 8 of 58
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
2
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 9 of 58
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment C.
Northern , there is now concealed (identify the
located in the ===--- District of ---------'===~--
California
person or describe the property Lo be seized):
See Attachment D.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1){A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
ref evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
City and state: Washingto'n, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 10 of 58
FILED
IN THE UNITED STATES DISTRICT COURT JUL 12 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy
Courts tor the District of Columbia
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH Case No. J 'i- SC - c.. '-Id(
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. .Before the submission of this warrant application, the Special Counsel's Office
complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
5. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
protected computer).
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to
Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
2
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 12 of 58
ASSANGE. On or about August2, 2016, CORSI responded to STONE that the "word is friend !
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthen-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
9. Furthermore, on the day of the Access Hollywood video disclosure, there were
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
3
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 13 of 58
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.
4
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 14 of 58
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staffreporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of20I6 regarding forthcoming disclosures of
5
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 15 of 58
14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
15. The U.S. Intelligence Community (USIC) is confident that the Russian
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
17. "Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
18. The USIC also described, at a high level, some of the techniques that the Russian
6
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 16 of 58
government employed during its interference. The USIC summarized the efforts as a "Russian
19. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
20. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US .victim data obtained in cyber operations publicly and in exclusives to media outlets."
21. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
22. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
7
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 17 of 58
23. For example, in or around September 2016, these individuals successfully gained ·
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
24. On or about September 4, 2016, individuals associated with the GRU stole the
· emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
26. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
27. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
8
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 18 of 58
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
30. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
31. On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
9
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 19 of 58
32. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
33. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34. On August 21, 2016, using @RogerJStoneJR, Stone tweeted stating: "Trust me, it
will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a '"mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
35. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fair!y soon. And that of course will answer the question as to what exactly what was erased on
37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
10
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 20 of 58
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of WikiLeaks' I 0-year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
38. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
40. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, John Podesta- referring back to Stone's August
21, 2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [StoneJ had advanced warning [of the release of his
emailsJ and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [AssangeJ may have passed this information on to
[Stone]." Connnenting to the NBC News, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
11
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 21 of 58
41. On March 27, 2017; CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
42. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account@RogerJStoneJr.
43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
44. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
12
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 22 of 58
46. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
13
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 23 of 58 I
49. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
I
issued a search warrant for STONE's address, On October
II
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's address,
search warrant for mail account. On or about March 14, 2018, Chief Judge Beryl
A. Howell issued a search warrant for STONE's iCloud account. Information recovered pursuant
"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSI responded, "I will work on
other meetings today." replied, "Do you [want] me to bring you anything from the
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE
with the Title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
14
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 24 of 58
53. On July 25, 2016, STONE sent an erriail to CORSI at Target Account 1 with the
subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the
subject line, "Call me MON." The body of the email read: " should see Assange[.]
should find Bernie [S]anders brother who called Bill a Rapist - turn him for Trump[.]
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre-
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian AS SANGE, the
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night." subsequently
15
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 25 of 58
stated to investigators that, around the same time; STONE told him he had gone to London to
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
STONE told he was joking and had not actually met Assange.
57. On or about August 15, 2016, CORSI messaged STONE using Target Account
3: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
58. On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:
59. On or about August 31, 2016, CORSI, using Target Account 2, messaged
STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
60. On or about September 6, 2016, CORSI emailed STONE using Target Account
61. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday
and spoke to him about it again today." wrote back, "Awaiting secret file.
Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
16
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 26 of 58
62. On or about October 3, 2016, an associate of STONE emailed STONE and asked:
"Assange-what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2,
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
65. That same day, BANNON emailed STONE, "What was that this morning???"
STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer is a big democrat."
17
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 27 of 58
66. When BANNON spoke with investigators during a voluntary proffer on February
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails·
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
69. At approximately 11 :53AM, STONE received a phone call from the Washington
70. At approximately 1:42PM, STONE called CORSI and the two spoke for
71. At approximately 2:18PM, CORSI called STONE and the two spoke for
1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
72. At approximately 4:00PM, the Washington Post published a story regarding the
73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE
emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need your BEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 29 of 58
complicated. Two articles in length. I can give you in raw form ihe stuff I got in Russiau
trauslated but to write it up so it's easy to understand will take weekend. Your choice?"
77. On or about that same day October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that "Podesta is at the heart of a Russian-govermnent
money laundering operation that benefits financially Podesta personally aud the Clintons through
78. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them aud used them."
79. On or about Thursday, October 13, 2016, CORSI, using Target Account 3,
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
20
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 30 of 58
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or data from Wikileaks." The post then asked, "Just how much
Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99 .978 percent by with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank
81. On or about October 14, 2016, CORSI sent a message using Target Account 2 to
STONE, "i'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
82. On or about October 17, 2016, CORSI messaged STONE using Target Account
2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
21
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 31 of 58
I
I
I
83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE I
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
!
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
84. On or about October 18, 2016, CORSI messaged STONE using Target Account
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
86. On or about November 8, 2016, the United States presidential election took place.
88. On or about November 10, 2016, CORSI messaged STONE using Target
Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm
22
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 32 of 58
23
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 33 of 58
24
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 34 of 58
96. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
subscribers to obtain email accounts at the domain names identified in the email address
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
experience, such information may constitute evidence of the crimes under investigation because
97. Inmy training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
25
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 35 of 58
information can include the date on which the account was created, the length of service, records
oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
99. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result. of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
100. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
26
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 36 of 58
communications, contacts lists, and images sent ( and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
101. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
27
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 37 of 58
102. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
103. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
• Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
2 The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/i0S Security Guide.pd[, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.
28
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 38 of 58
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
track the location of, display a message on, and wipe the contents of those devices. Find My
cellular, Wi-Fi, Global Positioning System ("OPS") networks, and Bluetooth, to determine a
• App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
29
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 39 of 58
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
104. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
105. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Applesprovided email address
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iC!oud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
106. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records oflog-in times and durations, the types of service utilized, the status of
30
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 40 of 58 I
the account (including whether the account is inactive or closed), the methods used to· connect to
lI
and utilize the account, the Internet Protocol address ("IP address") used to register and access
1
the account, and other log files that reflect usage of the account.
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.·
108. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
31
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 41 of 58
communications regarding a particular Apple device or service, and the repair history for a
device.
I 09. Apple provides users with five gigabytes of free electronic space on iC!oud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iC!oud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
110. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
susp1c10n.
32
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 42 of 58
111. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A) and 2703(c)(I )(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
CONCLUSION
112. Based on the forgoing, I request that the Court issue the proposed search warrant.
113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officeris not
33
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 43 of 58
114. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation
~~~
The Honorable Beryl A. Howell
Chief United States District Judge
34
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 44 of 58
I
ATTACHMENT A
I
I
I
Property to be Searched
This warrant applies to information associated with the following email account:
I
1.
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
35
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 45 of 58
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(:f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
36
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 46 of 58
II
I
l
i
II. Information to be Seized by Law Enforcement Personnel
Any and all records that relate in any way to the accounts described in Attaclnnent A
which consists of evidence, fruits, ~r instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
f. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;
37
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 47 of 58
'
I
,,I
ATTACHMENT C
Property to be Searched
I
This warrant applies to information associated with the following Apple account:
1.
1hat is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
38
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 48 of 58
ATACHMENTD
To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, o~ information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(1), Apple is required to disclose the following information to the govermnent,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI"); .
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
39
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 49 of 58
e. The contents of all files and other records stored on iCloud, including ail iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist. txt files).
40
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 50 of 58
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, , Julian
Assange, or any individual associated with the Trump Campaign;
g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
41
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 51 of 58
ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following email account:
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.
42
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 52 of 58
ATTACHMENT F
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(±), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment E:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Attachment E;
43
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 53 of 58
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified
above;
44
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 54 of 58
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned waITant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Apple Inc. ("Apple") an electronic communication
and/or remote computing services provider headquartered in Cupertino, California not to notify
m1y other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the W aITant for a period of one year or until further order of the Court.
1. The Court has the inherent power to seal court filings when appropriate,
including the Wm-rant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589,598 (1978)). The Court may also seal the
WaITant to prevent serious jeopm·dy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 55 of 58
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237.
3. Further, the Corui has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain cetiain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of conmmnications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b )(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 56 of 58
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once .the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705{b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Apple not to notify any other person (except attorneys for Apple for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
6. At the present time, law enforcement officers of the FBI are conducting an
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this waITant to Corsi could lead him to
destroy evidence or notify others who may delete information relevant to the investigation.
3
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 57 of 58
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Apple and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Wanant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may alert these targets to
the ongoing investigation and its scope. Once ale1ied to this investigation, potential targets would
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potential target could quickly and easily destroy or encrypt digital
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Comi and seek appropriate relief;
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 58 of 58
compelling· governmental interest in· confidentiality to justify the government's sealini request.
10. Based on prior dealings with Apple the United States is aware that, absent a court
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, it is
Apple's policy and practice, upon receipt of a wanant seeking the contents of electronically stored
wire or electronic communications for a certain account, to notify the subscriber or customer of
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned wanant, the application and affidavit in suppmi thereof, and all attachments
thereto and other related materials be placed under seal, and furthe1more, that the Court command
Apple not to notify any other person of the existence or contents of the above-captioned wanant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 1 of 57
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the properly to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before July 26, 2018 (not to exceed 14 days)
<;;fin the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
prope1ty was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. _B_e_iyl A. H~o~w~e~l~I_ _ __
(UniJed States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate bmj
0 for __ days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of .. · - - -
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
----
Printed name and title
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 2 of 57
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date: ..
Executing officer's signature
-
Printed name and title
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 3 of 57
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following email account:
1.
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
34
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 4 of 57
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, aU screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
35
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 5 of 57
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinfo1mation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
f. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
g. Credit card and other financial info1mation, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;
36
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 6 of 57
FILED
IN THE UNITED STATES DISTRICT COURT JUL 1 2 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02403
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A.
Assign. Date: 7/12/2018
Description: Search & Seizure Warrant
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require CSC Holdings, an electronic communication and/or remote computing service s
headquartered at 1111 Stewart Avenue, Bethpage, NY 11714, not to disclose the existence or
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Wmrnnt will seriously jeopardize the investigation, including by giving the
targets an oppo1tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Comi;
and
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 7 of 57
its employees shall not disclose the existence or content of the Warrant to any other person ( except
attorneys for CSC Holdings for the purpose of receiving legal advice) for a period of one year
~/</
Date
2
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 8 of 57
AO I06 (Rev. 04/10) Application for a Search Warrant
fit!D
UNITED STATES DISTRICT COURT JUL 1 2 2018
for the Clerk, U.S. District & Bankruptcy
District of Columbia Courts for the District of Columbia
See Attachment A.
New York , there is now concealed (identify the
located in the Eastern
--~=~~~--
person or describe the property to be seized):
District of
--~="-'=~--~
See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
,!I evidence of a crime;
,!I contraband, fruits of crime, or other items illegally possessed;
r,/ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
IAaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI
Printed name and title
Date: 7/12/2018
,. Judge's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 9 of 57
FILED
IN THE UNITED STATES DISTRICT COURT
JUL 12 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District &Bankruptcy
Courts for tile District of Columbia
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for tbe requested warrant and does not set
4. Before the submission of this warrant application, the Special Counsel's Office
complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
5. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
protected computer).
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
Specifically, tbe Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over tbe offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to
Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
2
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 11 of 57
ASSANGE. · On or about August 2, 2016, CORSI responded to STONE that the "word is friend
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta' s time in
predicted: On or aboutAugust 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthen-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
9. Furthermore, on the day of the Access Hollywood video disclosure, there were
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
3
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 12 of 57
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.
4
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 13 of 57
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
5
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 14 of 57
14. On October 7, 2016, the U.S. Department of Homeland Security an:d the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
15. The U.S. Intelligence Community (USIC) is confident that the Russian
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior~most officials could have authorized these activities.
assessment of Russian activities a:nd intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US ·Elections." In the report, the USIC
17. "Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
18. The USIC also described, at a high level, some of the techniques that the Russian
6
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 15 of 57
government employed during its interference. The USIC summarized the efforts as a "Russian
19. With respect to "cyber activity," the USIC-assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
20. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
21. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
22. TheSpecial Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
7
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 16 of 57
23. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
24. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
26. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
27. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
8
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 17 of 57
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
30. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
31. On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
9
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 18 of 57
32. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i 'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
33. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34. On August 21, 2016, using@RogerJStoneJR, Stone tweeted stating: "Trust me, it
will soon the [sic] Podesta' s time in the barrel. #CrookedHillary ." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a "'mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
35. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fairly soon. And that of course will answer the question as to what exactly what was erased on
37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
10
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 19 of 57
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
balcony of the Ecuadoran Embassy in London. On the day of the Assange armouncement -
which was part ofWikiLeaks' 10-year armiversary celebration- Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
38. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
40. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to Stone's August
21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the NBC News, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
11
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 20 of 57
41. · On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew a.bout the hacking ofPodesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
42. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
44. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
12
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 21 of 57
46. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
13
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 22 of 57
49. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's address,
search warrant for email account. On or about March 14, 2018, Chief Judge Beryl
A. Howell issued a search watTant for STONE's iCloud account. Information recovered pursuant
"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSiresponded, "I will work on
other meetings today." replied, "Do you [want] me to bring you anything from the
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE
with the Title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
14
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 23 of 57
53. On July 25, 2016, STONE sent an email to CORSI at Target Account 1 with the
subj~ct line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the
subject line, "Call me MON." The body of the email read: " should see Assange[.]
should find Bernie [S]anders brother who called Bill a Rapist-turn him for Trump[.]
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre-
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
reference to a "friend in embassy [who] plans 2 more. dumps" refers to Julian ASSANGE, the
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night." subsequently
15
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 24 of 57
stated to investigators that, around the same time, STONE told him he had gone to London to
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
STONE told he was joking and had not actually met Assange.
57. On or about August 15, 2016, CORSI messaged STONE using Target Account
3: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
58. On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:
59. On or about August 31, 2016, CORSI, using Target Account 2, messaged
STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
60. On or about September 6, 2016, CORSI emailed STONE using Target Account
61. On or about September 24, 2016 emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday
and spoke to him about it again today." wrote back, "Awaiting secret file.
Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
16
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 25 of 57
62. On or about October 3, 2016, an associate of STONE emailed STONE and asked:
"Assange - what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
63. .On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2,
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
65. That same day, BANNON emailed STONE, "What was that this morning???"
STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer is a big democrat."
17
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 26 of 57
66. When BANNON spoke with investigators during a volunt~y proffer on February
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
69. At approximately 11 :53AM, STONE received a phone call from the Washington
70. At approximately 1:42PM, STONE called CORSI and the two spoke for
71. At approximately 2:18PM, CORSI called STONE and the two spoke for
1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
18
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 27 of 57
72. At approximately 4:00PM, the Washington Post published a story regarding the
73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE
emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need yourBEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 28 of 57
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
77. On or about that same day October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
78. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Account, "Got them and used them."
79. On or about Thursday, October 13, 2016, CORSI, using Target Account 3,
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
'
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
20
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 29 of 57
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or.data from Wikileaks." The post then asked, "Just
;
how much
Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by , with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank
81. On or about October 14, 2016, CORSI sent a message using Target Account 2 to
STONE, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
82. On or about October 17, 2016, CORSI messaged STONE using Target Account
2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
21
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 30 of 57
83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
84. On or about October 18, 2016, CORSI messaged STONE using Target Account
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
86. On or about November 8, 2016, the United States presidential election took place.
88. On or about November 10, 2016, CORSI messaged STONE using Target
Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm
22
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 31 of 57
23
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 32 of 57
I
1'
I
I
11
!I
24
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 33 of 57
96. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
subscribers to obtain email accounts at the domain names identified in the email address
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
experience, such information may constitute evidence of the crimes under investigation because
97. In my training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). ·In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
25
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 34 of 57
I
II
f
I
information can include the date on which the account was created, the length of service, records I
'
oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
99. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
100. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
26
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 35 of 57
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
101. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
27
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 36 of 57
102. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
103. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
• Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while Face Time enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
2 The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/iOS Security Guide.pdf, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.
28
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 37 of 57
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.cotn.. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
track the location of, display a message on, and wipe the contents of those devices. Find My
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
• App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
29
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 38 of 57
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
104. Apple services are accessed through the use of an "Apple ID," an account created·
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
105. An Apple ID takes the form ofthe full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email'.' sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
106. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition; Apple captures the date on which the account was created, the
length of service, records oflog-in times and durations, the types of service utilized, the status of
30
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 39 of 57
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
108. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
31
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 40 of 57
I
I
communications regarding a particular Apple device or service, and the repair history for a
device.
I
I 09. Apple provides users with five gigabytes of free electronic space on iC!oud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iC!oud-connected services, including: email
(iC!oud Mail); images and videos (iC!oud Photo Library, My Photo Stream, and iC!oud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iC!oud Drive); and
web browser settings and Wi-Fi network information (iC!oud Tabs and iC!oud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iC!oud; for example, the iOS app for WbatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
110. Inmy training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
32
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 41 of 57
I
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED I
'I
111. I anticipate executing this warrant under the Electronic Communications Privacy !
1,
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
I
to require Google to disclose to the government copies of the records and other information
(including the content of commuuications) associated with the accounts in Attachment A, C, and
will rev1ew that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
CONCLUSION
112. Based on the forgoing, I request that the Court issue the proposed search warrant.
113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
33
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 42 of 57
114. I further request thatthe Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~~
Andrew Mitchell
Special Agent
Federal Bureau ofinvestigation
~
Subscribed and sworn to before me on thisB day of July, 2018.
~&~~
The Honorable Beryl A. Howell
Chief United States District Judge
34
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 43 of 57
I
ATTACHMENT A
Property to be Searched
I
I!
11
This warrant applies to information associated with the following email account:
II
I
1.
I
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
35
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 44 of 57
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provideris required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
36
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 45 of 57
I
I
I
II. Information to be Seized by Law Enforcement Personnel
Any and all records that relate in any way to the accounts described in Attachment A
l
Ii
!
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit I!
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
I
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
'
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
f. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;
37
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 46 of 57
ATTACHMENT C
Property to be Searched
This warrant applies to information associated with the following Apple account:
1.
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
38
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 47 of 57
l
ATACHMENTD l
l
Particular Things to be Seized I
I. Files and Accounts to be produced by the Provider:
To the extent that the information described in Attachment A is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
39
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 48 of 57
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other recordi related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes ·
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
40
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 49 of 57
Any and all records that relate in any way to the accounts described in Attaclunent A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related a9tivities in connection with computers and 18 U.S.C. § 371 (conspiracy to conunit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
conununications regarding hacking, release of hacked material, conununications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange, or conununications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
conununications or meetings involving Roger Stone, Julian
Assange, or any individual associated with the Trump Campaign;
g. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
41
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 50 of 57
ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following email account:
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.
42
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 51 of 57
ATTACHMENTF
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment E:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full riame, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Attachment E;
43
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 52 of 57
Any and all records that relate in any way to the accounts described in Attaclnnent A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i. All existing printouts from original storage which concern the categories identified
above;
44
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 53 of 57
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct CSC Holdings, an electronic communication and/or
remote computing services provider headquartered in Bethpage, NY not to notify any other person
(except attorneys for CSC Holdings for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further order of the Court.
1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wa!1"ant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See WashingtonPostv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Cami has jurisdiction to issue the requested order because it is "a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 54 of 57
offense under investigation occu1Ted within Washington, D.C. See 18 U.S.C. § 3237.
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
18 U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how CSC Holdings may
be compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a comi order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a cou1i order to preclude such
1 Section2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 55 of 57
18 U.S:C. § 2705(b ). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court dete1mines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Gran_d Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command CSC Holdings not to notify any other person (except attorneys for CSC Holdings for
the purpose of receiving legal advice) of the existence ofthe Subpoena for a period of one year or
6. At the present time, law enforcement officers of the FBI are conducting an
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to
destroy evidence or notify others who may delete info1mation relevant to the investigation.
3
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 56 of 57
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that CSC Holdings and its employees be directed not to notify any other person
of the existence or cof\tent of the Warrant (except attorneys for CSC Holdings for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order ·
is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of
which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the ongoing investigation and its scope. Once ale1ied to this investigation, potential
targets would be immediately prompted to destroy or conceal incriminating evidence, alter their
operational tactics to avoid future detection, and otherwise take steps to undermine the
investigation and avoid future prosecution. In patiicular, given that they are known to use
electronic communication and remote computing services, the potential target could quickly and
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the
WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 57 of 57
10. Based on prior dealings with CSC Holdings the United States is aware that, absent
a court order under Section 2705(b) commanding CSC Holdings not to notify anyone about a legal
request, it is CSC Holdings's policy and practice, upon receipt of a warrant seeking the contents
of electronically stored wire or electronic communications for a certain account, to notify the
subscriber or customer of the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
CSC Holdings not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for CSC Holdings for the purpose of receiving legal advice) for a period
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 1 of 38
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 10, 2018 (not to exceed 14 days)
(;t in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly retum this warrant and inventory to Hon. Beryl A Howell, Chief U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to search history information associated with the following accounts
View, California:
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 4 of 38
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
2
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 5 of 38
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
f. All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;
g. Evidence of passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;
I. Review Protocols
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
3
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 6 of 38
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A
located in the
- - --- District of - - - --California
Northern
- --
person or describe the property to be seized):
- - -- - - - , there is now concealed (identify the
See Attachment B
The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
fi evidence of a crime;
fi contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Date:
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 7 of 38
rl i1
fr i
JUL 21 20!U
Clork, U,s, Ui»trlut l"'4 Dunkruptcy
IN THE UNITED STATES DISTRICT COURT Courts for iha District of Columbia
FOR THE DISTRICT OF COLUMBIA
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
1. I make this affidavit in support of an application for a search warrant for search
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The
2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain information relevant to
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 8 of 38
violations of 18 U.S.C. § 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S .C. § l 349
(attempt and conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban)
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
6. The Special Counsel's Office, with FBI's assistance, is investigating the Russian
government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump. This includes investigating Roger Stone (STONE) and others known
and unknown, in connection with the hacking of email accounts associated with the Democratic
individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent
dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks,
among others.
2
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 9 of 38
7. On or about July 25, 2016, STONE emailed Jerome CORSI to "Get to Assange"
at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July 31, 2016,
. about August 2, 2016, CORSI responded to STONE that the "word is friend in embassy
[ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned
to be very damaging .... Time to let more than Podesta to be exposed as in bed w enemy if they
are not ready to drop HRC." After receipt of that message, on or about August 21, 2016, using
@RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in the barrel.
#CrookedHillary."
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the DCCC.
On or about October 7, 2016, the day the Washington Post published a breaking story about an
women, WikiLeaks released emails hacked from the account of John Podesta.
9. Furthermore, on the day of the Access Hollywood video disclosure, there were
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
3
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 10 of 38
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
described further below, STONE also maintained contact with individuals employed by the
4
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 11 of 38
Campaign, including then-campaign chairman Paul MAN AF ORT and deputy chairman Rick
GATES.
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
5
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 12 of 38
14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
The U.S. Intelligence Community (USIC) is confident that the Russian Government
directed the recent compromises of emails from US persons and institutions, including
from US political organizations. The recent disclosures of alleged hacked emails on sites
like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and
disclosures are intended to interfere with the US election process. Such activity is not
new to Moscow-the Russians have used similar tactics and techniques across Europe
and Eurasia, for example, to influence public opinion there. We believe, based on the
scope and sensitivity of these efforts, that only Russia's senior-most officials could have
authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, arid harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
16. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
17. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
18. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
20. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
21. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
7
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 14 of 38
those accounts.
22. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
24. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the
25. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main paii
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem ·
8
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 15 of 38
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Gucci fer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with AS SANGE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
29. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
31. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
9
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 16 of 38
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
32. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chainnan of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: "Trust me,
it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a '"mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
34. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
10
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 17 of 38
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
39. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE responded: "I have never
met or spoken with Assange, we have a mutual friend who's traveled to London several times,
and everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
40. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
11
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 18 of 38
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
41. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
42. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false ciaims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
44. On or about November 9, 2016, one day after the presidential election,
1
On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account @RogerJStoneJr.
12
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 19 of 38
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
4 7. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE'
13
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 20 of 38
Howell issued a search warrant for email account. On or about March 14, 2018,
Chief Judge Beryl A. Howell issued a search warrant for STONE's iC!oud account. Information
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were·
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- turn him for
14
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 21 of 38
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact ofrigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w
' .
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the same
time, STONE told him he had gone to London to meet AS SAN GE. also stated that
in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told he was joking and
"Give me a call today if you can. Despite MSM drumroll that HRC is
15
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 22 of 38
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
56. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
58. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
16
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 23 of 38
wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out.before Election Day.
61. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer is a big
democrat."
63. When BANNON spoke with investigators during a voluntary proffer on February
14, 201'8, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
17
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 24 of 38
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
66. At approximately 11 :53AM, STONE received a phone call from the Washington
67. At approximately 1:42PM, STONE called CORSI and the two spoke for
68. At approximately 2: 18PM, CORSI called STONE and the two spoke for
69. At approximately 4:00PM, the Washington Post published a story regarding the
70. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
2
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d747 l 4-8ce5-l l e6-875e-2cl bfe943b66 _ story.html
18
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 25 of 38
wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks - The Podesta Emails," with a link to the newly-released Podesta emails.
message to CORSI without comment. STONE does not appear to have forwarded the email to
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will Jose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
74. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
19
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 26 of 38
"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
75. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I' 11 give you one more - NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
77. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
20
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 27 of 38
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
78. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
79. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
21
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 28 of 38
It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
81. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
83. On or about November 8, 2016, the United States presidential election took place.
84. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
85. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
22
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 29 of 38
23
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 30 of 38
92. The search history associated with the account which was
obtained pursuant to search warrant, shows that STONE searched for terms that appear to be
related to the DNC hack and the stolen emails, including his nexus thereto, while logged into the
For example, on or about October 13, 2016, STONE searched for the
words "Roger Stone john Podesta." The search history for appears to
have been deleted between January 18, 2016, and July 23, 2016.
93. During the course of its investigation, the FBI has also identified a series of
searches that appear to relate to the personas Guccifer 2.0 and DCLeaks, which predate the
public unveiling of those two personas. In particular, between May 17, 2016, and June 15, 2016
24
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 31 of 38
(prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that
searches were conducted for the terms "dcleaks," "guccifer," and ''guccifer june," from IP
addresses within one of two ranges: 172.56.26.0/24, 107.77.216.0/24. 3 These IP ranges are
assigned to T-Mobile USA, Inc., and AT&T Mobility LLC, respectively, and, according to
Google, the searches were all conducted from Florida. On or about June 13, 2018, this Court
issued a search warrant for information associated with these searches and, in particular, for the
full search histories associated with the CookieIDs that conducted the search. 4 As set forth in the
affidavit submitted in support of that search warrant, IP logs obtained from Twitter showed that
STONE used multiple IP addresses within the ranges 172.56.26.0/24 and 107.77.216.0/24 to log
into his Twitter account @RogerJStoneJr. A Facebook account controlled by STONE also used
an IP address within the range 172.56.26.0/24 on or about June 13, 2016, to purchase a Facebook
advertisement.
Target Account 1 was last accessed on July 5, 2017. Search warrant returns for
3
Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range .of up to 256 IP addresses.
4
Google assigns unique CookieIDs to searches conducted while a user is not logged into a
Google account. All searches conducted from the same device and browser during a 24-hour
window are associated with the same CookieID.
25
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 32 of 38
October 26, 2016, and uses Target Account 1 as the recovery email. Target Account 2 was last
95. The search of STONE's Hotmail account indicates that STONE uses the address
"Target Account 3"). For example, on or about June 27, 2016, Stone
received an email in his account from the "Gmail Team" with the subject,
"Your Gmail address, , has been created." Subscriber records show that
Target Account 3 was created on June 27, 2016, and is registered in the name of"Swash
Buckler." On or about April 16, 2018, this Court issued an order pursuant to 18 U .S.C.
§ 2703(d) for non-content information associated with Target Account 3. Based on a review of
the header information obtained from Google pursuant to that Order, it appears that STONE
frequently used Target Account 3 to communicate with others via the classified advertisement
96. This warrant application seeks only search history for the Target Accounts; it
does not seek the content of email communications to and from the Target Accounts. 5 Google
maintains records of the Google searches that a user conducts while signed into a particular
Google email account (provided the user has not disabled the retention of this information). In
my training and experience, I know that users are often not aware of whether or not they are
5
The government is also contemporaneously seeking an order pursuant to 18 U.S.C. § 2703(d)
for non-content information associated with Target Accounts 1 and 2, including header
information.
26
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 33 of 38
experience, such information may constitute evidence of the crimes under investigation because
99. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with a Google account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, an account's search
history may indicate who used or controlled the account at a relevant time. Further, information
maintained by the email Providers can show how and when the account was accessed or used.
Additionally, information stored in an account's search history may indicate the geographic
location of the account user at a particular time (e.g., location information integrated into an
image or video sent via email). Lastly, stored electronic data, including search history
information, may provide relevant insight into the email account owner's state of mind as it
relates to the offense under investigation. For example, information in the email account may
indicate the owner's motive and intent to commit a crime (e.g., searches relating to the crime), or
consciousness of guilt (e.g., deleting search history in an effort to conceal information from law
enforcement).
28
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 34 of 38
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
The government, however, does not at this time anticipate that any of the items described in
CONCLUSION
101. Based on the forgoing, I request that the Court issue the proposed search warrant.
102. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
103. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
29
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 35 of 38
Respectfully sHbmitted,
~
Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation
. 1 It',
Subscribed and sworn to before me on thisll_ day of July, 2018.
/1;t4 &irLt/
The Honorable Beryl A. Howell
Chief United States District Judge
30
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 36 of 38
ATTACHMENT A
Property to be Searched
This warrant applies to search history information associated with the following accounts
View; California:
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 37 of 38
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, tiles, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
2
Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 38 of 38
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
f. All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;
g. Evidence of passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;
I. Review Protocols
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
3
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 1 of 47
AO 93 (Rev. 11/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (nottoexceed /4 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. CJ at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by Jaw and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, wiJJ be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) l'.:J until, the facts justifying, the later specific date of
City and state : Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 2 of 47
AO 93 (Rev. I 1/13) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
11
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer 's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, lnc.
- 1-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 4 of 47
ATTACHMENT B
I. Information to be disclosed by Facebook
To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of Facebook Inc. ("Face book"), including any messages, records, files, logs, or
information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
(a) All contact and personal identifying infonnation, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
(b) All activity logs for the account and all other documents showing the user's posts
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;
(d) All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use of Facebook applications;
-2-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 5 of 47
(e) All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;
(g) All "check ins" and other location information, including records of the user's
(h) All IP logs, including all records of the IP addresses that logged into the account;
(i) All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";
(j) All information about the Facebook pages that the account is or was a "fan" of;
(k) All past and present lists of friends created by the account;
(m) All information about the user's access and use ofFacebook Marketplace;
(o) The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);
(p) Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
-3-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 6 of 47
(s) All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
(t) All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
(u) All records related to advertisements and advertising conducted through the
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S .C. § 2 (aiding and
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 7 of 47
b. All records, information, documents or tangible materials that relate in any way to
Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
principals;
e. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
f. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
g. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
h. The source of all funds used to purchase advertisements or make other expenditures
1. The identity of the person(s) who created or used the account, including records
-5-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 8 of 47
J. The identity of any non-U.S. person(s)- including records that help reveal the
k. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
-6-
Case
AO 106 (Rev . 04/10) 1:19-mc-00029-CRC
Application for a Search Warrant Document 29-12 Filed 04/28/20 Page 9 of 47
See Attachment A
located in the Northern
- - - -- - - -
District of - - -- --
California
------
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
rif property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
~___-/
Reviewed by AUSA/SAUSA: Applicant's signature
Date:
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 10 of 47
I
IN THE UNITED STATES DISTRICT COURT AUG - 2 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptc
Courts for the District of Co/umbra
IN THE MATTER OF THE SEARCH OF
INFORMATION ASSOCIATED WITH Case: 1:18-sc- 02570
THREE FACEBOOK ACCOUNTS Ass!gned To: Howell, Beryl A
STORED AT PREMISES CONTROLLED Assign. Date: 8/2/2o 18
BY FACEBOOK, INC. Description : Search & Seizure Warrant
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
information associated with the Facebook accounts associated with the following user IDs:
which are stored at premises owned, maintained, controlled or operated by Facebook Inc., a social
be disclosed by Facebook and searched by the government is described in the following paragraphs
2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
-1 -
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 11 of 47
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain evidence, fruits, or
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), and
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 30121(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) . .. that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
-2-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 12 of 47
relationship with the Campaign thereafter, STONE maintained his support for Trump and
described further below, STONE also maintained contact with individuals employed by the
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
GATES.
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 13 of 47
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to _Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 14 of 47
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
, the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
-5-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 15 of 47
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
-6-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 16 of 47
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with AS SAN GE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washi1;1gton D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted stating: "Trust me,
-7-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 17 of 47
it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a "'mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
-8-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 18 of 47
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE indicated that he had
never met or spoken with Assange, saying that "we have a mutual friend who's traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Hu'ma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
-9-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 19 of 47
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 20 of 47
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE's
Howell issued a search warrant for email account. On or about March 14, 2018,
Chief Judge Beryl A. Howell issued a search warrant for STONE's iCloud account. Information
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 21 of 47
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: " should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist-tum him for
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w
-12-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 22 of 47
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
· expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SAN GE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet AS SAN GE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
: "Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
50. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
-13-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 23 of 47
S [b ]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
52. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
-14-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 24 of 47
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
55. On or about October 4, 2016, CORSI messaged STONE at his iClciud account:
"Assange made a fool of himself. Has nothing or he would have released it. Tota! BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer is a big
democrat."
57. When BANNON spoke with investigators during a voluntary proffer on February
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
2
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-1 le6-875e-2cl bfe943b66_story.html
-15-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 25 of 47
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60. At approximately 11 :53AM, STONE received a phone call from the Washington
61. At approximately 1:42PM, STONE called CORSI and the two spoke for
62. At approximately 2:18PM, CORSI called STONE and the two spoke for
63. At approximately 4:00PM, the Washington Post published a story regarding the
64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks -The Podesta Emails," with a link to the newly-released Podesta emails.
message to CORSI without comment. STONE does not appear to have forwarded the email to
-16-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 26 of 47
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
69. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
-17-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 27 of 47
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
-18-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 28 of 47
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
a..:..:uuul, 'Tm iu NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
-19-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 29 of 47
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
77. On or about November 8, 2016, the United States presidential election took place.
78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
79. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'1? in
-20-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 30 of 47
-21-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 31 of 47
by investigators from the Special Counsel's Office. told investigators that he became
STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
post social media content to Facebook and Twitter, and that he and STONE both
instructed these individuals about what to post. stated that he purchased a couple
hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts. 3 According to one of the individuals who did work for STONE on
Facebook in 2016 was Everett WILKINSON, a social media marketer and IT expert.
88. further stated that STONE wanted to push out WikiLeaks content
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
3
Facebook requires that all users of Facebook accounts use their actual name while registering
and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
-22-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 32 of 47
with Facebook user ID , is registered with the vanity name "rogerstone" and
advertisements associated with the Target Account, including advertisements with the following
90. Additionally, on or about March 31, 2017, STONE received a Facebook receipt at
his Hotmail account for advertisements associated with Target Account 1, with the following
• "I am not in touch with any Russians, don't have ... ,"
about August 13, 2017, STONE received a receipt from Facebook for several advertisements
-23-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 33 of 47
associated with Target Account 2, including an advertisement with the excerpted title, "I am not
92. Target Account 3 has the Facebook user ID and was created
on or about October 27, 2015. The account is registered in the name of using
Account 3, which may have bee.n auto-forwarded to STONE's Hotmail account. These emails
include a notification of a password change to Target Account 3 and at least one receipt for a
Facebook advertisement associated with Target Account 3, sent on or about June 30, 2016. At
addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
94. Facebook owns and operates a free-access social networking website of the same
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish
4
told investigators that he would sometimes send emails from STONE's account.
-24-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 34 of 47
accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.
95. Facebook asks users to provide basic contact and personal identifying information
to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
96. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
97. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
-25-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 35 of 47
98. Facebook users can create profiles that include photographs, lists of personal
interests, and other information. Facebook users can also post "status" updates about their
whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
99. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
100. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a Chat feature that allows users to send and receive instant messages
-26-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 36 of 47
through Facebook. These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
101. If a Facebook user does not want to interact with another user on Facebook, the
first user can "block" the second user from seeing his or her account.
102. Facebook has a "like" feature that allows users to give positive feedback or connect
to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
103. Facebook has a search function that enables its users to search Facebook for
104. Each Facebook account has an activity log, which is a list of the user's posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
105. Facebook Notes is a blogging feature available to Facebook users, and it enables
users to write and post notes or personal web logs ("blogs"), or to import their blogs from other
106. The Facebook Gifts feature allows users to send virtual "gifts" to their friends that
appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are
-27-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 37 of 47
free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.
107. Face book also has a Marketplace feature, which allows users to post free classified
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
108. In addition to the applications described above, Facebook also provides its users
with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
109. Some Facebook pages are affiliated with groups of users, rather than one individual
user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
110. Facebook uses the term "Neoprint" to describe an expanded view of a given user
profile. The "Neoprint" for a given user can include the following information from the user' s
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
-28-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 38 of 47
111. Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
112. Social networking providers like Facebook typically retain additional information
about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). In some cases, Facebook users may
communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
-29-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 39 of 47
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accuunls along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such .information allows
investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
114. Therefore, the computers of Facebook are likely to contain all the material
subscribers and their use of Facebook, such as account access information, transaction information,
-30-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 40 of 47
other operative privileges. The procedures include use, if necessary, of a designated "filter
kaa1," separate aml apart from the investigative team, in order to address potential privileges.
CONCLUSION
116. Based on the forgoing, I request that the Court issue the proposed search warrant.
117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
118. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
-31-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 41 of 47
Respectfully submitted,
~
Andrew Mitchell
Special Agent
Federal Bureau of Investigation
-32-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 42 of 47
ATTACHME NT A
Property to be Searched
This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc.
-1-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 43 of 47
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Facebook Inc. ("Facebook"), including any messages, records, files, logs, or
information that have been deleted but are slill available lo Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(:t), Facebook is required to disclose the
(a) All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
(b) All activity logs for the account and all other documents showing the user's posts
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;
(d) All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use of Facebook applications;
-2-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 44 of 47
(e) All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;
(g) All "check ins" and other location information, including records of the user's
(h) All IP logs, including all records of the IP addresses that logged into the account;
(i) All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";
G) All information about the Facebook pages that the account is or was a "fan" of;
(k) All past and present lists of friends created by the account;
(m) All information about the user's access and use of Facebook Marketplace;
(o) The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);
(p) Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
-3-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 45 of 47
(s) All pnvacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
(t) All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
(u) All records related to advertisements and advertising conducted through the
Any and all records that relate in any way to the accounts described in Attachment A
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 46 of 47
b. All records, information, documents or tangible materials that relate in any way to
Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
principals;
e. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
f. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
g. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
h. The source of all funds used to purchase advertisements or make other expenditures
i. The identity of the person(s) who created or used the account, including records
-5-
Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 47 of 47
J. The identity of any non-U.S. person(s)-including records that help reveal the
k. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
-6-
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 1 of 189
See Attachment E
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment F
YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. l'J at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)
l'J Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
['J for _ _ days (not to exceed 30) ['J until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 2 of 189
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:
created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.
53
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 4 of 189
ATACHMENTF
To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are stilJ available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEi");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 5 of 189
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
55
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 6 of 189
Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
56
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 7 of 189
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment E
located in the --------
Northern District of California
- - - - - - - - -- - -
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment F
The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other i~ems illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be an-ested or a person who is unlawfully restrained.
Date:
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 8 of 189
AUG - 3 2018
Cferk, U.S. Dlstrlci & Bankruptcy
Courts for the District of Columbia
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupe1iino, California 95014. The information to be disclosed by Apple and searched by
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
Gmail address, (Target Account 2). On or about March 14, 2018, Chief
Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This
2
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 10 of 189
warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
7. This application seeks authority to search, from the date of search warrants
previously issued by the Court to the present, three accounts believed to be used by Roger
STONE's account; and Target Account 3, which is STONE's iCloud account. As set
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
8. For example, as set forth in more detail below, in recent months STONE has
reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
3
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 11 of 189
urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness, who had
in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get
to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me,
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 12 of 189
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape of then-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.
5
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 13 of 189
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
6
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 14 of 189
13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were
7
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 15 of 189
intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to .
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
b. · The USIC also described, at a high level, some of the techniques that the
Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-such as cyber activity-
intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further,
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 16 of 189
activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
d. With respect to the release of stolen materials, the USIC assessed "with
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
multiple contradictory statements and false claims about his identity throughout the election.
15. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
17. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
9
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 17 of 189
spearphished over 100 accounts used by organizations and personnel involved in administering
19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United
20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
1A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.
10
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 18 of 189
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24. On August 12, 2016, Gucci fer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 19 of 189
26. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,
"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a "'mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
29. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a wee~ly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
12
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 20 of 189
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement- which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 21 of 189
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr. Information recovered from the search of that account
a. On October 13, 2016, while WikiLeaks was in the midst of releasing the
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. Thi~ account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"c01Tect\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
14
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 22 of 189
@wikileaks immediately followed up with another message less than a minute later: "We are
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
15
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 23 of 189
37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search
October 17, 2017, Chief Judge Howell issued a search warrant for STONE's address,
(Target Account 2); and on or about March 14, 2018, Chief Judge
Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
email account. Information recovered pursuant to those search warrants includes the following:
flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
16
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 24 of 189
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: ,should see
Assange[.] should find Bernie [SJ anders brother who called Bill a Rapist - turn him for
before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shottly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
17
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 25 of 189
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018 told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol he was joking and
1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
Account 3, "Podesta paid $I 80k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,
18
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 26 of 189
"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today." wrote back, "Awaiting secret file. Explosive ... Hope you
are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
conversation concerned possible derogatory information he was trying to obtain from Turkey.
Target Account 2 and asked: "Assange - what's he got? Hope it's good." STONE wrote back,
"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total
BS hype."
19
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 27 of 189
was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a
big democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released
Friday, October 7, 2016, Washington Pos.t reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
3
https://www.washingtonpost.com/lifestyle/style/the-cal\er-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/31 d74714-8ce5-l le6-875e-2c 1bfe943b66_story.html
20
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 28 of 189
40. At approximately 11 :53AM, STONE received a phone call from the Washington
41. At approximately 1:42PM, STONE called CORSI and the two spoke for
42. At approximately 2: 18PM, CORSI called STONE and the two spoke for
43. At approximately 4:00PM, the Washington Post published a story regarding the
44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the .
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded message to CORSI without comment. STONE does not appear
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 29 of 189
a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
122016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
49. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 30 of 189
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent
STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how mucl:i money did , a controversial Russian billionaire investor with
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by , with the money transferred via Deutsche
Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52. On or about October 14, 2016, CORSI sent a message to STONE at Target
Account 3, "I'm in.NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 31 of 189
53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1
and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted
source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3,
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
57. On or about November 8, 2016, the United States presidential election took place.
24
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 32 of 189
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3,
"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
25
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 33 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 34 of 189
61. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 35 of 189
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this repot1, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
info11nation proved to be correct. I have referred publicly to this journalist as an,
"intermediary" , "go-between" and "mutual friend." All of these monikers are equally
true.
62. Tn a document dated March 26, 2018 titled "Minority Views," Democratic
members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That-
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
63. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
28
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 36 of 189
Account 3, "My lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a
subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?"
66. On or about November 24, 2017, STONE, using Target Account 3, texted
CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "I told
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuffT,] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"
29
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 37 of 189
67. STONE and CREDICO continued to exchange messages via Target Account 3,
and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for perjury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if
4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
30
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 38 of 189
you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a ce1iain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify[.]"
71. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73. STONE and CREDICO continued to exchange messages via Target Account 3,
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
31
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 39 of 189
stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
75. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee ... But you'll get off because you're friends with Trump so don't wo1Ty. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
76. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
77. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog-
135911370.html
6
https ://www.motherjones.com/ po Iitics/2018/0 5/ro ger-stone-to-associate-prepare-to-die/
32
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 40 of 189
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap
devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use
Target Account 1 and Target Account 2, and that he has used them to communicate with
79. For example, STONE and communicated twice on May 28 and May
interviewed by the Special Counsel's Office on or aboi1t May 2, 2018. Toll records _show that
communicated with using Target Account 1 on June 1, 2018 and June 6, 2018.
, a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
80. STONE has also used Target Account 2 to communicate with individuals
a. For example, between May 23, 2018 and the present, STONE and CORSI
exchanged at least five messages using Target Account 2. In the same time period, STONE
33
•
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 41 of 189
STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
wit , using Target Account 2. In addition, between on or about June 14, 2018 and
June 17, 2018, and STONE exchanged five emails using Target Account 2.
81. STONE has also used a phone number associated with Target Account 3 to
who had been employed by STONE during the Campaign as an info1mation technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary form of communication with STONE is by text
82. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
34
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 42 of 189
subscribers to obtain email accounts at the domain names identified in the email address
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
experience, such information may constitute evidence of the crimes under investigation because
83. In my training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
35
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 43 of 189
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address infonnation can help to identify which computers or other devices were used to access
85. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
86. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 44 of 189
infonnation maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
87. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htip://images.apple.com/ privacy/docs/.l cgal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCioud," available at htlj ://www.apple.com/ icloud/; "What
does iCloud back up?," available at https://suppo1i .app le.corn/kb/PHJ 25 19; "iOS Security," available at
37
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 45 of 189
88. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
89. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a. Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
https://www.appl e.com/business/docs/iOS Security Guide.pdt: and "iCloud: How Can I Use iCloud?," available at
https://suppo1t.apple.com/kb/PH26502.
38
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 46 of 189
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
track the location of, display a message on, and wipe the contents of those devices. Find My
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
h. App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and .on desktop and laptop computers running
39
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 47 of 189
90. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
92. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
40
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 48 of 189
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iC!oud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
41
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 49 of 189
95. Apple provides users with five gigabytes of free electronic space on iCloud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
96. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
susp1c10n.
42
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 50 of 189
97. l anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
CONCLUSION
98. Based on the forgoing, I request that the Court issue the proposed search warrant.
99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
100. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
k~___/
Andrew Mitchel l
Special Agent
Federal Bureau of Investigation
43
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 51 of 189
/ )/ ~_./ ,
- ~-~ /;Arr-Cz,1/
The Honorable Beryl A. Howell
Chief United States District Judge
44
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 52 of 189
ATTACHMENT A
Property to be Searched
created or maintained between September 11, 2017 and present, that is stored at premises owned,
45
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 53 of 189
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following infor1!1ation to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. AJI internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
46
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 54 of 189
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C . § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, , Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
47
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 55 of 189
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
48
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 56 of 189
ATTACHMENT C
Property to be Searched
This warrant applies to information associated with the following Google account:
created or maintained between October 17, 2017 and the present, that is stored at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
49
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 57 of 189
ATTACHMENT D
To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S .C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c. All internet search data including all queries and location data;
50
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 58 of 189
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l. Google Talk and Google Hangouts conversation logs associated with the
account.
51
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 59 of 189
Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
52
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 60 of 189
ATTACHMENTE
Property to be Searched
This warrant applies to information associated with the following Apple DSID:
created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.
53
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 61 of 189
ATACHMENTF
To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, tiles, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(£), Apple is required to disclose the following infonnation to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 62 of 189
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
55
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 63 of 189
Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction.of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
56
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 64 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 65 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 66 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 67 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 68 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 69 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 70 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 71 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 72 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 73 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 74 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 75 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 76 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 77 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 78 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 79 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 80 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 81 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 82 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 83 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 84 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 85 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 86 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 87 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 88 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 89 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 90 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 91 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 92 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 93 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 94 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 95 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 96 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 97 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 98 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 99 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 100 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 101 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 102 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 103 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 104 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 105 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 106 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 107 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 108 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 109 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 110 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 111 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 112 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 113 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 114 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 115 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 116 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 117 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 118 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 119 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 120 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 121 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 122 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 123 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 124 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 125 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 126 of 189
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 127 of 189
See Attachment C
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment D
YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrale Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 128 of 189
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT C
Property to be Searched
This warrant applies to information associated with the following Google account:
created or maintained between October 17, 2017 and the present, that is stored at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
49
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 130 of 189
ATTACHMENTD
To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c. All internet search data including all queries and location data;
50
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 131 of 189
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
I. Google Talk and Google Hangouts conversation logs associated with the
account.
51
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 132 of 189
Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
52
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 133 of 189
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment C
located in the - - - - - District of
- - -Northern California
- -- - - - - - - - - -
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment D
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Date:
.Judge 's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and litle
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 134 of 189
]: i,'
AUG - 3 2018
Clerk, U.S. ()istrlc:t & Bunkruptc}'
Courts tor the District of Columbia
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
U.S.C. § J 030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This
2
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 136 of 189
warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 27I 1(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
7. This application seeks authority to search, from the date of search warrants
previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set
"
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
8. For example, as set forth in more detail below, in recent months STONE has
reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
3
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 137 of 189
urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness who had
done information technology work for STONE during the campaign and
in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather. to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get
to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 138 of 189
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthen-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.
5
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 139 of 189
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
6
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 140 of 189
13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were
7
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 141 of 189
intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and.potential presidency. We further assess Putin and the Russian Government
b. The USIC also described, at a high level, some of the techniques that the
Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-such as cyber activity-
intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further,
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 142 of 189
activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
d. With respect to the release of stolen materials, the USIC assessed "with
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
multiple contradictory statements and false claims about his identity throughout the election.
15. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the."snapshots" to
those accounts.
17. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
9
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 143 of 189
spearphished over 100 accounts used by organizations and personnel involved in administering
19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United
20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
1
A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.
10
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 144 of 189
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by AS SAN GE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 145 of 189
26. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJ r paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,
28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted:
"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
29. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
12
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 146 of 189
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Info wars that his intennediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 147 of 189
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "S\nce I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr. Information recovered from the search of that account
a. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
14
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 148 of 189
@wikileaks immediately followed up with another message less than a minute later: "We are
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
15
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 149 of 189
37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search
October 17, 2017, Chief Judge Howell issued a search warrant for STONE' address,
(Target Account 2); and on or about March 14, 2018, Chief Judge
Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
email account. Information recovered pursuant to those search warrants includes the following:
flight schedule. Need to get something confirmed now .... " CORSI responded, ."! copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
16
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 150 of 189
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- tum him for
before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HR.Can artifact ofrigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
17
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 151 of 189
same time, STONE told him he had gone to London to meet ASSANGE also stated
that in 2018 told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol he was joking and
1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
Account 3, "Podesta paid $ l 80k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,
18
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 152 of 189
"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today." wrote back, "Awaiting secret file. Explosive ... Hope you
are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
conversation concerned possible derogatory information he was trying to obtain from Turkey.
Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,
"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total
BS hype."
19
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 153 of 189
was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a
big democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had b~en hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released
Friday, October 7, 2016, Washington Post reporter David Fahrenthold rece_ived a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a ca.JI to STONE which STONE did not answer.
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/3 ld74 7l 4-8ce5- l l e6-875e-2cl bfe943b66_story.html
20
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 154 of 189
40. At approximately 11 :53AM, STONE received a phone call from the Washington
41. At approximately 1 :42PM, STONE called CORSI and the two spoke for
42. At approximately 2: 18PM, CORSI called STONE and the two spoke for
43. At approximately 4:00PM, the Washington Post published a story regarding the
44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded message to CORSI without comment. STONE does not appear
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
CORSI, "Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 155 of 189
a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
49. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 156 of 189
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have no.w promised it to a dozen MSM reporters[.]"
51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent
STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how much money did , a controversial Russian billionaire investor with
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by , with the money transferred via Deutsche
Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52. On or about October 14, 2016, CORSI sent a message to STONE at Target
Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 157 of 189
53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1
and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted
source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.J I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3,
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
57. On or about November 8, 2016, the United States presidential election took place.
24
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 158 of 189
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3,
"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
25
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 159 of 189
26
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 160 of 189
61. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Pode_sta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 161 of 189
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this rep011, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
infotmation proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
62. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in_
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That-
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is c01Tect, even though it was repeated to me on numerous separate
occasions.
63. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
28
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 162 of 189
64. On November 19, 2017, Randy CREDI CO (who, as described further below,
Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a
subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?'.'
66. On or about November 24, 2017, STONE, using Target Account 3, texted
CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDI CO replied, "I told
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one ofus indicted for
perjury[.]"
29
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 163 of 189
67. STONE and CREDICO continued to exchange messages via Target Account 3,
and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if
4
Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
30
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 164 of 189
you ·turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDI CO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify(.]"
71. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say 1 have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th(.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73. STONE and CREDICO continued to exchange messages via Target Account 3,
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
31
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 165 of 189
stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
75. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee ... But you'll get off because you're friends with Trump so don't worry. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
76. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
77. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog-
135911370.html
6
https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
32
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 166 of 189
He was depressed about it. Or was he lying." The article noted that CREDTCO stated he did not
have prostate cancer and did not have any such discussion with STONE.
78. On May I 7, 2018, Chief Judge Howell issued an order for the use of pen-trap
devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use
Target Account 1 and Target Account 2, and that he has used them to communicate with
79. For example, STONE and communicated twice on May 28 and May
interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that '
communicated wit using Target Account 1 on June 1, 2018 and June 6, 2018.
a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
July 12,2018.
80. STONE has also used Target Account 2 to communicate with individuals
a. For example, between May 23, 2018 and the present, STONE and CORSI
exchanged at least five messages using Target Account 2. In the same time period, STONE
33
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 167 of 189
STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
with using Target Account 2. In addition, between on or about June 14, 2018 and
June 17, 2018, and STONE exchanged five emails using Target Account 2.
81. STONE has also used a phone number associated with Target Account 3 to
who had been employed by STONE during the Campaign as an information technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary fmm of communication with STONE is by text
82. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
34
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 168 of 189
subscribers to obtain email accounts at the domain names identified in the email address
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
experience, such information may constitute evidence of the crimes under investigation because
83. In my training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
35
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 169 of 189
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
85. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
86. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 170 of 189
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
87. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htip:/limages.apple.com/orivacy/docs/ legal-process-guiclelines-us.pd_f; "Create and start using an Apple ID,"
available at https://suppoct.app.Je.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.aople.com/ kb/PH12519; "iOS Security," available at
37
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 171 of 189
88. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
89. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a. Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
https://www.apple.com/business/docs/iOS Security Guid.e. pdf, and "iCloud: How Can I Use iCloud?," available at
https: //support.apple.com/kb/PH26502.
38
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 172 of 189
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
track the location of, display a message on, and wipe the contents of those devices. Find My
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
h. App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
39
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 173 of 189
90. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
92. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
40
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 174 of 189
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
41
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 175 of 189
95. Apple provides users with five gigabytes of free electronic space on iCloud, and
users can purchase additional storage space. That storage space, located oµ servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail) ; images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
96. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
42
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 176 of 189
97. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
CONCLUSION
98. Based on the forgoing, I request that the Court issue the proposed search warrant.
99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
100. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respe~
Andrew Mitchell
Special Agent
Federal Bureau of Investigation
43
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 177 of 189
/ $
/711 !l l(,t1Lt
The Honorable Beryl A. Howell
Chief United States District Judge
44
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 178 of 189
ATTACHMENT A
Property to be Searched
created or maintained between September 11, 2017 and present, that is stored at premises owned,
45
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 179 of 189
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section LA.;
46
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 180 of 189
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
47
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 181 of 189
i. All existing printouts from original storage which concern the categories identified in
subsection II.a
48
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 182 of 189
ATTACHMENT C
Property to be Searched
This warrant applies to information associated with the following Google account:
created or maintained between October 17, 2017 and the present, that is stored.at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
49
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 183 of 189
ATTACHMENT D
To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(£), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;
c. All internet search data including all queries and location data;
50
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 184 of 189
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
1. Google Talk and Google Hangouts conversation logs associated with the
account.
51
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 185 of 189
Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
52
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 186 of 189
ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:
created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.
53
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 187 of 189
ATACHMENTF
To the extent that the information described in Attachment Eis within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
ofthe United States, including any messages, records, files, logs, or infonnation that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 188 of 189
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, Jogs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
55
Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 189 of 189
Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
I, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1. All existing printouts from original storage which concern the categories identified in
subsection II.a
56
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 1 of 61
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 2 of 61
Return
Case No. : Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
created or maintained between September 11, 2017 and present, that is stored at premises owned,
45
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 4 of 61
ATTACHMENTB
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
46
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 5 of 61
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. §4(misprisionofafelony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
47
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 6 of 61
i. All existing printouts from original storage which concern the categories identified in
subsection II.a
48
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 7 of 61
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment C
located in the - - - - - District of
- - -Northern California
- -- - - - - - - - - -
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment D
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Date:
.Judge 's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and litle
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 8 of 61
]: i,'
AUG - 3 2018
Clerk, U.S. ()istrlc:t & Bunkruptc}'
Courts tor the District of Columbia
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contain communications relevant to
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This
2
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 10 of 61
warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a comt of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
7. This application seeks authority to search, from the date of search warrants
previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
8. For example, as set forth in more detail below, in recent months STONE has
reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
3
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 11 of 61
urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness who had
in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get
to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
AS SAN GE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed
responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 12 of 61
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape of then-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.
5
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 13 of 61
PROBABLE CAUSE.
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
6
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 14 of 61
13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
Government directed the recent compromises of emails from .US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were
7
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 15 of 61
intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
that only Russia's senior-most officials could have authorized these activities.
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
aimed at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
b. The USIC also described, at a high level, some of the techniques that the
Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-·such as cyber activity-
intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further1
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 16 of 61
activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
d. With respect to the release of stolen materials, the USIC assessed "with
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
multiple contradictory statements and false claims about his identity throughout the election.
15. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
16. For example, in or around September 2016, these individuals successfully gained
September,"these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
17. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
9
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 17 of 61
19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United
20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
I
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors. The media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
-In that post, Guccifer 2.0 also began releasing hacked DNC documents.
21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
1
A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.
10
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 18 of 61
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
served as an intermediary.
24. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
11
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 19 of 61
26. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
27. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,
"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE] , the public [could] expect to see much more from the exiled
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
29. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had schec;luled for the next day from the balcony
12
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 20 of 61
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJ r
32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
34. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
13
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 21 of 61
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr. Information recovered from the search of that account
a. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending WikiLeaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends ar·e."
14
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 22 of 61
@wikileaks immediately followed up with another message less than a minute later: "We are
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
15
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 23 of 61
37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search
October 17, 2017, Chief Judge Howell issued a search warrant for STONE' address,
(Target Account 2); and on or about March 14, 2018, Chief Judge
Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
email account. Information recovered pursuant to those search warrants includes the following:
flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
with the title, "Roger -- why don't you look this over before I send i I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
16
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 24 of 61
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- turn him for
before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
17
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 25 of 61
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting ASSANGE. STONE tol he was joking and
1: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
Account 3, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,
18
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 26 of 61
"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today." wrote back, "Awaiting secret file. Explosive ... Hope you
are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
conversation concerned possible derogatory information he was trying to obtain from Turkey.
Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,
"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total
BS hype."
19
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 27 of 61
was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a
big democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/3 ld74714-8ce5-1 Ie6-875e-2cl bfe943b66_story.html
20
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 28 of 61
40. At approximately I I :53AM, STONE received a phone call from the Washington
41. At approximately I :42PM, STONE called CORSI and the two spoke for
42. At approximately 2:18PM, CORSI called STONE and the two spoke for
43. At approximately 4:00PM, the Washington Post published a story regarding the
44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded message to CORSI without comment. STONE does not appear
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 29 of 61
a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
48. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
49. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via Target Account 1: "Got them and used them."
50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
22
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 30 of 61
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent
STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how much money did a controversial Russian billionaire investor with
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by with the money transferred via Deutsche
Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52. On or about October 14, 2016, CORSI sent a message to STONE at Target
Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
23
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 31 of 61
53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1
and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted
source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offT.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3,
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
57. On or about November 8, 2016, the United States presidential election took place.
24
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 32 of 61
"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
25
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 33 of 61
26
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 34 of 61
61. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic asse1tions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the ban-el. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta' s email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 35 of 61
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
. Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
62. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only refe1Ting to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
63. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an miicle on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
28
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 36 of 61
64. On November 19, 2017, Randy CREDICO (who, as described further below,
Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDlCO responded, "Ha ha."
65. On or about November 21, 2017, CRED ICO messaged STONE on Target
Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a
subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?"
66. On or about November 24, 2017, STONE, using Target Account 3, texted
CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "Itold
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuffl.] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"
29
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 37 of 61
67. STONE and CREDICO continued to exchange messages via Target Account 3,
and on November 24, 2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is
received from HPSCT that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely []
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if
4
Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
30
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 38 of 61
you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you 're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify[.]"
71. STONE and CREDICO continued to message each other on or about December I,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
73. STONE and CREDICO continued to exchange messages via Target Account 3,
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
31
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 39 of 61
stating: "Embassy logs ... + 17 other pieces of information prove that r did not have any
75. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee . .. But you' 11 get off because you' re friends with Trump so don't worry. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
76. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
. from you," referring to CREDICO's therapy dog. CREDICO stated that it was "ce1iainly scary .
77. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog-
l 359 l l370.html
6
https ://www.motherjones.com/politics/20 18/05/ro ger-stone-to-associate-prepare-to-d ie/
32
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 40 of 61
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
78. On May 17, 2018 , Ghief Judge Howell issued an order for the use of pen-trap
devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use
Target Account 1 and Target Account 2, and that he has used them to communicate with
79. For example, STONE and communicated twice on May 28 and May
interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that
communicated wit using Target Account 1 on June 1, 2018 and June 6, 2018
a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described fmther below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
80. STONE has also used Target Account 2 to communicate with individuals
a. For example, between May 23, 2018 and the present, STONE and CORSI
exchanged at least five messages using Target Account 2. In the same time period, STONE
33
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 41 of 61
STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
wit using Target Account 2. In addition, between on or about June 14,2018 and
June 17, 2018 and STONE exchanged five emails using Target Account 2.
81. STONE has also used a phone number associated with Target Account 3 to
who had been employed by STONE during the Campaign as an information technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary form of communication with STONE is by text
82. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
34
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 42 of 61
subscribers to obtain email accounts at the domain names identified in the email address
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
experience, such information may constitute evidence of the crimes under investigation because
83. In my training and experience, email Providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
transactional information about the creation and use of each account on their systems. This
info1mation can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
35
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 43 of 61
(such as logging into the account via the Providers ' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
85. In my training and experience, in some cases, email account users will
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
86. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
36
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 44 of 61
info1mation maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
87. In my training and experience, information such as search history can help to
show the state of mind of an individual at the time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at http://images.apple.com/ privacy/docs/lee.al-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.app le.oom/en-us/HT203993; "iCloud," available at http://www.appl e.com/icloud/; "What
does iCloud back up?," available at https://supporl.apple.com/kb/PH125 l9; "iOS Security," available at
37
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 45 of 61
88. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
89. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the services include email, instant messaging, and file storage:
a. Apple provides email service to its users through email addresses at the
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
https://"1ww.apple.com/business/docs/iOS Security Guide.pd£, and "iCloud: How Can I Use iCloud?," available at
l1t1ps://supporl.npple.com/kb/PH26502.
38
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 46 of 61
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize boolanarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
track the location of, display a message on, and wipe the contents of those devices. Find My
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
h. App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
39
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 47 of 61
90. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
91. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
92. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
40
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 48 of 61
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.
94. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, and information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
41
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 49 of 61
95. Apple provides users with five gigabytes of free electronic space on iC[oud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
96. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
42
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 50 of 61
97. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Google to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A, C, and
will review that information to locate the items clescribed in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
CONCLUSION
98. Based on the forgoing, I request that the Court issue the proposed search warrant.
99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
100. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Res~ ~
Andrew M i t c h e l l ~
Special Agent
Federal Bureau of Investigation
43
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 51 of 61
k//~fdttt7~
fe 1
The Honora Ber; l A. Howell
Chief United States District Judge
44
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 52 of 61
ATTACHMENT A
Property to be Searched
created or maintained between September 11, 2017 and pr~sent, that is stored at premises owned,
45
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 53 of 61
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section LA. above;
c; All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section LA,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section LA, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
46
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 54 of 61
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S .C. § 3 (accessory after the fact) , 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June I,
2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
47
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 55 of 61
ATTACHMENT D
To the extent that the information described in Attachment C is within the possession,
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section I.A. above;
c. All internet search data including all queries and location data;
50
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 56 of 61
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
1. Google Talk and Google Hangouts conversation logs associated with the
account.
51
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 57 of 61
Any and all records that relate in any way to the accounts described in Attachment C which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); ·1s U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
, Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
1.. All existing printouts from original storage which concern the categories identified in
subsection II.a
52
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 58 of 61
ATTACHMENT E
Property to be Searched
This warrant applies to information associated with the following Apple DSID:
created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.
53
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 59 of 61
ATACHMENTF
To the extent that the information described in Attachment E is within the possession,
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(£), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment E:
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEi");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
54
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 60 of 61
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCJoud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and book.marks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and book.marks;
f. . All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
j. . All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
55
Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 61 of 61
Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U .S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of_justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
a. All records, information, documents or tangible materials that relate in any way to
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
g. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
i. All existing printouts from original storage which concern the categories identified in
subsection II.a
56
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 1 of 48
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 21, 2018 (not to exceed 14 days)
r/ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell , Chief U.S. District Judge
(United States Magistrate Judge)
D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriale box)
D for _ _ days (not to exceed 30) D until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
- - - - - - - - - - -- - - Printed name and title
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 2 of 48
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
-1-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 4 of 48
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(±), Google is required to disclose the following
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 5 of 48
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 6 of 48
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 7 of 48
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 8 of 48
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
1. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 9 of 48
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A
located in the District of California , there is now concealed (identify the
- - - Northern
- - --- ---- -- -- -- - -
person or describe the property to be seized) :
See Attachment B
The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
~ evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
jl<yle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI
Printed name and title
City and state: Washington, D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 10 of 48
FILE
AUG -8 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District and
Bankruptcy Courts
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
disclosed by Google and searched by the government is described in the following paragraphs and
in Attachments A and B.
2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. ,Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-: 1-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 11 of 48
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121 (a)(I )(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U .S.C.
§ 271 I (3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
-2-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 12 of 48
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 13 of 48
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these tyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 14 of 48
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to mbve the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
-5-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 15 of 48
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:l 8-cr-00125).
19. On June 14, 2016, Crowd Strike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[tJhe main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
-6-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 16 of 48
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
-7-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 17 of 48
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
-8-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 18 of 48
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
-9-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 19 of 48
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 20 of 48
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's l addresses,
warrant for s email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 21 of 48
with the title, "Roger -- why don't you look this over before I send " I believe that
. CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: h should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist - turn him for
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
-12-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 22 of 48
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018 told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
: "Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
-13-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 23 of 48
50. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
52. On or about September 24, 2016 emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today. wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't ~ait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
-14-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 24 of 48
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
55. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a big
democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
-15-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 25 of 48
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn 't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60. At approximately 11 :53AM, STONE received a phone call from the Washington
61. At approximately 1:42PM, STONE called CORSI and the two spoke for
62. At approximately 2:18PM, CORSI called STONE and the two spoke for
63. At approximately 4:00PM, the Washington Post published a story regarding the
64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31 d74714-8ce5-l l e6-875e-2cl bfe943b66_story.html
-16-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 26 of 48
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
-17-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 27 of 48
financially Podesta personally and the Clintons through the Clinton Foundation."
69. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
lik skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
-18-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 28 of 48
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent b , with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. lf HRC wins, Assange can
-19-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 29 of 48
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
77. On or about November 8, 2016, the United States presidential election took place.
78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
79. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-20-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 30 of 48
-21-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 31 of 48
87. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing"was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
-22-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 32 of 48
such asse11ions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
88. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confamed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
89. In the month that followed his testimony before HP SCI, on or about October 24,
2017, STONE published an ai1icle on his website, stonecoldtruth.com, titled "Is it the Podesta's
-23-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 33 of 48
Time in the Barrel Yet?" In that article, STONE stated: "[J]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
90. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
91. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me . It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
-24-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 34 of 48
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
93. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
95. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely []
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June i2, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credi co never said he knew or had any information as to source or
96. On or about December 1, 2017, CREDI CO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for petjury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything
4
Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-25-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 35 of 48
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of petjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back .. ·. and amend your testimony and tell them the truth." CREDI CO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
97. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
99. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDI CO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
-26-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 36 of 48
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
101. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
102. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
103. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the a11icle, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-135911370.html
6
https ://www .motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-27-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 37 of 48
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
" The recovery email for the Target Account is STONE' l account,
that the last login to the Target Account occurred on May 17, 2018.
which was created on October 27, 2015, with the verified telephone numbe
Counsel's Office on or about Friday, May 18, 201 told investigators that he
became STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as
individuals to post social media content to Facebook and Twitter, and that he ) and
STONE both instructed these individuals about what to post. stated that he
purchased a couple hundred fake Face book accounts as part of this work (including both new
and existing accounts), and that bloggers working for STONE would try to build what looked
like real Facebook accounts. 7 further stated that STONE wanted to push out
7
Face book requires that all users of Facebook accounts use their actual name while registering
-28-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 38 of 48
WikiLeaks content through his Facebook and Twitter accounts, and that content related to the
stolen Podesta emails was pushed out through STONE's Facebook and Twitter accounts.
107. On or about August 2, 2018, Chief Judge Howell issued a search warrant for the
2570).
108. Search warrant returns for STONE's Hotmail account contain a number of emails
entities, including Facebook and Twitter. Although it is not clear from the face of the emails
how they ended up in STONE l account, 8 they may have been auto-forwarded or
otherwise imported from the Target Account into th l account. These emails include at
least one receipt sent on or about June 30, 2016, from Facebook to the Target Account for a
109. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
8
Investigators have been unable to access the full headers for these emails.
9
told investigators that he would sometimes send emails from STONE's account.
-29-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 39 of 48
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account's
user or users.
110. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
111. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
-30-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 40 of 48
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
112. In my training and experience, in some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user ::is ::i
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
113. This application seeks a warrant to search all responsive records and information
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
whether such communication, record, or other information is stored, held, or maintained outside
114. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
-31-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 41 of 48
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
-32-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 42 of 48
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
116. Based on the forgoing, I request that the Court issue the proposed search warrant.
117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
118. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~ape ~
Andrew Mitchell
Special Agent
Federal Bureau oflnvestigation
6//W
The Honorable Beryl A. Howell
Chief United States District Judge
-33-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 43 of 48
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
-1-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 44 of 48
ATTACHMENTB
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 45 of 48
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
i. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usernames and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 46 of 48
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 47 of 48
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 48 of 48
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 1 of 50
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 21, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United Stales Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 2 of 50
Return
Case No .: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
-1-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 4 of 50
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
A. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;
B. The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;
C. All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;
D. All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;
E. All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the usemame associated with the account (i.e., "mentions" or "replies");
F. All photographs and images in the user gallery for the account;
G. All location data associated with the account, including all information collected by the
"Tweet With Location" service;
H. All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;
I. All data and information that has been deleted by the user;
J. A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);
-2-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 5 of 50
0. All records of Twitter searches performed by the account, including all past searches saved
by the account;
P. All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;
Q. All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;
R. All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;
S. All data and information associated with the profile page, including photographs;
T. All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;
U. The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;
V. All transactional records associated with the account, including any IP logs or other records
of session times and durations;
W. Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
information regarding the types of devices used to access the account;
Y. All location information for the account, including all location data collected by any
plugins or widgets;
-3-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 6 of 50
AA. All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;
BB. All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;
CC. All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;
DD. All data and information that has been deleted by the user;
EE. The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);
FF. All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;
GG. Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identifier;
HH. Information regarding accounts linked to accounts to which the Target Accounts are linked;
II. All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 7 of 50
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 8 of 50
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
1. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 9 of 50
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A
located in the
- - -Northern
- - -- - District of
---- -California
-- -- - -- , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B '
The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
ri evidence of a crime;
ri contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
---- 4,t;,u~
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 10 of 50
FILE D
IN THE UNITED STATES DISTRICT COURT AUG -8 201B
F R TI-IB !STRICT OF OLUMBIA Clertc, U.S. District and
Bankrupt~y Cour-t
IN THE MATIER F 1 J' SEARCH OF Case: 1:18- sc- 02596
INFORMATION A S CIATED WITH Ass!gned To : Howell, Beryl A.
ONE ACCOUN1 STORED AT PREMISES Assrgn. Date : 8/8/2018
CONTROLLED BY TWITTER Description: Search & Seizure Warrant
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
searched by the government is described in the following paragraphs and in Attachments A and B.
2. I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-1-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 11 of 50
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
-2-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 12 of 50
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 13 of 50
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
-4-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 14 of 50
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
-5-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 15 of 50
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
-6-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 16 of 50
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
-7-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 17 of 50
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part of WikiLeaks' 10-year anniversary celebration - STONE told lnfowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
-8-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 18 of 50
think there's at least a reasonable belief that (Assange] may have passed this information on to
(STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-9-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 19 of 50
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
-I 0-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 20 of 50
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one of STONE' addresses,
warrant fo email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
with the title, "Roger -- why don't you look this over before I send i I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
-11-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 21 of 50
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read should see
Assange[.] should find Bernie [S]anders brother who ·called Bill a Rapist - tum him for
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSJ's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
-12-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 22 of 50
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE also stated
that in 2018 told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol he was joking and
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
50. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
-13-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 23 of 50
52. On or about September 24, 2016 emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
-14-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 24 of 50
55. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a big
democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d74714-8ce5-11 e6-875e-2c 1bfe943b66_story.html
-15-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 25 of 50
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
60. At approximately 11 :53AM, STONE received a phone call from the Washington
61. At approximately l :42PM, STONE called CORSI and the two spoke for
62. At approximately 2:18PM, CORSI called STONE and the two spoke for
63. At approximately 4:00PM, the Washington Post published a story regarding the
64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
-16-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 26 of 50
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
usin emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
68. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
69. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
-17-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 27 of 50
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo-Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to.post on Podesta since I have now promised it to a dozen MSM reporters[.]"
71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
-18-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 28 of 50
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
73. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[ .]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
-19-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 29 of 50
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
77. On or about November 8, 2016, the United States presidential election took place.
78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
79. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-20-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 30 of 50
-21-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 31 of 50
87. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21 , 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
-22-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 32 of 50
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
info1mation proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
88. In a document dated March 26, 2018 titled "Minority Views," Democratic
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confomed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
89. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
-23-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 33 of 50
90. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
91. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the UNC stutll.J 1just followed his tweetsl.J" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
-24-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 34 of 50
93. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
95. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
96. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights if u don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of perjury[.] But I'm sure
4
Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-25-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 35 of 50
that wasn't sworn testimony so you're probably clear[.]' Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied; "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
97. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
99. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would.do my show[.] That was my
initial contact."
-26-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 36 of 50
logs ... + 17 other pieces of information prove that I did not have any conversations with
101. CREDI CO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
102. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
103. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
5
https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-l359113 70.html
6
https://www .motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-27-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 37 of 50
by investigators from the Special Counsel's Office told investigators that he became
STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
post social media content to Facebook and Twitter, and that he ) and STONE both
instructed these individuals about what to post. stated that he purchased a couple
hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.
106. further stated that STONE wanted to push out WikiLeaks content
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
Search warrant returns for STONE's Hotmail account contain emails from Twitter about Target
. Although it is not clear from the face of the emails how they
ended up in STONE's Hotmail account, 7 they may have been auto-forwarded or otherwise
7
Investigators have been unable to access the full headers for these emails.
-28-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 38 of 50
108. Tweets associated with the Target Account, which are publicly available, include
the retweeting of content related to WikiLeaks, STONE's testimony before the House
Intelligence Committee, and the hacking of the DNC. The Target Account was also used to
retweet content with the hashtag #FreeAssange! The Target Account is listed as having been
109. In my training and experience, I know that, in addition to posting content and
purchasing advertisements, Twitter accounts can be used to communicate privately and directly
with other users through Twitter's direct messaging function. As noted above, STONE used at
least one other Twitter account, @RogerJStoneJr, to communicate with WikiLeaks and
110. Twitter owns and operates a free-access social-networking website of the same
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a· photo of themselves, and location
information. Twitter also permits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
11 I. Upon creating a Twitter account, a Twitter user must create a unique Twitter
usemame and an account password, and the user may also select a different name of 20
8
was also used to register a Facebook account. This Court
authorized a search of that Facebook account on or about August 2, 20 I 8 (I: 18-sw-2570).
-29-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 39 of 50
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.
112. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
113. A Twitter user can post a personal photograph or image (also known as an
"avatar") to his or her profile, and can also change the profile background or theme for his or her.
account page. In addition, Twitter users can post ·"bios" of 160 characters or fewer to their profile
pages.
114. Twitter also keeps IP logs for each user. These Jogs contain information about the
user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
115. As discussed above, Twitter users can use their Twitter accounts to post "Tweets"
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
-30-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 40 of 50
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
116. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that the user has shared on Twitter,
117. Twitter users can also opt to include location data in their Tweets, which will
reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
118. When Twitter users want to post a Tweet that includes a link to a website, they
can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
119. A Twitter user can "follow" other Twitter users, which means subscribing to
those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
-31-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 41 of 50
120. In addition to posting Tweets, a Twitter user can also send Direct Messages
(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
121. Twitter users can configure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
122. Twitter includes a search function that enables its users to search all public
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
123. Twitter users can connect their Twitter accounts to third-party websites and
applications, which may grant these websites and applications access to the users' public Twitter
profiles.
124. If a Twitter user does not want to interact with another user on Twitter, the first
user can "block" the second user from following his or her account.
125. In some cases, Twitter users may communicate directly with Twitter about issues
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
-32-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 42 of 50
for breaching Twitter's terms of service, during which time the Twitter user will be prevented
126. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
-33-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 43 of 50
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
127. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other account
information.
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
129. Based on the forgoing, I request that the Court issue the proposed search warrant.
130. Pursuant to 18 U .S.C. § 2703(g), the presence of a law enforcement officer is not
131. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
-34-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 44 of 50
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Andrew Mitchell
Special Agent
Federal Bureau of Investigation
~!fA;qp
The Honorable Beryl A. Howell
Chief United States District Judge
-35-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 45 of 50
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
-1-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 46 of 50
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession;
custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following
A. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;
B. The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;
C. All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;
D. All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;
E. All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");
F. All photographs and images in the user gallery for the account;
G. All location data associated with the account, including all information collected by the
"Tweet With Location" service;
H. All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;
I. All data and information that has been deleted by the user;
J. A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);
-2-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 47 of 50
0. All records of Twitter searches performed by the account, including all past searches saved
by the account;
P. All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;
Q. All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;
R. All past and current usemames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;
S. All data and information associated with the profile page, including photographs;
T. All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;
U. The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;
V. All transactional records associated with the account, including any IP logs or other records
of session times and durations;
W. Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
information regarding the types of devices used to access the account;
Y. All location information for the account, including all location data collected by any
plugins or widgets;
-3-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 48 of 50
AA. All information about the account's use of Twitter' s link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;
BB. All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;
CC. All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;
DD. All data and information that has been deleted by the user;
EE. The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);
FF. All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;
GG. Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
identifier, or any other account or device identifier;
HH. Information regarding accounts linked to accounts to which the Target Accounts are linked;
II. All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 49 of 50
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5 -
Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 50 of 50
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 1 of 33
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before September 3, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Rudolph Contreras-, U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued: if_dJ!J(J.&18 3: l?t t'\L / Judge 's signature
City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 2 of 33
Return
Case No. : Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following l&I Mail account, whic;h
is stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, Inc., a
-1-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 4 of 33
ATTACHMENT B
To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 5 of 33
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All device information associated with the account, including all instrument or
j. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
-3-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 6 of 33
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
c. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
d. Evidence indicating the account owner's state of mind as it relates to the crimes
under investigation;
e. The identity of the person(s) who created or used the account, including records
principals;
-4-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 7 of 33
h. Communications, recorqs, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
i. The identity of any non-U.S. person(s)-including records that help reveal the
J. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
-5-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 8 of 33
AO 106 (Rev. 04/10) Application for a Search Warrant
l
(Briefly describa the property to be searched
or identify the person by name and oddres!i) Ass!gned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH ONE ACCOUNT Assign. Date: 8/20/2018
STORED AT PREMISES CONTROLLED BY 1&1 MAIL &
MEDIA, INC.
Description: Search & Seizure Warrant
)
See Attachment A
located in the -------
Eastern District of Pennsylvania
----"--''--"-...c...r...;_..:....:.._;~- - -
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
M evidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
!Kyle R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI
Printed name and title
Date: er
City and state: Washington, D.C. Hon. Rudolph Contreras, U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 9 of 33
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("1&1 Mail"), a
Mail and searched by the government is described in the following paragraphs and in Attachments
A and B.
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
-1-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 10 of 33
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
U.S.C. § 951 (acting as an unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of
a protected computer), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban).
There also is probable cause to search the information described in Attachment A for evidence,
Attachment B.
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
6. On June 14, 2016, the cybersecurity firm CrowdStrike, Inc. and its affiliates
("CrowdStrike") published a blog post entitled, "Bears in the Midst: Intrusion into the
-2-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 11 of 33
Democratic National Committee." 1 In the blog post, CrowdStrike described how the firm "was
called by the Democratic National Committee (DNC), the formal governing body for the US
Democratic Party, to respond to a suspected breach." According to CrowdStrike, the cyber actor
known as "Fancy Bear" breached the DNC network in 2016. CrowdStrike further assessed:
"Extensive targeting of defense ministries and other military victims [by FANCY BEAR] has
been observed, the profile of which closely mirrors the strategic interests of the Russian
government, and may indicate affiliation with f'nasttoe Pa:rne,ri:hrnaTeJihHoe Yrrpasnem1e (Main
compromise both the work and personal email accounts of numerous individuals involved in the
2016 U.S. presidential campaign through "spearphishing" efforts. In this context, spear phishing
refers to the fraudulent practice of sending an email that purports to be from a known or trusted
sender in order to induce the targeted victim to respond in a desired manner, typically by clicking
a malicious link or URL. The perpetrators used Bitly, a link-shortening and management service,
to disguise the malicious URLs. Victims of these spearphishing efforts included John Podesta, the
chairman of the Clinton Campaign, who received a spearphishing email on or about March 19,
2016. The email contained a Bitly link created by the Bitly account john356gh, which the FBI has
8. On or about September 20, 2016, Crowd Strike also identified a new intrusion into
the DNC's virtual private cloud, hosted by Amazon Web Services (AWS). CrowdStrike advised
1
"Bears in the Midst: Intrusion into the Democratic National Committee," June 14, 2016,
available at https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-
committee.
-3-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 12 of 33
the FBI that the perpetrators obtained unauthorized access to the DNC's VPC system through the
theft of an administrator credential, which gave the perpetrators the ability to modify the network's
security rules. After gaining this access, the perpetrators modified the rules that limited the
universe of devices that could connect to the victim computers. Based on its forensic analysis,
CrowdStrike determined that the perpetrators copied snapshots of the DNC's cloud-based
computers onto at least three new AWS accounts created by the perpetrators.
9. Following the inception of the spear phishing and intrusion campaigns, a series of
overlapping actors began to be release documents stolen from the DNC, DCCC, and the personal
occurred through three forums: (1) a series of accounts operated under the online persona
"Guccifer 2.0"; (2) a website and series of accounts operated under the online persona "DCLeaks";
and (3) the websites and public archives operated by the group "Wikileaks." The releases of stolen
documents discussing various components of the 2016 federal elections; and confidential
correspondences of the DNC and DCCC, as well as individuals involved in the presidential
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." 2 In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith .in the US
2
"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_20l 7_01.pdf.
-4-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 13 of 33
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
11. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
12. With respect to hacking activity, the USIC assessed: "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
13. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
14. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
-5-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 14 of 33
B. Guccifer 2.0's Use of WikiLeaks to Further the Interference in the 2016 U.S.
Presidential Election
15. On June 15, 2016, the day after CrowdStrike publicly attributed the DNC hack to
Russian government actors, the persona Guccifer 2.0 published its first post on a WordPress
blog, publicly claiming responsibility for the hack. The post, titled "GUCCIFER 2.0 DNC'S
2.0 represented as "docs I downloaded from the Democrats network." Guccifer 2.0 also stated in
the same post that, with respect to the documents stolen from the DNC, "[t]he main part of the
papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
organization, which is responsible for releasing stolen documents from a number of government
around 2006, and he has stated in public interviews that he is deeply involved in running the
organization.
17. On or about June 20, 2016, Guccifer 2.0 registered the Twitter account
@GUCCIFER_ 2. Search warrant returns for that Twitter account show that Guccifer 2.0
communicated via direct message with WikiLeaks' Twitter account, @wikileaks, about the stolen
DNC documents, including about ways to maximize the impact of the documents on the 2016
U.S. presidential election. For example, on or about June 22, 2016, WikiLeaks sent a private
message to Guccifer 2.0, via Twitter, telling Guccifer 2.0 to "[s]end any new material [stolen
from the DNC] here for us to review and it will have a much higher impact than what you are
doing." On or about July 6, 2016, WikiLeaks stated, "if you have anything hillary related we
want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National
Convention] is approaching and she will solidify Bernie supporters behind her after." Guccifer
-6-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 15 of 33
2.0 responded, "ok ... I see." WikiLeaks explained, "we think trump has only a 25% chance of
winning against Hillary ... so conflict between Bernie and Hillary is interesting."
Target Account conducted in or around August 2016, I know that on or about July 14, 2016,
Guccifer 2.0 sent WikiLeaks an email with an attachment titled "wk dnc linkl .txt.gpg." Search
warrant returns for the Guccifer 2.0 Twitter account show that Guccifer 2.0 then sent a direct
message to WikiLeaks that appears to explain that the encrypted file contained instructions on
how to access an online archive of stolen DNC documents. On or about July 18, 2016,
WikiLeaks confirmed it had "the 1Ob or so archive" and would make a release of the stolen
19. On or about July 22, 2016, WikiLeaks released over 20,000 emails and other
documents stolen from the DNC network. This release occurred approximately three days before
the start of the Democratic National Convention. WikiLeaks did not disclose Guccifer 2.0's role
in providing them.
20. On or about October 7, 2016, WikiLeaks released the first set of emails that had
been stolen from John Podesta, chairman of the Clinton Campaign. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately thirty-three tranches
of documents that had been stolen from Podesta. Based on an assessment of the WikiLeaks
releases, investigators believe that the total amount of stolen election-related data released by
WikiLeaks was substantially greater than the 1GB of stolen data apparently contained in the
-7-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 16 of 33
21. In an August 2017 interview, AS SANGE indicated that only a small number of
people, including himself, worked on the release of the DNC emails. 3 Based on public source
information, I know that AS SANGE made false and misleading statements about the origins of
the stolen documents, including statements that insinuated that WikiLeaks had received them
including via intermediaries, about the stolen documents with Roger J. Stone ("STONE"), who
advised the presidential campaign of Donald J. Trump in 2015 and who remained in contact with
individuals employed by the campaign through the 2016 election. For example, search warrant
returns for STONE's Hotmail account , show that on or about July 25,
2016, STONE directed one of his associates, Jerome CORSI, to "[g]et to Assange [a]t the
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... ." On or about July
31, 2016, Stone reached out again to CORSI, suggesting that he should "see Assange." A few
days later, on or about August 2, 2016, CORSI emailed STONE, "Word is friend in embassy
plans 2 more dumps. One shortly after I'm back 2nd in Oct[ober]. Impact planned to be very
damaging .... " I believe that CORSl's reference to a "friend in [the] embassy" refers to
ASSANGE.
23. According to subscriber information obtained from WordPress in July 2016, the
Guccifer 2.0 WordPress account ) was created on June 15, 2016 using
3
See https://www.newyorker.com/magazine/2017/08/21/julian-assange-a-man-without-a-country
-8-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 17 of 33
another email address on the account. Subscriber records for the Target Account indicate that it
24. The FBI searched the Target Account in approximately August 2016 pursuant to
2017, the government obtained additional non-content information about the Target Account
pursuant to 18 U.S.C. § 2703(d), which included header information for the period of time
between approximately August 2016 and September 2017. The header information shows that
the Target Account continued to receive emails through at least approximately February 25,
2017, including emails from WordPress and the file sharing services DropBox and MediaFire,
which were not captured in the original court-authorized search conducted in August 2016.
25. Subscriber records obtained from l&l Mail in August 2018 show that the Target
Account is still active (that is, it has not been deleted). The last login is listed as October 18,
2016. Records from the Target Account will, among other things, assist investigators in
understanding Guccifer 2.0's use of file sharing services, which may in turn assist investigators
in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks
and others.
26. In my training and experience, I have learned that l&l Mail provides a variety of
on-line services, including electronic mail ("email") access, to the public. 1& 1 Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target
Account. Subscribers obtain an account by registering with l&l Mail. During the registration
process, 1& 1 Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1& 1 Mail are likely to contain stored electronic communications (including retrieved
-9-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 18 of 33
and unretrieved email for l&l Mail subscribers and information concerning subscribers and their
use of 1& 1 Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
27. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
28. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,
-10-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 19 of 33
IP address information can help to identify which computers or other devices were used to access
29. In my training and experience, m some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
30. This application seeks a warrant to search all responsive records and information
under the control of l&l Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
31. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
-11-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 20 of 33
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
32. Because there is probable cause to believe that the Target Account is an
operational account created to further criminal conduct, this application seeks authorization to
seize the information in Attachment B from the time of the creation of the account to the present.
-12-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 21 of 33
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
CONCLUSION
34. Based on the forgoing, I request that the Court issue the proposed search warrant.
35. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
36. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
-Ei?~
Special Agent
Federal Bureau oflnvestigation
__,
rable Rudolph Contreras
United States District Judge
-13-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 22 of 33
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following l&l Mail account, which
is stored at premises owned, maintained, controlled, or operated by l&I Mail & Media, Inc., a
-1-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 23 of 33
ATTACHMENTB
To the extent that the information described in Attachment A is within the possession,
custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 24 of 33
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All device information associated with the account, including all instrument or
J. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
-3-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 25 of 33
Any and all records that relate in any way to the accounts described in Attachment A
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
c. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
d. Evidence indicating the account owner's state of mind as it relates to the crimes
under investigation;
e. The identity of the person(s) who created or used the account, including records
principals;
-4-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 26 of 33
h. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
1. The identity of any non-U.S. person(s)-including records that help reveal the
J. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
-5-
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 27 of 33
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct l&l Mail & Media, Inc. ("l&l Mail"), an electronic
Pennsylvania, not to notify any other person (except attorneys for l&l Mail for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 28 of 33
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how l&l Mail may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
1
Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 29 of 33
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in-
(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b ), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command l&l Mail not to notify any other person (except attorneys for 1&1 Mail for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
FA N-DlSCLOSURE
for violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
3
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 30 of 33
and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses"), in connection with efforts to compromise the networks
Committee ("DCCC"), and the email accounts of U.S. persons involved in the 2016 presidential
election, followed by the public release of stolen materials through various outlets.
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that l&l Mail and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for 1& 1 Mail for the purpose of receiving
legal advice) for a period of one year or until further order of the Court. Such an order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant
and related papers may also alert the targets to the scope of information known to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
4
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 31 of 33
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S .C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with l&l Mail, the United States is aware that, absent a
court order under Section 2705(b) commanding l&l Mail not to notify anyone about a legal
request, 1& 1 Mail may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
1& 1 Mail not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for 1& 1 Mail for the purpose of receiving legal advice) for a period of one year
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 32 of 33
AUG 2o2018
Clerk, U.S. District & Bankruptcy
IN THE UNITED STATES DISTRICT COURT Courts tor the District of Columbia
FOR THE DISTRICT OF COLUMBIA
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require l&l Mail & Media, Inc. ("1&1 Mail"), an electronic communication and/or remote
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 33 of 33
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C . § 2705(b), l&l Mail and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for I & I Mail for the purpose of receiving legal advice) for a period of one year or until
//L--
BLE RUDOLPH CONTRERAS
TES DISTRICT JUDGE
oG)oJdfl_c (
2
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 1 of 35
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 31, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 2 of 35
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the cellular telephone assigned call
-1-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 4 of 35
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.
§ 2703(f), the Provider is required to disclose to the government the following information
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through
1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
viii. Means and source of payment for such service (including any credit card
or bank account number) and billing records.
-2-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 5 of 35
b. All records and other information (not including the contents of communications)
including:
11. information regarding the cell tower and antenna face (also known as
Any and all records that relate in any way to the accounts described in Attachment A which
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
-3-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 6 of 35
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A
located in the - - - -- District of - - --
- --Southern Florida
- - - - - -- -
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
0 property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
c_A~,-
.c.-
1. ~ ,..--·-~~-
pp 1ca11 s signature
Date: _ 8_µg!_)i}( (
/ Judge's signature
City and state: Washington, D.C. Hon. Rudolph Contreras, U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 7 of 35
~Il
AUG 2 o 2018
Clork, U.S. District & Baok1optcy
IN THE UNITED STATES DISTRICT COURT Courts for the blstrlct of Columbia
FOR THE DISTRICT OF COLUMBIA
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a
service provider headquartered in North Palm Beach, Florida. The information to be disclosed by
AT&T and searched by the government is described in the following paragraphs and in
Attachments A and B.
2. I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have been
since 2011. As a Special Agent of the FBI, I have received training and experience in investigating
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and does
4. Based on my training and experience and the facts as set forth in this affidavit; there
- 1-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 8 of 35
is probable cause to believe that violations of the following statutes have been committed or are
being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C.
§ 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 3012l(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the information
described in Attachment A for evidence of the Subject Offenses, further described in Attachment
B.
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
6. When the Government obtains records under § 2703 pursuant to a search warrant,
the Government is not required to notify the subscriber or any other person of the warrant, for such
a period as the Court deems appropriate, where there is reason to believe that such notification will
PROBABLE CAUSE
7. The Special Counsel's Office, with FBI's assistance, is investigating the Russian
government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump ("Trump Campaign"). This includes investigating Roger Stone (STONE)
-2-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 9 of 35
and others known and unknown, in connection with the hacking of email accounts associated with
(DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the
subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization
8. This application seeks cell-site location information for the Target Telephone,
used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this
corresponds to the time period during which there is evidence that STONE was engaged in, and
attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder
Julian ASSANGE about the content of stolen documents prior to their public release. During this
same time period, STONE was also in communications with members of the Trump Campaign.
1. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official relationship
with the Campaign thereafter, STONE maintained his support for Trump and continued to make
media appearances in support of the Campaign. As described further below, STONE also
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According to
-3 -
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 10 of 35
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for
the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of books
regarding Democratic presidential candidates. As described further below, CORSI was in contact
with STONE during the summer and fall of 20 I 6 regarding forthcoming disclosures of hacked
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
-4-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 11 of 35
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump.
13. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
14. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and
maintained that access until at least June 2016." The USIC attributed these cyber activities to the
Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in the
compromise of the personal e-mail accounts of Democratic Party officials and political figures. By
May, the GRU had exfiltrated large volumes of data from the DNC."
15. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
16. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
17. The Special Counsel's Office has determined that individuals associated with the
-5-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 12 of 35
GRU continued to engage in hacking activity related to the 2016 presidential election through at
18. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals used
three new accounts with the same cloud computing service to move the "snapshots" to those
accounts.
19. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
20. On or about November 1, 2016, individuals associated with the GRU spearphished
over 100 accounts used by organizations and personnel involved in administering elections in
21. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).
22. During the course of its investigation, the FBI has identified a series of searches
that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona.
In pa1iicular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress
blog), records from Google show that searches were conducted for the terms "guccifer" and
-6-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 13 of 35
"guccifer j une," from an IP address within the range 107. 77 .216.0/24. 1 This IP range is assigned
to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida.
23. IP logs obtained from Twitter show that STONE used multiple IP addresses within
24. Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about
June 13, 2018, the FBI obtained all searches conducted by the CookieIDs that conducted the
Guccifer-related searches described above. 2 Based on these results, the FBI has not yet been able
25. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on
its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part of
the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon." In
that post, Guccifer 2.0 also began releasing hacked DNC documents.
26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
1
Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range of up to 256 IP addresses.
2
Google assigns unique CookieIDs to searches conducted while a user is not logged into a Google
account. All searches conducted from the same device and browser during a 24-hour window are
associated with the same CookieID.
-7-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 14 of 35
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain to
the Clinton Foundation but there's no telling what the October surprise may be." A few days later,
STONE clarified that while he was not personally in touch with AS SANGE, he had a close friend
29. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
30. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer
-8-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 15 of 35
31. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
32. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe
that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton
aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
34. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
-9-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 16 of 35
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr to
37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"REI,,EASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link to
approximately 2,050 emails that had been hacked from John Podesta's personal email account.
39. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do. I
do believe he has all of the e-mails that Ruma Abedin and Cheryl Mills, the Clinton aides, thought
40. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing from
-10-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 17 of 35
an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 3 The latter account is the official Twitter account of WikiLeaks and has been
described as such by numerous news reports. The message read: "Sine~ I was all over national
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents
and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
42. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your operation
leaks like a sieve. You need to figure out who your friends are."
44. On or about November 9, 2016, one day after the presidential election, @wikileaks
3
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account@RogerJStoneJr.
-11-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 18 of 35
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: "Still
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from
the government and the courts ruled it was legal to do so and refused to issue an order restraining
the paper from publishing additional articles. If the US government moves on you I will bring
down the entire house of cards. With the trumped-up sexual assault charges dropped I don't know
of any crime you need to be pardoned for - best regards. R." That same day, @JulianAssange
responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest level
of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
4 7. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
-12-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 19 of 35
warrant for email account. On or about March 14, 2018, Chief Judge Howell issued
a search warrant for STONE's iCloud account. Information recovered pursuant to those search
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist - tum him for
-13-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 20 of 35
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox will
have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now.
Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential campaign
to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed
as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are
now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor
she well. I expect that much of next dump focus, setting stage for Foundation debacle."
Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
led Trnmp by 15 points. STONE responded on or about the same day, "enjoy it while u can[.] I
dined with my new pal Julian Assange last night." subsequently stated to investigators
that, around the same time, STONE told him he had gone to London to meet ASSANGE.
also stated that in 2018, told STONE he would be interviewed by the FBI
and would have to divulge the conversation about meeting ASSANGE. STONE told
-14-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 21 of 35
54. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-Iocation
"Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not over
yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm in NYC
57. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by S [bJerbank,
Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton false narrative
59. On or about September 24, 2016, emailed CORSI, "I will have much
-15-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 22 of 35
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have secure
back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again
today." wrote back, "Awaiting secret file. Explosive ... Hope you are well. Can't wait
for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted about file[.]"
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
61. On or about October 4, 2016, AS SANGE gave a press conference at the Ecuadorian
Embassy. There had been speculation in the press leading up to that event that ASSANGE would
release information damaging to then-candidate Clinton, but WikiLeaks did not make any new
releases. Instead, ASSANGE promised more documents, including information "affecting three
powerful organizations in three different states, as well as, of course, information previously
referred to about the U.S. election process." ASSANGE also stated that WikiLeaks would publish
documents on various subjects every week for the next ten weeks, and vowed that the U.S.
62. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
-16-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 23 of 35
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't cut
deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was
about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released
October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source
regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a 2005
segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling Trump's
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
67. At approximately 11 :53AM, STONE received a phone call from the Washington
5
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iev.:d-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875e-2c 1bfe943 b66_story.html
-17-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 24 of 35
68. At approximately 1:42PM, STONE called CORSI and the two spoke for
69. At approximately 2:18PM, CORSI called STONE and the two spoke for
70. At approximately 4:00PM, the Washington Post published a story regarding the
71. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked
from John Podesta that focused primarily on materials related to the Clinton Foundation. On or
about August 2, 2016, CORSI emailed STONE using "I expect that
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty minutes
later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T attacking
Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers."
using emailed Corsi asking him to "send me your best podesta links."
-18-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 25 of 35
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta
is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
75. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3 :25PM EDT, CORSI
"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
76. CORSI followed up several minutes later with another email titled, "Podesta talking
points," with the text "sent a second time just to be sure you got it." STONE emailed CORSI back
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post
under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back
to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me like
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once had
the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's Clinton
Fund account, there's no telling how much money he laundered, or where it ended up. Nothing in
-19-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 26 of 35
Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia &
Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me SOMETHING to
78. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked, "Just
how much money did a controversial Russian billionaire investor with ties to
the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank account
79. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's basically
a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
80. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."
-20-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 27 of 35
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote,
"From a very trusted source," and forwarded an email with the header information stripped out,
showing only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry,
Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that
he has a set of dead man files that include Hillary. It's what they used to call a 'Mexican stand
off[.]' Only hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
82. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails." STONE
stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear it from
Wikileaks, although Julian Assange and I share a common friend. I reported the story on my
website." STONE linked to the story he had asked CORSI to write for him on October 13, 2016
discussed above.
84. On or about November 8, 2016, the United States presidential election took place.
85. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
86. On or about November 10, 2016, CORSI messaged STONE at his iCloud account,
"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
-21-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 28 of 35
show that on numerous occasions, including in 2016, STONE provided the Target Telephone
Number to individuals as his cellular telephone number and/or the way to reach him. On or about
Target Telephone Number is "Roger J. Stone." Publicly available databases indicate the Target
Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a
88. There is evidence that STONE used the Target Phone in connection with the
a) STONE called CORSI on or about July 25, 2016 from the Target Phone, and spoke
with him for approximately twenty-six minutes. Less than roughly two hours after that call,
STONE emailed CORSI, "Get to Assange [a]t the Ecuadorian Embassy in London and get the
b) On or about July 30, 2016--one day before STONE instructed CORSI to have
called STONE on the Target Phone Number. The two spoke for approximately sixty-seven
minutes.
c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure,
STONE received a call from the Washington Post at the Target Phone Number, and shortly
thereafter, STONE had two conversations with CORSI from the Target Phone Number.
89. As set forth in Attachment B, this application seeks cell-site location information
-22-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 29 of 35
for the Target Telephone between Ju ne 14. 201 6-the day before a Google search was conducted
for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0's first public
appearance-and November 15, 2016- one week after the 2016 presidential election and less than
one week after CORSI messaged STONE about having "interesting news" for him. Given
STONE's repeated communications with and/or about the WikiLeaks releases during this time,
including discussions about the content of the documents prior to their release, there is probable
cause to believe that STONE's whereabouts during this time period will yield evidence of the
Subject Offenses under investigation. Location information for the Target Phone will assist
investigators in determining, among other things: whether STONE was in Florida at the time of
the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or
around any of the events or communications discussed above; and where STONE was on the night
he claimed he "dined" with ASSANGE. 6 Location information will also assist investigators in
identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential
90. In my training and experience, I have learned that AT&T is a company that provides
cellular telephone access to the general public. I also know that providers of cellular telephone
service have technical capabilities that allow them to collect and generate information about the
locations of the cellular telephones to which they provide service, including cell-site data, also
6
As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to
have met AS SANGE, but the FBI is investigating whether STONE may have met an intermediary
instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site
location information varies depending on the distance between towers (among other things).
Given the density of Los Angeles, I believe that cell-site location data for STONE's trip there
would assist investigators in determining, among other things, whether STONE was present at the
locations he has publicly claimed to have been.
-23-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 30 of 35
known as "tower/face information" or "cell tower/sector records." Cell-site data identifies the
"cell towers" (i.e., antenna towers covering specific geographic areas) that received a radio signal
from the cellular telephone and, in some cases, the "sector" (i.e., faces of the towers) to which the
telephone connected. These towers are often a half-mile or more apart, even in urban areas, and
can be 10 or more miles apart in rural areas. Furthennore, the tower closest to a wireless device
does not necessarily serve every call made to or from that device. Accordingly, cell-site data
provides an approximate location of the cellular telephone but is typically less precise than other
types of location information, such as E-911 Phase II data or Global Positioning Device ("GPS")
data.
91. Based on my training and experience, I know that AT&T can collect cell-site data
about the Target Telephone. Cell-site location data is typically generated only when the phone
is used to engage in communications. I also know that wireless providers such as AT&T typically
collect and retain cell-site data pertaining to cellular phones to which they provide service in their
normal course of business in order to use this information for various business-related purposes.
92. Based on my training and experience, I know that wireless providers such as
AT&T typically collect and retain information about their subscribers in their normal course of
business. This information can include basic personal information about the subscriber, such as
name and address, and the method(s) of payment (such as credit card account number) provided
by the subscriber to pay for wireless telephone service. I also know that wireless providers such
as AT&T typically collect and retain information about their subscribers' use of the wireless
service, such as records about calls or other communications sent or received by a particular
phone and other transactional records, in their normal course of business. In my training and
experience, this information may constitute evidence of the crimes under investigation because
-24-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 31 of 35
the information can be used to identify the Target Telephone user or users and may assist in the
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
CONCLUSION
94. Based on the forgoing, I request that the Court issue the proposed search warrant.
95. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
-25-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 32 of 35
96. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
c:::::~
Andrew Mitchell
Special Agent
Federal Bureau of Investigation
-26-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 33 of 35
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the cellular telephone assigned call
-1-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 34 of 35
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.
§ 2703(f), the Provider is required to disclose to the government the following information
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through
1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
vu1. Means and source of payment for such service (including any credit card
or bank account number) and billing records.
-2-
Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 35 of 35
b. All records and other information (not including the contents of communications)
including:
11. information regarding the cell tower and antenna face (also known as
Any and all records that relate in any way to the accounts described in Attachment A which
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
-3-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 1 of 56
AO 93 (Rev. 11/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)
D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box).
D for days (not to exceed 30) D until, the facts justifying, the later specific date of
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
-1-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 4 of 56
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
(a) All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
(b) All activity logs for the account and all other documents showing the user's posts
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;
(d) All profile information; News Feed information; status updates; videos,
photographs, rn:ticles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use ofFacebook applications;
-2-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 5 of 56
(e) All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;
(g) All "check ins" and other location information, including records of the user's
(h) All IP logs, including all records of the IP addresses that logged into the account;
(i) All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";
(j) All information about the Facebook pages that the account is or was a "fan" of;
(k) All past and present lists of friends created by the account;
(m) All information about the user's access and use ofFacebook Marketplace;
(o) The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);
(p) Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
-3-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 6 of 56
(s) All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
(t) All records pertaining to connnunications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
(u) All records related to advertisements and advertising conducted through the
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to connnit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 7 of 56
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
-5-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 8 of 56
J. Credit card and other financial information, including but not limited to, bills and
' 1. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 9 of 56
AUG 2 B 2018
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. Disirict & Bankruptoy
Courts. tor the District of Ga!mnhia
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
computing services provider headquartered in Menlo Park, California, not to disclose the existence
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 10 of 56
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until
ES E. BOASBERG
ISTRICT JUDGE
1/k~~
Date
2
Case
AO 106 (Rev. 04/10) 1:19-mc-00029-CRC
Application for a Search Warrant Document 29-19 Filed 04/28/20 Page 11 of 56
See Attachment A
located in the Northern District of ----~
California ----
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more}:
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ property designed for use, intended for use, or used in committing a crime;
D a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
52 U.S.C. § 30121 Foreign Contribution Ban
18 u.s.c. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Affidavit for add'I
The application is based on these facts:
See attached Affidavit.
Reviewed by AUSA/SAUSA:
4~urA{,t!,,u.__ Applicant's signature
Date: 1/1--f/;t
City and state: Washington, D.C. Hon. J
Printed name and title
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 12 of 56
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof ( collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Facebook, Inc. ("Facebook"), an electronic
California, not to notify any other person (except attorneys for Facebook for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Facebook not to notify any other person (except attorneys for Facebook for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
3
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 14 of 56
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with Facebook, the United States is aware that, absent a
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Facebook not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 15 of 56
FILED
AUG 2 8 2018
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis Heide, beingfirst duly sworn, hereby depose and state as follows:
disclosed by Facebook and searched by the government is described in the following paragraphs
2. I have been a Special Agent with the Federal Bureau of investigation for 12 years.
In the course of my duties, I have been responsible for investigating federal crimes and national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-1-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 16 of 56
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
-2-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 17 of 56
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 18 of 56
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 19 of 56
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
-5-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 20 of 56
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
-6-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 21 of 56
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
-7-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 22 of 56
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part ofWikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
-8-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 23 of 56
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
-9-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 24 of 56
account @wikileaks. l The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the govermnent and the courts ruled it was legal to do so and refused to
1On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 25 of 56
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one ofSTONE's addresses,
warrant for mail account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 26 of 56
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: " should see
Assange[.] should find Bernie [SJ anders brother who called Bill a Rapist~ turn him for
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
-12-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 27 of 56
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later -heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
-13-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 28 of 56
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S [b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan; I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
and asked: "Assange - what's he got? Hope it's good." STONE wrote
-14-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 29 of 56
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
-15-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 30 of 56
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately I :42PM, STONE called CORSI and the two spoke for
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
64. At approximately 4:00PM, the Washington Post published a story regarding the
Access Hollywoodtape.
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31d74714-8ce5- l l e6-875e-2c 1bfe943b66_story.html
-16-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 31 of 56
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of hext dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
-17-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 32 of 56
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
-18-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 33 of 56
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bankand Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 34 of 56
AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-20-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 35 of 56
-21-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 36 of 56
-22-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 37 of 56
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
-23-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 38 of 56
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "ls it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[l]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of Jolm
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
-24-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 39 of 56
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credi co never said he knew or had any information as to source or
-25-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 40 of 56
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache(.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure,
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
98. STONE and CREDICO continued to message each other on or about December I,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 41 of 56
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
5 https://www.yahoo.com/news/comedian-randy-credico-says-trurnp-adviser-roger-stone-
threatened-dog-135911370.html
-27-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 42 of 56
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
by investigators from the Special Counsel's Office. told investigators that he became
STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man. 7
post social media content to Facebook and Twitter, and that he and STONE both
instructed these individuals about what to post. tated that he purchased a couple
hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.
107. further stated that STONE wanted to push out WikiLeaks content
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
7 told investigators that he would sometimes send emails from STONE's account.
-28-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 43 of 56
108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,
the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
was created on August 17, 2015, in the name of"Falo Memo Tio." 8 STONE's Hotmail account
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
example, in the event a password is lost or compromised. Accordingly, there is probable cause
to believe that STONE controls (directly, or through an employee or associate) the email account
8 Subscriber records list the "Language Code" for the email account as "pt_BR." I believe this
indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 44 of 56
§ 2703(d). Although subscriber records indicate that the last login to the email account took
place on August 18, 2015, header information shows that the account continued to receive emails
until at least July 27, 2018, including from companies that offer advertisement placements.
111. Header information shows that the email account received multiple emails from
Facebook between approximately November 3, 2016 and November 7, 2016, shortly before the
U.S. presidential election. On or about October 5, 2016, the email account also received an
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
112. Based on a query performed through Facebook's law enforcement portal, the FBI
Facebook account. As explained further below, in my training and experience, I know that, in
addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
113. Facebook owns and operates a free-access social networking website of the same
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish
accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.
-30-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 45 of 56
114. Facebook asks users to provide basic contact and personal identifying information
to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
115. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
116. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
117. Facebook users can create profiles that include photographs, lists of personal
interests, and other information. Facebook users can also post "status" updates about their
-31-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 46 of 56
whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
118. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
119. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
'
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a Chat feature that allows users to send and receive instant messages
through Facebook. These chat communications are stored in the chat history for the account.
-32-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 47 of 56
Facebook also has a Video Calling feature, and although Facebook does not record the calls
120. If a Facebook user does not want to interact with another user on Facebook, the
first user can "block" the second user from seeing his or her account.
121. Facebook has a "like" feature that allows users to give positive feedback or connect
to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
122. Facebook has a search function that enables its users to search Facebook for
123. Each Facebook account has an activity log, which is a list of the user's posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
124. Facebook Notes is a blogging feature available to Facebook users, and it enables
users to write and post notes or personal web logs ("biogs"), or to import their biogs from other
125. The Facebook Gifts feature allows users to send virtual "gifts" to their friends that
appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are
free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.
-33-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 48 of 56
126. Facebook also has a Marketplace feature, which allows users to post free classified
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
127. In addition to the appJications described above, Facebook also provides its users
with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
128. Some Facebook pages are affiliated with groups of users, rather than one individual
user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
129. Facebook uses the term "Neoprint" to describe an expanded view of a given user
profile. The "Neoprint" for a given user can include the following information from the user's
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
130. Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
-34-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 49 of 56
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
131. Social networking providers like Facebook typically retain additional information
about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). In some cases, Facebook users may
communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
-35-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 50 of 56
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understandthe chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
133. Therefore, the computers of Facebook are likely to contain all the material
subscribers and their use ofFacebook, such as account access information, transaction information,
-36-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 51 of 56
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
135. Based on the forgoing, I request that the Court issue the proposed search warrant.
136. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
13 7. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
/;'-1,~ A~/~,b~
Curtis Heide
Special Agent
Federal Bureau ofinvestigation
-37-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 52 of 56
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
-1-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 53 of 56
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
(a) All contact and personal identifying information, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
(b) All activity logs for the account and all other documents showing the user's posts
( c) All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;
(d) All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use ofFacebook applications;
-2-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 54 of 56
(e) All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;
(g) All "check ins" and other location information, including records of the user's
(h) All IP logs, including all records of the IP addresses that logged into the account;
(i) All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";
G) All information about the Facebook pages that the account is or was a "fan" of;
(k) All past and present lists of friends created by the account;
(m) All information about the user's access and use ofFacebook Marketplace;
(o) The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);
(p) Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
-3-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 55 of 56
(s) All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
(t) All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
(u) All records related to advertisements and advertising conducted through the
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 56 of 56
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
.h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
i. The identity of the person( s) who created or used the account, including records
-5-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 1 of 49
AO 93 (Rev. 1 l/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days)
'iii in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
-1-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 4 of 49
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 5 of 49
e. All records pertaining to connnunications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 6 of 49
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 7 of 49
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 8 of 49
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
AO 106 (Rev. 04/10} Application 'for a Search Warrant
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 9 of 49
See Attachment A
located in the Northern District of _ _ _ __-C,:.:a:.:.lic.:fo::-r..n.,,ia,...__ _ _ , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
Mevidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
~ s, /I, ,,?ktA,,..___
Reviewed by AUSA/SAUSA: Applicant's signature
Date:
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
and searched by the government is described in the following paragraphs and in Attachments A
andB.
2. I have been a Special Agent with the Federal Bureau of investigation for 12 years.
In the course of my duties, I have been responsible for investigating federal crimes and national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-1-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 11 of 49
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
-2-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 12 of 49
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
.-3-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 13 of 49
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 14 of 49
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, inor around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
-5-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 15 of 49
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
-6-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 16 of 49
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thauks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using @RogerJStoneJR; STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
-7-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 17 of 49
[AS SANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. Onthe day o£the AS SANGE announcement - which was
part ofWikiLeaks' IO-year anniversary celebration- STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
-8-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 18 of 49
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture),and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
-9-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 19 of 49
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 20 of 49
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 21 of 49
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist -turn him for
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
-12-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 22 of 49
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet AS SANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?'' STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
-13-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 23 of 49
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S[b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
-14-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 24 of 49
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SAN GE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October. 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
-15-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 25 of 49
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately I :42PM, STONE called CORSI and the two spoke for
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31d74714-8ce5-11 e6-875e-2c 1bfe943b66_ story.html
-16-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 26 of 49
64. At approximately 4:00PM, the Washington Post published a story regarding the
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSl for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
-17-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 27 of 49
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the c)lannel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
-18-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 28 of 49
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17,2016, CORSI messaged STONE at his iCloud account,
.. "On Assange, can you call me now- before 2pm[.)" STONE responded, "Missed u- just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 29 of 49
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
-20-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 30 of 49
80. On or about November 10, 2016, CORSI messaged STONE at his iC!oud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 31 of 49
-22-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 32 of 49
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
-23-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 33 of 49
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occas10ns.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
-24-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 34 of 49
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what ? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post1 STONE further stated that "Credico merely[]
-25-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 35 of 49
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any inf01mation as to source or
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Charmel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 36 of 49
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't w01Ty. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
-27-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 37 of 49
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
by investigators from the Special Counsel's Office. told investigators that he became
STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
post social media content to Facebook and Twitter, and that he and STONE both
instructed these individuals about what to post. stated that he purchased a couple
hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts.
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-135911370.html
6 https://www.motherjones.com/po litics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 38 of 49
107. further stated that STONE wanted to push out WikiLeaks content
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,
the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
created on August 17, 2015, in the name of"Falo Memo Tio." 7 STONE's account
is listed as the recovery email for the Target Account. In my training and
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
7
Subscriber records list the "Language Code" for the Target Account as "pt_BR." I believe
this indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 39 of 49
110. The government obtained non-content information associated with the Target
Account pursuant to an order issued by Chief Judge Howell under 18 U.S.C. § 2703( d).
Although subscriber records indicate that the last login to the Target Account took place on
August 18, 2015, header information shows that the account continued to receive emails until at
least July 27, 2018, including from companies that offer advertisement placements.
111. Header information shows that the Target Account received multiple emails
from Facebook between approximately November 3, 2016 and November 7, 2016, shortly before
the U.S. presidential election. On or about October 5, 2016, the Target Account also received
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
112. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
-30-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 40 of 49
of the crimes under investigation because the information can be used to identify the account's
user or users.
113. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
114. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
communicate directly with an email service provider about issues relating to the account, such as
-31-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 41 of 49
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the· crimes under investigation because the information can be used to identify the
116. This application seeks a warrant to search all responsive records and information
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
whether such communication, record, or other information is stored, held, or maintained outside
117. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
-32-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 42 of 49
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the Jogged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
119. Based on the forgoing, I request that the Court issue the proposed search warrant.
120. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
-33-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 43 of 49
121. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~,~A /LA~
· ide
Special Agent
Federal Bureau oflnvestigation
-34-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 44 of 49
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
-1-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 45 of 49
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(!), Google is required to disclose the following
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, . telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 46 of 49
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 47 of 49
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 48 of 49
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 49 of 49
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
1. The identity of any non-U.S. person(s}-including records that help reveal the
m. The identity of any person(s}-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 1 of 48
AO 93 (Rev. l l/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days)
f1 in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following I & I Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by I & I Mail & Media,
-1-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 4 of 48
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), 1&1 Mail is required to disclose
the following information to the government for each account listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 5 of 48
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
i. All device information associated with the account, including all instrument or
j. For any accounts linked to the accounts listed in Attaclunent A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attaclunent A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided dming registration, methods of connecting, log files, and means and
-3-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 6 of 48
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
principals;
-4-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 7 of 48
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
-5-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 8 of 48
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
AO 106 (Rev. 04/10) Application for a Search Warrant
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 9 of 48
See Attachment A
- - - - - District of
located in the - - -Eastern _,P,_e__,n...n..s,_,y_..lv"a.._n...ia~--- , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
r.f evidence of a crime;
r.f contraband, fruits of crime, or other items illegally possessed;
fl property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
~'llzA . . ? ~ ~
Reviewed by AUSA/SAUSA: Applicant's signature
Date:
FILED
IN THE UNITED STATES DISTRICT COURT AUG 2 8 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy
Courts for tfle District of Columbia
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
stored at premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("l&l
by l&l Mail and searched by the government is described in the following paragraphs and in
Attachments A and B.
2. I have been a Special Agent with the Federal Bureau of investigation for 12 years.
In the course of my duties, I have been responsible for investigating federal crimes and national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-1-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 11 of 48
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
-2-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 12 of 48
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 13 of 48
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Goverrunent developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian goverrunent employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
-4-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 14 of 48
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own\technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
-5-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 15 of 48
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian govermnent actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
-6-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 16 of 48
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange .
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SANGE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
-7-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 17 of 48
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
-8-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 18 of 48
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta' s email ( speculation and conjecture) and the timing
or scope of their subsequent disclosures. So l am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
-9-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 19 of 48
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
1On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 20 of 48
issue an order restraining the paper from publishing additional articles. If the US govermnent
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Govermnent. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 21 of 48
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist-tum him for
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
-12-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 22 of 48
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet AS SANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3 :3 8PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
-13-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 23 of 48
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or.about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
-14-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 24 of 48
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
-15-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 25 of 48
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately 1:42PM, STONE called CORSI and the two spoke for
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31d74 714-8ce5-l l e6-875e-2c 1bfe943b66_story .html
-16-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 26 of 48
II
I
64. At approximately 4:00PM, the Washington Post published a story regarding the
l
Access Hollywood tape.
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
-17-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 27 of 48
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
-18-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 28 of 48
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[.J" STONE responded, "Missed u-just ·
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 29 of 48
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
-20-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 30 of 48
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 31 of 48
-22-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 32 of 48
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
-23-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 33 of 48
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtrnth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
-24-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 34 of 48
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Charmel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely []
-25-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 35 of 48
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]'' STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
'
-26-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 36 of 48
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
102. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
-27-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 37 of 48
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
created on November 4, 2015 in the name of Roger Stone, and the last login to the account was
May29,2018. 7
Assange:
107. For example, on or about March 21, 2018, STONE used the Target Account to
send an email with the subject, "Randy [Credico] and Me: The Truth about WikiLeaks." The
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog0135911370.html
6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
7 The customer date of birth listed in the subscriber records is not STONE's birthdate. In my
training and experience, providers such as l&l. Mail do not verify customer dates of birth.
-28-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 38 of 48
email appears to be a media blast sent to a distribution list that included STONE's Gmail account
had asked Credico to confirm that Assange had credible information on Clinton, and that Credico
"never said from whom he gained [the] confirmation, or the source, or the content of whatever
was coming."
108. At least one reporter also emailed STONE at the Target Account about
WikiLeaks and Assange. In particular, on or about May 11, 2018, a reporter with the
[email protected] about "a story on the Mueller investigation." The reporter described "a
from [STONE] that made reference to an upcoming meeting with Julian Assange." After noting
, STONE's position that no meeting with Assange ever occurred, the reporter also asked STONE,
I 09. On or about the same day, STONE responded from his Google account
stating that the email concerning a meeting with Assange was "a joke
made while trying to get off the phone." STONE also wrote, "Now would be a good time
for the Washington Post to report that the accusation there was an email that proved that I knew
about the contents of the WikiLeaks disclosures in advance has never been seen by the
110. In my training and experience, I have learned that !&I Mail provides a variety of
on-line services, including electronic mail ("email") access, to the public. l&l Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target
-29-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 39 of 48
Account. Subscribers obtain an account by registering with l&l Mail. During the registration
process, l&l Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1&1 Mail are likely to contain stored electronic communications (including retrieved
and unretrieved email for 1&1 Mail subscribers and information concerning subscribers and their
use of l&l Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute.
evidence of the crimes under investigation because the information can be used to identify the
111. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
112. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
-30-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 40 of 48
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
113. In my training and experience, m some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
114. This application seeks a warrant to search all responsive records and information
under the control of 1& I Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
115. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" ofthe criminal conduct
-31-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 41 of 48
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent. (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
-32-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 42 of 48
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
117. Based on the forgoing, I request that the Court issue the proposed search warrant.
118. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
119. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
'
/~ /-1 . .d-1; ~
~ d e '1'
Special Agent
Federal Bureau ofinvestigation
-33-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 43 of 48
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following l&l Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by l&l Mail & Media,
-1-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 44 of 48
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), l&l Mail is required to disclose
the following information to the government for each account listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 45 of 48
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
i. All device information associated with the account, including all instrument or
J. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
-3-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 46 of 48
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
. b. All records, information, documents or tangible materials that relate in any way to
principals;
-4-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 47 of 48
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
-5-
Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 48 of 48
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 1 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 2 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 3 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 4 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 5 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 6 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 7 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 8 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 9 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 10 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 11 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 12 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 13 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 14 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 15 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 16 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 17 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 18 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 19 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 20 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 21 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 22 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 23 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 24 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 25 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 26 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 27 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 28 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 29 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 30 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 31 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 32 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 33 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 34 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 35 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 36 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 37 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 38 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 39 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 40 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 41 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 42 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 43 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 44 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 45 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 46 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 47 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 48 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 49 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 50 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 51 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 52 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 53 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 54 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 55 of 56
Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 56 of 56
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 1 of 59
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before October 9, 2018 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell., Ch ief U.S. District Judge
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3 !03a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued: -tkl2P1J?g:/- f..:. (}o/;); Judge 's signature
City and state: Wash ington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
- - - - - - -- - - - --- Printed name and title
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 2 of 59
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
-1-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 4 of 59
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
A. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;
B. The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;
C. All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;
D. All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;
E. All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");
F. All photographs and images in the user gallery for the account;
G. All location data associated with the account, including all information collected by the
"Tweet With Location" service;
H. All information about the account's use of Twitter' s link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;
I. All data and information that has been deleted by the user;
J. A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);
-2-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 5 of 59
0. All records of Twitter searches performed by the account, including all past searches saved
by the account;
P. All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;
Q. All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;
R. All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;
S. All data and information associated with the profile page, including photographs;
T. All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;
U. The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;
V. All transactional records associated with the account, including any IP logs or other records
of session times and durations;
W. Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
information regarding the types of devices used to access the account;
Y. All location information for the account, including all location data collected by any
plugins or widgets;
-3-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 6 of 59
AA. All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;
BB. All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;
CC. All information about connections between the account and third-party websites and
applications, including any Twitter, Face book or other social networking accounts to which
posts from the account are sent;
DD. All data and information that has been deleted by the user;
EE. The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);
FF. All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;
GG. Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
identifier, or any other account or device identifier;
HH. Information regarding accounts linked to accounts to which the Target Accounts are linked;
II. All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 7 of 59
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
investigation;
principals;
book" entries and contacts, including any and all preparatory steps taken in
f.. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 8 of 59
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 9 of 59
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-7-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 10 of 59
AO 106 (Rev. 04/10) Application for a Search Warrant
See Attachment A
located in the - --
Northern
- - - --
District of California
_ __ ____c:....;......;.;__.- - - - " - - --
, there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
~ p~operty designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Judge's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 11 of 59
SEP 2 6 2016
IN THE UNITED STATES DISTRICT COURT
Clsrk, U.S. Dlst(fct & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for the Dfstrlct of Columbia
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
-1-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 12 of 59
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contains evidence, fruits, or
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
-2-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 13 of 59
Donald J. Trump (the "Campaign") until August 2015 . Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
.,3_
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 14 of 59
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 15 of 59
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
-5-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 16 of 59
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
-6-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 17 of 59
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJr, STONE tweeted: "Trust me, it will
-7-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 18 of 59
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16., 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
-8-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 19 of 59
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
-9-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 20 of 59
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 21 of 59
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 22 of 59
with the title, "Roger -- why don't you look this over before I send it to I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- turn him for
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
-12-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 23 of 59
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
-13-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 24 of 59
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S[b]erbank, Russia's largest financial institution- Podesta$$$ ties to Russia undermine Clinton
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
-14-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 25 of 59
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
-15-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 26 of 59
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately 1:42PM, STONE called CORSI and the two spoke for
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875 e-2cl bfe94 3b66_story.html
-16-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 27 of 59
64. At approximately 4:00PM, the Washington Post published a story regarding the
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
usin emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
-17-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 28 of 59
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, ''Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
-18-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 29 of 59
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did , a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 30 of 59
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
-20-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 31 of 59
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such asse1iions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be con-ect. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
-23-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 34 of 59
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Ban-el Yet?" In that aiiicle, STONE stated: "[l]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
-24-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 35 of 59
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HP SCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
-25-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 36 of 59
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of tis has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you' re a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
4
Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 37 of 59
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't kriow how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
I 02. CREDI CO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103. On or about April 13, 2018, news repo1is stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
-27-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 38 of 59
from you," referring to CREDICO's therapy dog. CREDJCO stated that it was "ce11ainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
5
https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-ro ger-stone-
threatened-dog-135911370 .html
6
https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 39 of 59
110. Twitter owns and operates a free-access social-networking website of the same
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
-29-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 40 of 59
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also pennits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
111. Upon creating a Twitter account, a Twitter user must create a unique Twitter
usemame and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
usemame, password, and name without having to open a new Twitter account.
112. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
113. A Twitter user can post a personal photograph or image (also known as an
"avatar") to his or her profile, and can also change the profile background or theme for his or her
account page. In addition, Twitter users can post "bias" of 160 characters or fewer to their profile
pages.
114. Twitter also keeps IP logs for each user. These logs contain information about the
user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
-30-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 41 of 59
115. As discussed above, Twitter users can use their Twitter accounts to post "Tweets"
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
116. Twitter users can include photographs or images in their Tweets. Each Twitter
account also 'is provided a user gallery that includes images that the user has shared on Twitter,
117. Twitter users can also opt to include location data in their Tweets, which will
reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
118. When Twitter users want to post a Tweet that includes a link to a website, they
can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
119. A Twitter user can "follow" other Twitter users, which means subscribing to
those users' Tweets and site updates. Each user profile page includes a list of the people who are
following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
-31-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 42 of 59
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
120. In addition to posting Tweets, a Twitter user can also send Direct Messages
(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
121. Twitter users can configure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
122. Twitter includes a search function that enables its users to search all public
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
123. Twitter users can connect their Twitter accounts to third-party websites and
applications, which may grant these websites and applications access to the users' public Twitter
profiles.
124. If a Twitter user does not want to interact with another user on Twitter, the first
user can "block" the second user from following his or her account.
-32-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 43 of 59
125. In some cases, Twitter users may communicate directly with Twitter about issues
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, as well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
126. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
-33-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 44 of 59
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
127. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other account
information.
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
129. Based on the forgoing, I request that the Court issue the proposed search warrant.
130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
-34-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 45 of 59
131. I fmther request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
c~
Special Agent
Federal Bureau of Investigation
~d/~
The Honorable Beryl A. Howell
Chief United States District Judge
-35-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 46 of 59
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Twitter accoun~s, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
- 1-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 47 of 59
ATTACHMENT B
To the extent that the info1mation described in Attachment A is within the possession,
custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
A. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;
B. The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;
C. All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;
D. All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;
E. All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the username associated with the account (i.e., "mentions" or "replies");
F. All photographs and images in the user gallery for the account;
G. All location data associated with the account, including all information collected by the
"Tweet With Location" service;
H. All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;
I. All data and information that has been deleted by the user;
J. A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);
-2-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 48 of 59
0. All records of Twitter searches performed by the account, including all past searches saved
by the account;
P. All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;
Q. All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;
R. All past and current usemames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;
S. All data and information associated with the profile page, including photographs;
T. All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;
U. The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;
V. All transactional records associated with the account, including any IP logs or other records
of session times and durations;
W. Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
information regarding the types of devices used to access the account;
Y. All location information for the account, including all location data collected by any
plugins or widgets;
-3-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 49 of 59
AA. All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;
BB. All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;
CC. All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;
DD. All data and information that has been deleted by the user;
EE. The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);
FF. All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;
GG. Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identifier;
HH. Information regarding accounts linked to accounts to which the Target Accounts are linked;
II. All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 50 of 59
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, information, documents or tangible materials that relate in any way to
investigation;
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 51 of 59
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 52 of 59
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-7-
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 53 of 59
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct TWITTER, LLC ("TWITTER"), an electronic
California, not to notify any other person (except attorneys for TWITTER for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
18 U.S.C. § 2711 (3)(A)(i). Acts or omissions in furtherance of the offense under investigation
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§,2701-2712, governs how TWITTER may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
1
Section 270.S(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 55 of 59
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(h) must he issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command TWITTER not to notify any other person (except attorneys for TWITTER for the
purpose ofreceiving legal advice) of the existence of the Subpoena for a period of one year or until
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
3
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 56 of 59
· Offenses"), arising out of the conduct of Roger Stone and others. It does not appear that Stone is
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this
warrant to Stone could lead him to destroy evidence or notify others who may delete information
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that TWITTER and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and avoid future prosecution. In particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or encrypt digital evidence relating to their
criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
4
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 57 of 59
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b )(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with TWITTER, the United States is aware that, absent a
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
TWITTER not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 58 of 59
1L'
SEP 2 6 2018
IN THE UNITED STATES DISTRICT COURT
Clerk, U.S. District & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for the District of Golumb/a
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
computing services provider headquartered in San Francisco, California, not to disclose the
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 59 of 59
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until
TIIEHON&t~LL
CHIEF UNITED STATES DISTRICT JUDGE
2
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 1 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 2 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 3 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 4 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 5 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 6 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 7 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 8 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 9 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 10 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 11 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 12 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 13 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 14 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 15 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 16 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 17 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 18 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 19 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 20 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 21 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 22 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 23 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 24 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 25 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 26 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 27 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 28 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 29 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 30 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 31 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 32 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 33 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 34 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 35 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 36 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 37 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 38 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 39 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 40 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 41 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 42 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 43 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 44 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 45 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 46 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 47 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 48 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 49 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 50 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 51 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 52 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 53 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 54 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 55 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 56 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 57 of 58
Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 58 of 58
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 1 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 2 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 3 of 61
ATTACHMENT A
Property to be Searched
This wmrnnt applies to information associated with the Twitter accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
-1-
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 4 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 5 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 6 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 7 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 8 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 9 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 10 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 11 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 12 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 13 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 14 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 15 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 16 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 17 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 18 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 19 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 20 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 21 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 22 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 23 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 24 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 25 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 26 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 27 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 28 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 29 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 30 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 31 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 32 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 33 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 34 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 35 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 36 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 37 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 38 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 39 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 40 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 41 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 42 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 43 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 44 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 45 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 46 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 47 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 48 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 49 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 50 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 51 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 52 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 53 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 54 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 55 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 56 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 57 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 58 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 59 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 60 of 61
Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 61 of 61
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 1 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 2 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 3 of 71
ATTACHMENT A
Property to be Searched
This wanant applies to infonnation associated with the Facebook accounts registered to
the following email addresses ("Target Facebook Accounts"), stored at premises owned,
This wanant also applies to information associated with the Instagram accounts registered
to the following email addresses ("Target Instagram Accounts"), stored at premises owned,
1-
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 4 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 5 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 6 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 7 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 8 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 9 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 10 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 11 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 12 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 13 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 14 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 15 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 16 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 17 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 18 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 19 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 20 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 21 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 22 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 23 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 24 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 25 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 26 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 27 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 28 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 29 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 30 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 31 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 32 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 33 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 34 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 35 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 36 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 37 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 38 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 39 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 40 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 41 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 42 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 43 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 44 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 45 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 46 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 47 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 48 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 49 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 50 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 51 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 52 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 53 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 54 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 55 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 56 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 57 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 58 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 59 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 60 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 61 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 62 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 63 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 64 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 65 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 66 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 67 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 68 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 69 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 70 of 71
Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 71 of 71
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 1 of 56
AO 93 (Rev. 11/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (;dentify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days)
;/ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
(United States Magistrate Judge)
D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
D for days (not to e,ceed 30) D until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
-----·
Printed name and title
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 2 of 56
AO 93 (Rev. I 1/13) Search and Seizure Warranl (Page 2)
Retum
Case No.: Date aud time warrant executed: Copy ofwanant and inventory left with:
Certification
I declare nnder penalty of petjury that this inventory is correct and was returned along with the original wanant to the
designated judge.
Date:
Ei:ecuting officer's signature
-·---,.,,-- ...
Printed name and title
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 3 of 56
ATTACHMENT A
Property to be Searched
This wanant applies to information associated with the following Microsoft accounts,
This wanant also applies to infmmation associated with the following Skype usernames
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
-1-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 4 of 56
ATTACHMENTB
To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such infmmation is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
b. The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
-2-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 5 of 56
f. All Microsoft Developer information and content and any other information and
g. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
h. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
k. All search history and web history associated with the account (including Bing
history);
n. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
-3-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 6 of 56
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regm·ding the identification of the account,
to include full nmne, physical addrnss, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 7 of 56
b. All records, infonnation, documents or tangible materials that relate in any way to
individual associated with the Trump Campaign, any witness in the investigation;
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
-5-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 8 of 56
J. Credit card and other financial information, inclnding but not limited to, bills and
I. The identity of any 11011-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-6-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 9 of 56
\;t~: '!i'
tt{ ~
lL [i'c'. r~
\:J.;;.,: ,.,oS,; <,..'.:<
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in suppo1i thereof (collectively the "Warrant"),
computing services provider headquartered in Redmond, Washington, not to disclose the existence
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Corui;
and
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 10 of 56
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Microsoft for the purpose of receiving legal advice) for a period of one year or until
THEHONO~t~~
CHIEF UNITED STATES DISTRICT JUDGE
2
Case
AO !06 (Rev. 04/10) 1:19-mc-00029-CRC
Application for a Search Warrant Document 29-27 Filed 04/28/20 Page 11 of 56
See Attachment A
located in the Western District of _ _ ___,W=a,,,sh...i..
n,,_gt"o""n'-~· , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained .
Reviewed by AUSA/SAUSA:
~
~ c a n t ' s Signature
Judge's signature
City and state: Washington, D.C. Hon. Beryl A Howell, Chief U.S. District Judge
---
Printed name and title
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 12 of 56
SEP 2 ! 2018
IN THE UNITED STATES DISTRICT COURT
Clerk, U.S. DIHtrlct & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for tl10 District ot Columbia
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH ARRANT ,v
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Specia!Agent, I have conducted national
-1-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 13 of 56
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set fmih in this affidavit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditnre ban). There also is probable
cause to search the infonnation described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l )(A). · Specifically, the Co111i is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
-2-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 14 of 56
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the sunrmer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 15 of 56
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and hmm her
electability and potential presidency. We further assess Putin and the Russian
Govermnent developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian gove1mnent employed during its interference. The USIC summarized the effo1is
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
-4-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 16 of 56
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guecifer 2.0 persona, DCLeaks.com, and WikiLealcs to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud~based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
-5-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 17 of 56
. spearphishcd over 100 accounts used by organizations and personnel involved in administering
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the doclL.rnents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
-6-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 18 of 56
why he did the hack of the DNC." The article also stated: "Gliccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me ifI can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
-7-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 19 of 56
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
fmm of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regariling an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his inte1mediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
-8-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 20 of 56
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta-refening back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of connnunications. I'm not implying I have any
influence with him or that I have advanced knowledge ofthe specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Cmnpaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
-9-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 21 of 56
or scope of their subsequent disclosures. S9 I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wildleaks immediately followed up with another message less than a minute later: "We are
1 Onor about August 7, 2017, Chief Judge Beryl A Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 22 of 56
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from 1he government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iC!oud account. Information recovered pursuant to those
-11-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 23 of 56
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafmt and DT this coming week." CORSI
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.J should find Bernie [SJ anders brother who called Bill a Rapist - turn him for
Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
-12-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 24 of 56
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
campaign to get serious staiiing Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memmy bad, has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI' s reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
-13-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 25 of 56
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STUNE's iC!oud that appears to have been taken on August 3, 2016 and had gco-location
Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra sca.'1dal. Podesta now under FBI
S [bJerbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
-14-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 26 of 56
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be ont in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stnffto worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." AS SAN GE also stated that
WikiLealcs would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
-15-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 27 of 56
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
·Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately 1:42PM, STONE called CORSI and the two spoke for
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a0lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-l le6-875e-2cl
.
bfe943b66- story.html
-16-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 28 of 56
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
64. At approximately 4:00PM, the Washington Post published a story regarding the
65. At approximately 4:30PM, WikiLeaks tweeted out its first release ofemails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
usin emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
-17-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 29 of 56
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
· Podesta is complicated. Two articles in length. I can give you in raw forni the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombm1k to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
-18-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 30 of 56
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel conununications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99 .978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New Yark City, with the money
ending up in a private bank account in the 'Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iC!oud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17, 2016, CORSI messaged STONE at his iC!oud account,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 31 of 56
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Keny, Ecuador and U .K. He will drop the goods on them ii
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off{.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iC!oud account,
-20-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 32 of 56
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Arc you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 33 of 56
-22-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 34 of 56
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trnst me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrntiny ....
[L]et me address the charge· that I had advance knowledge of the timing, content and
source of the WikiLealcs disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this· report, and he subsequently did. This journalist
assured me that WikiLeaks would release this infotmation in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be c01rect. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
-23-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 35 of 56
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
cmmnunication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intennediary -
MR. STONE: That - .
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In tl1at article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
-24-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 36 of 56
back, "That was the point at which your lawyers should have told them you would asse1t your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o Jn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
-25-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 37 of 56
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillaty Clinton which are
pending publication,' ... Credico never said he ]mew or had any information as to source or
97. On or about December 1, 2017, CREDlCO messaged STONE, "l don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September ofthis year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with assetiing for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts ofpe1jury[.] But I'm sme
that wasn't sworn testimony so you're probably clear[.] Council for t_l-1e committee !mows you
never had a back Channel and if you had just told the trnth wouldn't have put me in this bad spot
... you should go back ... and amend yom testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
4
Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 38 of 56
98. STONE and CREDICO continued to message each other on or abont December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fnck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDI CO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter,
STONE responded, "Hope u don't fuck Up my effmis to get Assange a pardon[.]" CREDICO
· messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of info1mation prove that I did not have any conversations with
102. CREDICO and STONE continued to message each other, and on or about January
'
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
103. On or about April 13, 2018, news rep01is stated that CREDICO had shown
repmiers c~pies of email messages he had received from STONE in the prior few days that
-27-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 39 of 56
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-135911370.html
6 https ://www.motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 40 of 56
-29-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 41 of 56
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 42 of 56
115. In my training and experience, I have learned that Microsoft provides a variety of
online services, including electronic mail ("email") access, voice communications services such
-31-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 43 of 56
as Skype, Windows Live services, cloud storage services such as OneDrive, and software
development kit accounts, to the public. Subscribers obtain any of these types of accounts by
registering with Microsoft. During the registration process, Microsoft asks subscribers to provide
basic personal information. Therefore, the computers of Microsoft are likely to contain stored
electronic connnunications (including retrieved and unretrieved email for email subscribers and
information concerning subscribers and their use of email services, such as account access
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
116. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for a services account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank accou._'lt number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers inseit false information to conceal their identity, this information often provides clues
117. In my training and experience, email providers typically retain ce1tain transactional
information about the creation and use of each account on theit systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
-32-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 44 of 56
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with paiiicular logins
to the account. Because every device that connects to the Internet must use. an IP address,
IP address information can help to identify which computers or other devices were used to access
118. In my training and experience, in some cases, account users will communicate
directly with a service provider about issues relating to the account, such as technical problems,
billing inquiries, or complaints from other users. Providers typically retain records about such
communications, including records of contacts between the user mid the provider's supp01i
services, as well as records of any actions taken by fue provider or user as a .result of the
communications. In my training and experience, such information may constitute evidence of the
crimes under investigation because the information can be used to identify fue account's user or
users.
119. This application seeks a warrant to search all responsive records and information
under the control of Microsoft, a provider subject to tl1e jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or oilier infonnation pertaining to the customers or subscribers if such
maintained outside the United States. It is my understanding that Microsoft has access to email
accounts with the top level domain .au, which is associated with Australia.
-33-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 45 of 56
120. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the IP addresses from
which users access the email account, along with the time and date of that access. By
determining the physical location associated with the logged IP addresses, investigators can
understand the chronological and geographic context of the email account access and use relating
to the crime under investigation. This geographic and timeline information may tend to either
inculpate or exculpate the account owner. Additionally, information stored at the user's account
may further indicate the geographic location of the account user at a particular time (e,g.,
location infom1ation integrated into an image or video sent via email). Last, stored electronic
data may provide relevant insight into the email account owner's state of mind as it relates to the
· offense under investigation. For example, information in the email account may indicate the
owner's motive and intent to commit a crime (e.g., communications relating to the crime), or
consciousness of guilt (e.g., deleting communications in an effort to conceal them from law
enforcement).
-34-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 46 of 56
other operative privileges. The procedures include use, if necessary, of a designated ''filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
122. Based on the forgoing, I request that the Comt issue the proposed search warrant.
123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
124. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until fmiher order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
docmnents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~~
~y-e-rs____________
Special Agent
Federal Bureau oflnvestigation
~48
The Honorable Beryl A. Howell
Chief United States District Judge
-35-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 47 of 56
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Microsoft accounts,
This warrant also applies to information associated with the following Skype usernrunes
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
-1-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 48 of 56
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such information is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date arid time at which each
email was sent, and the size and length of each email;
b. The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
include full name, physical address, _telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
t¥e length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
-2-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 49 of 56
which 1he accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and oilier identifiers,
records of session times and durations, the date on which the account was created,
1he length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
I
provided during registration, methods of connecting, log files, and means and
Any and all records 1hat relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations ofl8 U.S.C. § 2 (aiding and
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unau1horized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons ~r entities associated with WikiLealcs, including but not limited to
-4-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 50 of 56
b. All records, information, documents or tangible materials that relate in any way to
individual associated with the Trump Campaign, any witness in the investigation;
principals;
f. Connnunications, records, documents, and other files that reveal eff01ts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the acconnt was accessed or used, to determine
(
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
i. The identity of the person(s) who created or used the acconnt, including records
-5-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 51 of 56
J. Credit card and other financial information, including but not limited to, bills and
1. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access infonnl'ltion that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-6-
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 52 of 56
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Wanant") under seal, and precluding the provider from
notifying any person of the WaiTant pursuant to 18 U.S.C. § 2705(b). In regard t9 the non-
disclosure, the proposed Order wonld direct Microsoft Corporation ("Microsoft"), an electronic
Washington, not to notify any other person (except attorneys for Microsoft for the purpose of
receiving legal advice) of the existence or content of the Wanant for a period of one year or until
1. The Court has the inherent power to seal comt filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 53 of 56
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
"district court of the United Slates ... that - has jurisdiction over the offense being investigated."
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Microsoft may be
compelled to supply communications and other records using a subpoena, court order, or search
wanant. Specifically, Section 2703(c)(2) authorizes the Government to obtain ce1tain basic
. "subscriber information" using a subpoena, Section 2703( d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search wanant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
2
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 54 of 56
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in-
(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(h). The United States District Court for the District of Columbia has made clear
that a nondisclosnre order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Microsoft not to notify any other person (except attorneys for Microsoft for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an umegistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
3
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 55 of 56
(foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Microsoft and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Microsoft for the purpose of receiving
legal advice) for a period of one year or until further order of the Court. Such an. order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant.
and related papers may also ale1t the targets to the scope of information !mown to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
4
Case 1:19-mc-00029-CRC Document 29-27 Filed 04/28/20 Page 56 of 56
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with Microsoft, the United States is aware that, absent a
court order under Section 2705(b) commanding Microsoft not to notify anyone about a legal
request, Microsoft may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Microsoft not to notify any other person of the existence oi: contents of the above-captioned
warrant (except attorneys for Microsoft for the purpose of receiving legal advice) for a period of
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 1 of 57
AO 93 (Rev. 11/13) Search and Seizure Warrant
See Attachment A
I find that the affidavit(s), or any recorded testimony; establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days)
r;t in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the prope1iy was taken, or leave the copy and receipt at the place where the
prope1iy was taken.
The officer executing this warrant, or an officer present during the execution of the wanant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District ~llQilL ______ .
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the pe1:son who, or whose
property, will be searched or seized (check the appropriate box) I
' ·
0 for _ _ days (nottoexceed30) 0 until, the facts justifying, the later specific dat'(1bf - - - ~ - - - --~-----
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 2 of 57
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date: -
Executing officer's signature
·--··
Printed name and title
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 3 of 57
ATTACHMENT A
Property to be Searched
This warrant applies to info1mation associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
-1-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 4 of 57
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession,
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses,
provided during registration, methods of connecting, log files, and means and
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
-2-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 5 of 57
e. All records pertaining to connnunications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken;
g. All search history and web history associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usernames and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 6 of 57
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 7 of 57
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
b. All records, infonnation, documents or tangible materials that relate in any way to
individual associated with the Trump Campaign, any witness in the investigation;
principals;
book" entries and contacts, including any and all preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 8 of 57
g. Evidence indicating how and when the account was accessed or used, to detennine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial infonnation, including but not limited to, bills and
L The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access info1mation that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 9 of 57
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-7-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 10 of 57
SEP 2 l wm
IN THE UNITED STATES DISTRICT COURT
Clerk U.S. rnstrlct & Bankru\ltcy
FOR THE DISTRICT OF COLUMBIA r.ourt; for \lie O\stric1 oi Columbia
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Google, an electronic communication and/or remote computing services provider
headquartered in Mountain View, California, not to disclose the existence or contents of the
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 11 of 57
employees shall not disclose the existence or content of the Wa.1Tant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until
Wi,r(;pr!
Date
2
Case
AO 106 (Rev. 04/lO) 1:19-mc-00029-CRC
Application for a Search Warrant Document 29-28 Filed 04/28/20 Page 12 of 57
See Attachment A
Northern
located in the - - - -----
District of _ __-C-.-a..li...fo,,.r_..n...,ia.__ _ _ , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
r'lf evidence of a cri1ne;
ref contraband, fruits of crime, or other items illegally possessed;
ref property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
~--------,,,~d
7
~
Judge's signature
City and state: Washingto_n_,_D_.C_.________ Hon. Beryl A Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 13 of 57
er:1:i ·,·,. ·1 UI
;i;_ 1
,n1''G
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA C1~rk, U.S. lllotrlct & Hankruptcy
Courts tor tt10 District o1 Golumbla
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
-1-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 14 of 57
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 3012l(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
(c)(l )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18. U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
-2-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 15 of 57
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 16 of 57
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian govennnent employed during its interference. The USIC summarized the effmis
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." Further, "[i]n July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
-4-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 17 of 57
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
12. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Connsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's ovm technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a fotmer White House advisor who was then advising the Clinton Campaign. These
spearphished over 100 accounts used by organizations and personnel involved in administering
-5-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 18 of 57
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian govermuent actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility fol' the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The atiicle also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
-6-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 19 of 57
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do'/" STU NE responded: ''Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will
-7-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 20 of 57
soon the [sic] Podesta's time in the ba1Tel. #CrookcdHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
[ASSANGEJ, the public [could] expect to see much more from the exiled whistle blower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC _Moming Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SAN GE had scheduled foi" the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE am1ouncement -which was
part of WikiLeaks' 10-yeaT anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE nsed@RogerJStoneJr
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeal(s sent a Tweet reading
-8-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 21 of 57
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLealcs continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- refeITing back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this infonnation on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying l have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLealcs was in the midst of releasing the hacked
-9-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 22 of 57
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikilcaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operationleaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get infonnation only that it is
accurate and authentic. The New Y orlc Times printed the Pentagon Papers which were
1On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 23 of 57
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restrnining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
2017, Chief Judge Howell issued a search warrant for one ofSTONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 24 of 57
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recogpized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assarrge." The body of the message read: "Get to Assarrge
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."
CORSI with the subject line, "Call me MON." The body of the email read: " should see
Assarrge[.] should find Bernie [S]arrders brother who called Bill a Rapist-tmn him for
"Word is frie11.d in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC arr artifact of rigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
-12-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 25 of 57
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet AS SANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting ASSANGE. STONE told he was joking and
48. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
-13-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 26 of 57
call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
"Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One -was hired by Rosatom in Giustra scandal. Podesta now under FBI
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back chaunel highly sensitive stuff." CORSI responded, "We have
secure back chaunel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive... Hope you are well.
Can't wait for the debate. Chauneling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
-14-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 27 of 57
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows whatAssange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 28 of 57
February 14, 2018; he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON aclmowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
62. At approximately 1:42PM, STONE called CORSI and the two spoke for
63. At approximately 2:18PM, CORSI called STONE and the two spoke for
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /3 ld74 714-8ce5-11e6-875e-2c 1bfe943b66_ story.html
-16-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 29 of 57
64. At approximately 4:00PM, the Washington Post published a story regarding the
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacldng bad job
numbers."
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
-17-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 30 of 57
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
-18-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 31 of 57
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOrIN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99 .978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now- before 2prn[.]" STONE responded, "Missed u-just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
-19-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 32 of 57
AS SAN GE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
-20-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 33 of 57
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 34 of 57
-22-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 35 of 57
88. On September 26, 2017, STONE testified before the House Pennanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In. them, STONE stated:
Members of this Committee have made three basic asse1tions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman Jolm Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillm-y Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be exan1ined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regm·ding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] armounced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
-23-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 36 of 57
89. In a document dated March 26, 2018 titled "Minority Views," Democratic
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only refe1Ting to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is con-ect, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta' s
Time in the B=el Yet?" In that ariicle, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the ban-el' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet refe1Ted to Podesta's business dealings with Russia, and the
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
92. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house connnittee lawyer told my lawyer that I will be getting a subpoena[.]'' STONE wrote
-24-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 37 of 57
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, 'To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuffI.J I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my :first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjmy[.]"
94. STONE and CREDI CO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
-25-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 38 of 57
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any infmmation as to source or
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't lmowwhy
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now lmowthat I was not in London tmtil September of this year[.] You had
no back-chatmel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asse1iing for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDICO resp~nded, "You open yourself up to six counts ofpe1jury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the connnittee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and am.end your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
· you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
4Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 39 of 57
98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
I 00. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a rep01ter.
STONE responded, "Hope u don't fuck Up my effo1ts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
102. CREDICO and STONE continued to message each other, and on or about Januaty
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Tnunp so don't worr):'. I have all the forensic evidence[.] I was
not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103. On or about April 13, 2018, news rep01ts stated that CREDICO had shown
repo1ters copies of email messages he had received from STONE in the prior few days that
-27-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 40 of 57
stated, "You arc a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO slated that it was "certainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The aiticle noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviscr-roger-stone-
threatened-dog-135911370.html
6 https ://www.mothcrj ones.com/politics/2018/05/ro gcr-stone-to-associate-prcpare-to-die/
-28-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 41 of 57
-29-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 42 of 57
-30-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 43 of 57
115. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (inclnding retrieved and umetrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
-31-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 44 of 57
application inforn1ation. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account's
user or users.
116. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying inforn1ation when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false infonnation to conceal their identity, this information often provides clues
117. In my training and experience, email providers typically retain certain transactional
info1mation about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the IP address used to register the
account an.d the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
-32-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 45 of 57
118. In my training and cxpenence, m some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
119. This application seeks a wanant to search all responsive records and information
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested wanant of the contents of wire or electronic communications and any
whether such communication, record, or other information is stored, held, or maintained outside
120. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search wanant at a residence. For example, email communications, contacts
-33-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 46 of 57
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
122. Based on.the forgoing, I request that the Court issue the proposed search wanant.
-34-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 47 of 57
123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
124. I further request that the Court order that all papers in supp01i of this application,
including the affidavit and search warrant, be sealed until frniher order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
Special Agent
Federal Bureau oflnvestigation
-35-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 48 of 57
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
-1-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 49 of 57
e. All records pe1taining to communications between the Provider and any person
regarding the account, including contacts with suppmt services and records of
actions taken;
g. All search hislory aml web hislory associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemarnes and email accounts associated with them);
t. All device information associated with the account, including all instrument or
-3-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 50 of 57
a. All records, infoimation, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
or other obfuscation about knowledge of, or access to, hacked material; '
b. All records, infmmation, documents or tangible materials that relate in any way to
individual associated with the Trump Campaign, any witness in the investigation;
principals;
book" entries and contacts, including any and all preparatory steps talcen in
f. Commnnications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
-5-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 51 of 57
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
1. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
1. The identity of any non-U.S. person(s)-including records that help reveal the
m. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s}--who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
· principals.
n. . Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 52 of 57
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-7-
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 53 of 57
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof(collectively herein the "Wan-ant") under seal, and precluding the provider from
notifying any person of the Wan-ant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California, not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until fiuther order of the Comt.
1. The Court has the inherent power to seal court filings when appropriate,
including the Wan-ant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Wmrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Comt has jurisdiction.to issue the requested order because it is "a
"district court of the United States ... that - has jurisdiction over the offense being investigated."
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 54 of 57
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, comt order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" infmmation using a comt order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search wanants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
under that provision.
2
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 55 of 57
18 U.S.C. § 2705(b ). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under§ 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject Offenses"), in
connection with efforts to compromise the networks of the Democratic National Convention
("DNC"}, the Democratic Congressional Campaign Committee ("DCCC"), and the email accounts
of U.S. persons, followed by the public release of stolen materials through various outlets.
3
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 56 of 57
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Wmrnnt (except attorneys for Google for the purpose ofreceiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Wanant relates to an ongoing criminal investigation, the scope and nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are !mown to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the
WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 57 of 57
10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request,
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or
electronic communications for a certain account, notify the subscriber or customer of the existence
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period ofone year or
Respectfully submitted,
By: /
Kyle . eeny
The Special Counsel '.s Office
(202) 616-3812
5
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 1 of 57
..1 and Seizure Warrant
.I
UNITED STATES DISTRICT COURT
for the
District of Columbia
See Attachment A
I fmd that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the pe1wn or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days)
,;{ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
prope,ty was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to -·· Hon. Beryl A. Howell, Chief U.S. District Judge ___
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), Ifind that immediate notification may have an adverse result listed in 18 U.S.C. j
§ 2705 (except for delay of trial), and autl1orize the officer executing this warrant to delay notice to the person who, or whose
propetty, will be searched or seized (check the appropriate box) II
Ii
0 for days (not to exceed 30) 0 until, the facts justifying, the later specific date of
'
I
,I
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 2 of 57
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of pe1jury that this inventmy is correct and was returned along with the original warrant to the
designated judge.
Date: -
Executing officer's signature
ATTACHMENT A
Property to be Searched
This warrant applies to info1mation associated with the following accounts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company
-1-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 4 of 57
ATTACHMENT B
To the extent that the infonnation described in Attaclnnent A is within the possession,
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(:1:), the
Provider is required to disclose the following information to the govennnent for each account or
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;
-2-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 5 of 57
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
J. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic · Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMSI"), or International Mobile Equipment Identities
("IMEI").
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, infmmation, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-3-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 6 of 57
b. All records, inf01mation, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and aH preparatory steps taken in
f. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence inclicating the account user's state of mind as it relates to the crimes under
investigation;
-4-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 7 of 57
i. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)-including records that help reveal the
m. Th~ identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access information that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-5-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 8 of 57
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apaii from the investigative team, in order to address potential privileges.
-6-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 9 of 57
FILED
IN THE UNITED STATES DISTRICT COURT
SEP 2 7 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy
Courts for the District of Col~mbla
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Apple, Inc., an electronic conununication and/or remote computing services
provider headquartered in Cupertino, California, not to disclose the existence or contents of the
The Cowt finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 10 of 57
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
2
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 11 of 57
See Attachment A
located in the Northern District of California , there is now concealed (identify the
--- ·--~===----
person or describe the property to be setzed):
See Attachment B
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or mo,e):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
d property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
City and state: Washington, _D_.c_._ _ _ _ __ --~H~on. Beryl A Howell, Chief U.S. District Judge
Printed name and tille
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 12 of 57
FILED
IN THE UNITED STATES DISTRICT COURT SEP 2 7 2018
FOR THE DISTRICT OF COLUMBIA
Clerk, U.S. District & Bankruptcy
Courts tor th& Dlstrlct o1 Golumbl,
IN THE MATTER OF THE SEARCH OF
Case: 1:18-sc-02922
INFORMATION ASSOCIATED WITH
Assigned To: Howell, Beryl A.
ONE ACCOUNT STORED AT PREMISES
Assign. Date : 9/27/2018
CONTROLLED BY APPLE
Description: Search & Seizure Warrant
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
headquartered in Cupertino, California. As set forth below, the Target Account is believed to be
used by an associate of STONE who was in communication with STONE on the day that
WikiLeaks first released emails stolen from Clinton Campaign chair John Podesta and who appears
to have met with STONE in October 2016 on the same day that STONE publicly claimed to have
had dinner with his back-channel to WikiLeaks founder Julian Assange. Upon receipt of the
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
-1-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 13 of 57
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contains evidence, fruits, or
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
,JURISDICTION
5. This Court has jurisdiction to issue the requesteq warrant because it is "a court of
(c)( 1)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
-2-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 14 of 57
II
i!
!
PROBABLE CAUSE
I
A. Background on Relevant Individuals !
.1
i. Roger STONE
II
6. Roger STONE is a self-employed political strategist/consultant and has been
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
-3-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 15 of 57
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian
Govermnent developed a clear preference for President-elect Trump.
10. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
11. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
-4-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 16 of 57 I
I
I
I'
,,
services conducted cyber operations against targets associated with the 2016 US presidential I
I
election, including targets associated with both major US political parties." Fmiher, "[i]n July I
:1
I
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC attributed these cyber activities
I
r
'
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
I 2. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
14. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 presidential election through at
15. For example, in or around September 2016, these individuals successfully gained
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
16. On or about September 4, 2016, individuals associated with the GRU stole the
emails from a former White House advisor who was then advising the Clinton Campaign. These
-5-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 17 of 57
18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125).
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
-6-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 18 of 57
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assangc
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoncJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
25. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
26. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
-7-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 19 of 57 I
I
I,
,1
i~
I!
,,
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
I
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
soon the [sic] Podesta's time in the batTel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
[ASSANGE], the public (could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... [ think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abcdin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
28. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLcaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told lnfowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
-8-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 20 of 57
31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
33. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [Assange] may have passed this information on to
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that 1-Juma Abedin and Cheryl Mills, the Clinton aides,
34. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
-9-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 21 of 57 I
I
Ji
1:
i/
t
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
35. On October 13, 2016, while WikiLcaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoncJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
36. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
38. On or about November 9, 2016, one day after the presidential election,
@wikileaks immediately followed up with another message less than a minute later: "We are
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr.
-10-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 22 of 57
the founder of WikiLcaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issue an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards .. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
@J ulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
41. On September 11, 2017, ChiefJudge Beryl A. Howell of the District of Columbia
. 2017, Chief Judge Howell issued a search warrant for one ofSTONE' addresses,
warrant fo email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
-11-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 23 of 57
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your ayailability to meet Manafort and DT this coming week." CORSI
with the title, "Roger -- why don't you look this over before I send it to I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
CORSI with the subject line, "Get to Assange." The body of the message read: "Get.to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly." The text of this email from STONE to CORSI substantially mirrored the
text of ah email that STONE received from ~a freelance blogger who had been
conducting research into the Clintons during presidential campaign---on or about the same day.
CORSI with the subject line, "Call me MON." The body of the email read: " should see
Assangc[.J should find Bernie [S]anders brother who called Bill a Rapist - tum him for
-12-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 24 of 57
11
)
i
"Word is friend in embassy plans 2 more dumps. One shortly after I'm j
l
I
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
I
,,
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, I
I•
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential I
i
~
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
i
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- IIi
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation .
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
I
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
I
47. On or about August 5, 2016, an associate of STONE's, emailed
Ir
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting ASSANGE. STONE told he was joking and
48. Tlu·ough a search of STONE's iCloud account, the FBI has uncovered evidence
-13-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 25 of 57
j
ll.
I
[
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
i
STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting !
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
: "Give me a call today if you can. Despite MSM drumroll that HRC is
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $ l 80k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
S[b ]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
53. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
-14-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 26 of 57
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
conversation concerned possible derogatory information he was trying to obtain from Turkey.
and asked: "Assange - what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. Yon didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release infonnation damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
-15-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 27 of 57
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
BANNON had been hoping for releases of damaging information that morning.
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
61. At approximately 11 :53AM, STONE received a phone call from the Washington
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /3 l d7 4 7 l 4-8ce5- l l e6-875e-2cl bfe943 b66_story.html
-16-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 28 of 57
62. At approximately 1:42PM, STONE called CORSI and the two spoke for
63. At approximately 2: 18PM, CORSI called STONE and the two spoke for
64. At approximately 4:00PM, the Washington Post published a story regarding the
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
that much of next dump focus, setting stage for Foundation debacle."
"get[ting] to Assange," and who, according to emails and phone records, regularly
communicated with STONE-sent STONE an email titled, "WikiLeaks - The Podesta Emails,"
with a link to the newly-released Podesta emails. Approximately ten minutes later, STONE,
STONE does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE ls
Accused of Advance Knowledge of the Leak
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
-17-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 29 of 57
usin m, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
69. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
financially Podesta personally and the Clintons through the Clinton Foundation."
70. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I'll give you one more- NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
-18-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 30 of 57
had the channel open from Metcombank to Deutsche Bank America to Ban[k) of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did , a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian goverrnnent, launder through
Metcombank, a Russian regional bank owned 99.978 percent b with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
-19-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 31 of 57
74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand offl.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account,
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
-20-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 32 of 57
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
78. On or about November 8, 2016, the United States presidential election took place.
79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
80. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 33 of 57
I
I
!
!1
I
l
I'
11
-22-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 34 of 57
!
I
I
[
I
i
II
I!
I
I
I
88. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCJ). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that oµr intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranitun deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
-23-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 35 of 57
Assange to independently confirm this report, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
information proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
90. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
91. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
-24-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 36 of 57
II
!
t
lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
'
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
92. On or about November 21, 2017, CREDI CO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, 'That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDI CO wrote back, "It was not August because I didn't
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
guess Schiff will try to get one ofus indicted for perjury[.]"
94. STONE and CREDI CO continued to exchange messages and on November 24,
2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
received from HPSCI that was dated November 27, 2017. Toll records show that on November
-25-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 37 of 57
27 and 28, 2017, CREDI CO and STONE communicated via text message more than a dozen
times.
96. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[)
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
97. On or about December I, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all ofmy forensic evidence to
the FBI today what a headache[.]' You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you tumed over anything to the FBI you're
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
that wasn't swom testimony so you 're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
4
Contrary to his statement, CREDI CO had not at the time provided any forensic evidence to the
FBI.
-26-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 38 of 57
!
l•I
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
I
Fifth Amendment rights but you can. I guarantee you you [sicJ are the one who gets indicted for
fl
98. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
100. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
logs ... + 17 other pieces of information prove that I did not have any conversations with
102. CREDI CO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
-27-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 39 of 57 I
I
lf:
II
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was '~
I
!I
not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
I
11
103. On or about April 13, 2018, news reports stated that CREDICO had shown 11
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
I
Ii,1
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
104. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
have prostate cancer and did not have any such discussion with STONE.
105. As noted above, in late July 2016 emailed STONE to "get to Assange,"
which appears to have precipitated STONE's email to CORSI with the same instruction.
106. On or about August 17, 2016 sent an email to STONE's Gmail account
with the subject line, "Introduction." The email was also sent to the work account o
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-1359113 70.htrnl
6
https: //www. motherj ones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 40 of 57
listed both STONE' telephone numbers, and he advised them, "You should find
time to chat."
107. Toll records for STONE's cellphone show that between August 18, 2016 and
included several calls on October 7, 2016, the day that WikiLeaks began releasing Podesta's
STONE's call with the Washington Post, which was about to publish information about the
"Access Hollywood" tape. The call lasted approximately seven minutes. appears to
be the first person, other than journalists, to talk to STONE after STONE's call with the
Washington Pos called STONE a second time at approximately 2:38PM on the same
day. That call lasted approximately one minute. STONE also had a missed FaccTime call from
at approximately 3:32PM the same day. WikiLeaks released the first tranche of stolen
108. As noted above told investigators that in January 2017, CORSI told
him that he (CORSI) and STONE were involved in and were aware of the timing and content of
the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta,
and CORSI implied, in sum and substance, that STONE was involved in the release of the
109. According to open source information, on or about October 12, 2016, five days
after the first release of stolen Podesta emails, STONE told a local news outlet in Florida, "I do
have a back-channel communication with Assange, because we have a good mutual friend. That
-29-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 41 of 57
i
!
I!
friend travels back and forth from the United States to London and we talk. I had dinner with II
ri
him last Monday." 7 "Ibe Monday prior to the date ofSTONE's statement was October 10, 2016. !
!I
!,
110. In the early hours of October 10, 2016, at approximately 3:26AM EDT
texted STONE: "H . If you are still in NY we MUST meet tomorrow. Major major
I
stuff." At approximately 8:26AM the same day (but, effectively, the next morning, given the I
I
hour o R's text), STONE replied, "Ok- can we meet UES?" UES appears to be a
iI
reference to the Upper East Side of New York City, where STONE maintained a residence.
texted STONE at approximately 9:02AM, "Sure. Lunch? Coffee? Time?" and again at I
10:55AM, "What time works." Investigators have not located a response from STONE, although
seconds.
111. Cell-site location data for STONE shows that he was in the Upper East Side on
the evening of October 10, 2016, when he claimed to have met with his contact to Assange,
transaction on October 10, 2016, at a pizza parlor located in the Upper East Side, in the amount
of approximately $20.
112. Search warrant returns show that after WikiLeaks began to release Podesta's
emails in October 2016, emailed STONE several times from the account
("Target Account") with links to WikiLeaks' website and discussion about the
October 25, 2016, sent an email from the Target Acconnt to STONE' account
7
https ://miami .cbslocal.com/2016/1 0/12/trump-all y-roger-stone-admits-back-channel-tie-to-
wikileaks/
-30-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 42 of 57
I
i
j
[
with a link to the portion ofWikiLeaks' website containing Podesta emails, with the comment, I
I
"Cheryl Mills & John Podesta panic to cover Obama's lies on Hillary emails." !
I'
113. Search warrant returns for CORSI k account show th was in j
communication with CORSI at least in 2017. During an email exchange in June 2017 that
I
I
appears to relate to financial policy-makers, CORSI tol that he was "concerned about
Mueller," following up shortly thereafter to clarify that had "meant Mnuchen," the Secretary of
Treasury. CORSI added, "Guess I have Special Counsel on mind these days."
114. For the foregoing reasons, there is probable cause to believe that the Target
Account contains evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses.
115. In my training and experience, I have learned that Apple provides a variety of on-
line services, including electronic mail ("email") access, to the public. Apple allows subscribers
to obtain email accounts at the domain name me.com, like the Target Account. Subscribers obtain
an account by registering with Apple. During the registration process, Apple asks subscribers to
provide basic personal information. Therefore, the computers of Apple are likely to contain stored
electronic communications (including retrieved and unretrieved email for Apple subscribers and
information concerning subscribers and their use of Apple services, such as account access
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
116. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying· information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
-31-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 43 of 57
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
117. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were.used to access
118. In my training and experience, in some cases, email account users will
.
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user as a
result of the communications. In my training and experience, such information may constitute
-32-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 44 of 57
evidence of the crimes under investigation because the information can be used to identify the
119. This application seeks a wanant to search all responsive records and information
under the control of Apple, a provider subject to the jurisdiction of this court, regardless of where
Apple has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
whether such communication, record, or other information is stored, held, or maintained outside
120. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
information stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
-33-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 45 of 57 I
I
f
I
chronological and geographic context of the email account access and use relating to the crime
Ir1
I•
11
under investigation. This geographic and timeline information may tend to either inculpate or I
I·,I
ii
exculpate the account owner. Additionally, information stored at the user's account may further
II
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
I
insight into the email account owner's state of mind as it relates to the offense under investigation. I
II
For example, information in the email account may indicate the owner's motive and intent to
other operative privileges. The procedures include use, if necessary, of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
CONCLUSION
122. Based on the forgoing, I request that the Court issue the proposed search warrant.
123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
-34-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 46 of 57
I
I
Ii"
II
I
~
REQUEST FOR SEALING I
I
124. I further request that the Court order that all papers in supp01t of this application,
i
including the affidavit and search warrant, be scaled until further order of the Court. These 1
I
i
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
~
atrickJ.Myers
Special Agent
Federal Bureau of Investigation
-35-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 47 of 57
II
!
i
II
ATTACHMENT A
Property to be Searched
I
1
!~
This warrant applies to information associated with the following acconnts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company
II
"
-1-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 48 of 57
ATTACHMENTB
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
infonnation is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the
Provider is required to disclose the following information to the government for each account or
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;
-2-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 49 of 57
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
j. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMS!"), or International Mobile Equipment Identities
("IMEI").
Any and all records that relate in any way to the accounts described in Attachment A
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
a. All records, information, documents or tangible materials that relate in any way to
with persons or entities associated with WikiLeaks, including but not limited to
-3-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 50 of 57
b. All records, information, documents or tangible materials that relate in any way to
principals;
book" entries and contacts, including any and all preparatory steps taken in
f Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
foreign principals;
g. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
h. Evidence indicating the account user's slate of mind as it relates to the crimes under
investigation;
-4-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 51 of 57
i. The identity of the person(s) who created or used the account, including records
J. Credit card and other financial information, including but not limited to, bills and
I. The identity of any non-U.S. person(s)--including records that help reveal the
m. The identity of any person(s)--including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
principals.
n. Passwords and encryption keys, and other access inf01mation that may be necessary
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-5-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 52 of 57
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
-6-
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 53 of 57
i
I
I
I
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA I
11
I
Ii
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Apple, Inc. ("Apple"), an electronic communication
.'
and/or remote computing services provider headquartered in Cupertino, California, not to notify
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year or until further order of the Court.
1. The Court has the inherent power to seal court filings when .appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
'\
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
'
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
"district court of the United States .. , that - has jurisdiction over the offense being investigated."
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 54 of 57
3. Further, the Court has authority to require non-disclosure of the W arraot under 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
compelled to supply communications aod other records using a subpoena, court order, or search
warrant. Specifically, Section 27~3(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"no.n-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
J
Government to obtain contents of communications using a search warraot. See 18 U.S.C. § 2703.
4. The SCA does not set forth aoy obligation for providers to notify subscribers about
subpoenas, court orders, or search warraots under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such ·
1
Section 2705(b) contains additional requirements for legal process obtained pursuaotto 18 U.S.C.
§ 2703(b)(I)(B), but the Govenunent does not seek to use the proposed Order for aoy legal process
,under that provislon.
2
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 55 of 57
18 U .S.C. § 2705(b ). The United States District Court for the District of Cohunbia has made clear
'
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under§ 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Apple not to notify any other person (except attorneys for Apple for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 '(conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U,S,C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S,C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National '
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
3
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 56 of 57
email accounts of U.S. persons, followed by the public release of stolen materials through various
outlets.
7. In this matter, the government requests that the Warrant be sealed until further order ·
of the Court and that Apple and its employees be directed not to notify any other person of the ·
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such ar1 order is appropriate
because the Warrarit relates to an ongoing criminal investigation, the scope arid nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrarit and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
8. Given the complex arid sensitive nature of the criminal activity under.investigation,
and \tlso given that the criminal scheme may be ongoing, the, Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief,
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets fill opportunity
to flee from prosecution, destroy or tamper with evidence, arid intimidate witnesses. See 18 U.S.C.
4
Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 57 of 57
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
I 0. Based on prior dealings with Apple, the United States is aware that, absent a court
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, Apple
may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic
communications for a certain account, notify the subscriber or customer of the existence of the
WHEREFORE, for all the foregoing reasons, the governmentrespectfully requests that the
above-captioned watrant, the application and affidavit in support thereof, and all attachments
thereto'and other related materials be placed under seal, and furthermore, iliat the Court command
Apple not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or
Respectfully submitted,
5
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 1 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 2 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 3 of 60
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the Google accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
-1-
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 4 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 5 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 6 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 7 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 8 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 9 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 10 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 11 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 12 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 13 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 14 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 15 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 16 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 17 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 18 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 19 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 20 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 21 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 22 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 23 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 24 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 25 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 26 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 27 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 28 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 29 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 30 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 31 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 32 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 33 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 34 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 35 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 36 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 37 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 38 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 39 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 40 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 41 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 42 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 43 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 44 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 45 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 46 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 47 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 48 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 49 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 50 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 51 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 52 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 53 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 54 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 55 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 56 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 57 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 58 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 59 of 60
Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 60 of 60
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 1 of 48
See Attachment A.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the p erson or describe the prop erty to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before February 27, 2019 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U .S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the approp riate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
City and state: Washington, DC Hon. Beryl A. Kowell, Ghief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 2 of 48
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer 's signature
ATTACHMENT A
Property to be Searched
Columbia:
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 4 of 48
ATTACHMENT B
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b){l) (witness tampering), those violations involving Roger Stone, for
a ;
telephone number
h. Records and information relating to the Signal account associated with telephone
number
Page 1 of 3
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 5 of 48
1. Records and information relating to the Wicla account associated with telephone
number ;
above;
k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
2. For any computer or storage medium whose seizure is otherwise authorized by this
warrant, and any computer or storage medium that contains or in which is stored records or
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
history, user profiles, email, email contacts, "chat," instant messaging logs,
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
software;
Page 2 of 3
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 6 of 48
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
e. evidence indicating the computer user' s state of mind as it relates to the crime under
investigation;
1. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 3 of3
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 7 of 48
AO 106 ( Rev. 04/1 0) Applicat ion for a Search Warrant
See Attachment A
located in the - -- - -- - -
District of _ __ __
Columbia
_ ;.c...;...;.- '--- ---
, there is now concealed (identify the
person or describe the property to be seized) :
See Attachment 8
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
rJ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
Reviewed by AUSA/SAUSA:
& ., A~ Applicant's signature
Date: 02/13/2019
City and state: Washington, D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 8 of 48
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
1. I make this affidavit in support of an application for a search warrant for the
following devices (the "Subject Devices") associated with Roger J. Stone, Jr. ("Roger Stone"),
described below and further in Attachment A, currently located in the District of Columbia:
a.
b.
c.
2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have
been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cybersecurity.
3. I am currently involved in the investigation into Roger J. Stone, Jr., ("Roger Stone")
and others known and unknown to the government, for the commission of unlawful activities in
the District of Columbia, and elsewhere, including, but not limited to: (i) obstruction of
proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in
Page 1 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 9 of 48
violation of Title 18, United States Code, Section l 001 and (iii) witness tampering, in violation of
Title 18, United States Code l 512(b)(1) (collectively the "Specified Federal Offenses").
4. On January 24, 2019, a Grand Jury in the District of Columbia indicted Roger Stone
on seven counts: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section
1505 (Count 1); (ii) false statements, in violation of Title 18, United States Code, Section 1001
(Counts 2-6) and; (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(l)
(Count 7). See United States v. Roger Jason Stone, Jr., 19-cr-18-ABJ, Dkt. 1. On January 29,
2019, Roger Stone pied not guilty to the charges before Magistrate Judge Deborah A. Robinson.
contained herein based on my own investigation, as well as my review of documents, records, and
6. This affidavit is intended to show merely that there is sufficient probable cause for
the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I assert that an event took place on a particular date, I am asserting that it took
7. For the reasons set forth in this Affidavit, there is probable cause to believe that one
or more of the Specified Federal Offenses have been committed by Roger Stone and others known
and unknown to the government. Further, there is probable cause to believe that each of the Subject
Devices have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in each of the
Page 2 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 10 of 48
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S . politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald J. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
10. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly
with Stone throughout the campaign, including about the release of stolen documents by
WikiLeaks.
12. Based on the investigation to date, Randy Credico was a radio host who has known
Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent
Selection Committee on Intelligence ("HP SCI") on or about September 26, 2017, Stone described
Credico (without naming him) as an " intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by
Page 3 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 11 of 48
name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that Assange, had
13. Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gates, 1:l 7-cr-201 (D.D.C.).
14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief
16. John Podesta is a U.S. citizen who served for years as a political consultant. During
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
1
In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.
Page 4 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 12 of 48
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation, through which an actor would have gained access to Podesta's email
account, allowing the actor to steal emails and documents from that account.
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity
18. On or about June 14, 2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia
returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
Page 5 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 13 of 48
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: l 8-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
20. As alleged in the Netyksho indictment, after successfully hacking the DNC and
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the stolen
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the
transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior DNC
officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
thousands of emails and documents stolen from Podesta's email account. Between on or about
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
23. In April 2018 interviews with the Special Counsel's Office, Richard Gates stated
that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
Page 6 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 14 of 48
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
24. According to Gates, Manafort directed Gates to contact Stone about any additional
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel' s Office in or
around October 2018, Gates recalled that at one point during the campaign he was with then-
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.
show that shortly after the July 22, 2016 release of stolen DNC emails
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails .. . they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
2
A search of was authorized on or about September 11, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-661 (D.D.C. Sept. 11, 2017). A
second search of was authorized on or about August 3, 2018 by the U.S.
District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 2703(d) for records connected to Case No. I: 18-sc-2911 (D.D.C. Sept.
26, 2018). Records provided in response by Microsoft Corporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
Page 7 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 15 of 48
Stone' s email to who lived in the United Kingdom and who was a
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that "should see Assange."
c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
that the phrase "friend in embassy" referred to Assange. Corsi added in the same
email, "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
26. According to recorded public statements recovered by the FBI, starting in early
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
Page 8 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 16 of 48
During the interview, Stone stated that he was "in communication with Assange"
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communications with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN television interview on or about August 18, 2016, Stone stated that he
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
produced a series of text messages between Stone and Credico during the 2016 presidential
Page 9 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 17 of 48
campaign. 3 These text messages show that, beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeaks and Assange planned to
a. On or about August 19, 2016, Credi co sent a text message to Stone that read in part,
August 21 , 2016, Credi co sent another text message to Stone, writing in part, "I
b. On or about August 25, 20 16, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was " in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
3
As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
Page 10 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 18 of 48
added in a later text message, "Just remember do not name me as your connection
e. Later on or about September 18, 2016, Stone emailed Credi co an article with
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.
g. On or about September 30, 2016, Credico sent Stone via text message a photograph
was located.
h. On or about October l, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday . . . now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary
Page 11 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 19 of 48
1. On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to-
J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it[']s on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
28. Emails and text messages recovered by the FBI show that, in or around October
2016, Stone made statements about Assange' s future releases that were similar to prior statements
which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange -
4
A search of was authorized on or about October 17, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
second search of was authorized on or about August 3, 2018 by the U.S.
District Court for the District of Columbia. Case No. 1: 18-sc-2583 (D.D.C. Aug. 3, 2018).
Page 12 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 20 of 48
what' s he got? Hope it's good." Stone responded, " It is. I'd tell Bannon but he
c. On or about October 4, 2016, Assange held a press conference but did not release
Steve Bannon on or about October 4, 2016 that occurred after the press conference.
In the exchange, Bannon asked, " What was that this morning???", referring to
thinks they are going to kill him and the London police are standing do[wn].
replied, " Yes - want to talk on a secure line - got Whatsapp." In an interview with
the Special Counsel ' s Office in or around May 2018 confirmed that he and
Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from
Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read "well done." Similarly,
5
A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No. l: 18-sc-662 (D.D.C. Mar. 14, 2018). The
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
Page 13 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 21 of 48
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating
allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone' s prior public
statements about having communications with Assange (particularly those from August 2016)
31. In or around May 2017, HP SCI sent a letter requesting that Stone voluntarily appear
before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was
32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and
stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts
6
On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active measures"
directed against the United States in connection with the 2016 election.
Page 14 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 22 of 48
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
33. On or about September 26, 2017, Stone provided HPSCI with an "opening
statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony in a closed session
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Special Counsel' s Office from HPSCI in or around
December 2018. Stone appeared before HP SCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearing, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document
7
On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone' s written opening statement, and various
correspondence from Stone' s counsel to members ofHPSCI.
Page 15 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 23 of 48
request and whether Stone had any documents or written communications that discussed Julian
[ ...]
36. In fact, and as described above, Stone had sent and received numerous emails and
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and
Page 16 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 24 of 48
at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017.8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016 that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that "should
see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016
that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to
explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
8
The warrant for Stone's email account was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account was obtained on or about October 17, 2017 and executed
shortly thereafter. The warrant for Stone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
Page 17 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 25 of 48
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38. Stone testified that these public references to having a means of contacting
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "go-
between, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
39. In fact, documents recovered during the investigation (including those obtained via
search warrant returns show that Stone did not begin communicating
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9- approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after his August 12, 2016 statements of being " in communication with
40. When interviewed by the FBI, Credico stated that the first time he ever spoke with
°
Assange was on or about August 25, 2016, when Credico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between him and another
9
As described above, on or about August 19, 2016, Credi co informed Stone by text message that
Credi co intended to interview Assange the following week. On or about August 25, 2016, Credi co
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."
1
°Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews
Page 18 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 26 of 48
member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
41. The FBI has not identified any communications between Stone and Credico from
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
42. In contrast, and as described above, the FBI has identified written communications
prior to August 8, 2016 in which Stone directed Corsi-not Credico--to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WikiLeaks emails .. . they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico--sent an email to Stone in which Corsi
wrote that " [w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
source for information from WikiLeaks. Similarly, Stone also never disclosed his written
communications with Corsi to HPSCI when answering HPSCI' s questioning about the August 8,
2016 and August 12, 2016 statements about being in communication with Assange.
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to
communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
Page 19 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 27 of 48
44. In fact, starting on or about September 18, 2016, Stone directed Credi co to pass on
a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August IO to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
September 19, 2016, Stone texted Credico again, writing " Pass my message . .. to
Assange." Credico responded, "I did." An email obtained from the account
forwarded the request to an attorney who had the ability to contact Assange;
45. During his HPSCI testimony, Stone was asked repeatedly about his
communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
Page 20 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 28 of 48
A: No.
A: No.
Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
A: No.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his intermediary)
engaged in frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
47. Written communications between Stone and Credico continued up until Stone's
HPSCI testimony and afterwards. For example, on or about September 26, 2017- the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages from
his identified intermediary-Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone denied
Page 21 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 29 of 48
ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or around September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you [] said you have a back-channel way back a month before I had Assange on
my show ... I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together .. . so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this emai l was obtained through
49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your
conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
a. As described above, Gates confirmed to investigators that Stone spoke with senior
3, 2016, Stone wrote to , " Spoke to my friend in London last night. The
Page 22 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 30 of 48
Credico about the delay in WikiLeaks's release of stolen materials, Stone emailed
Bannon that Assange had a " [s]erious security concern" but would release "a load
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his " intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged
51. In or around November 2017, Credico received a request from HP SCI to testify
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, " ' Stonewall it. Plead the fifth . Anything to save the
plan' . .. Richard Nixon." (A copy of these text messages was recovered through
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
Page 23 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 31 of 48
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
account).
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, "Are you sure you want to make something out of this now? Why
not wait to see what [Credico] does? You may be defending yourself too much -
raising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1, 2017, Stone told
Page 24 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 32 of 48
from investigators.
f. On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool. " Later that day, Credico texted Stone, " You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you' re a fool. Because of tromp I could never get away with a certain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you' re stupid enough to testify." (A copy of these text
account).
52. On or about December 12, 2017, Credico informed HP SCI that he intended to assert
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
53. Following Credico's invocation of his Fifth Amendment privilege not to testify
before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 .. . docs prove that ... You should be honest w fbi . . . there
was no back channel ... be honest." Stone replied approximately two minutes
later, "I'm not talking to the FBI and if your smart you won't either." (A copy of
Page 25 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 33 of 48
iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. You
are a stoolie. You backstab your friends- run your mouth my lawyers are dying
Rip you to shreds." Stone also said he would "take that dog away from you,"
referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
accoun ).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee . . . you've opened yourself up to
perjury charges like an idiot." Stone responded, " You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact the head of Assange]." (A
Credico was sensitive to having this friend 's name publicly disclosed.
54. As described above, the government has recovered the content of many of Stone's
electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
Page 26 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 34 of 48
numerous other relevant electronic communications, the content of which it has not yet been able
to recover.
55. As described above, during his HPSCI testimony, Stone falsely denied having
emailed or exchanged text messages with his " intermediary" (later identified by Stone as Randy
Credico). In fact, emails and text messages recovered in this investigation show the two
communicated frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI' s inquiry, but Stone
56. In addition to these emails and text messages in the FBI's possession, the FBI has
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017, and
they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
Page 27 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 35 of 48
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations. As discussed further below, the
government has reason to believe that these messages may be located on the Subject Devices.
57. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed
that Stone has used encrypted applications to communicate with others. Similarly, records
obtained in this investigation indicate Stone uses multiple applications designed for encrypted
communication, including (a) WhatsApp, 11 (b) Signal, 12 (c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
11
According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device' s default message
application.
12
According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender' s and the receivers' devices.
13
According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
14
According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-
side encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
Page 28 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 36 of 48
email to that they "talk on a secure line" and proposed using WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal application
Additionally, text messages recovered from Stone' s iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
15
This attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
Page 29 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 37 of 48
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
59. The FBI continues to seek evidence of Stone's communications and contacts during
the period of the 2016 U.S. presidential election and through the present. The FBI believes these
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such
investigation by showing additional contacts and communications about Assange and WikiLeaks
60. In or around November 2018, media reports began to publish excerpts of text
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements and described further below, your affiant believes the cell phone referenced in the
16
See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger-
stone-wikileaks-randy-credico-mueller.
Page 30 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 38 of 48
61. On or about February 11, 2019, investigators, with the consent of Roger Stone's
attorneys, spoke with , a certified forensic examiner who stated he had been retained
by Roger Stone's attorneys. had been authorized by Stone's attorneys to provide the
Subject Devices to the FBI, although in providing the devices, Stone did not consent to their search.
Stillman gave the Agents three devices: the iPhone 5s, the iPhone 7, and the external hard drive.
associated with the phone number ending in Stone's cellular number as discussed above.
The documentation also indicated that had imaged the iPhone 5s on or about November
10, 2018, several days before the article discussed above where Stone claimed to have released
newly-uncovered messages with Credico. Toll records produced by AT&T pursuant to subpoena
indicate that Stone used an iPhone 5s from at least on or about January 1, 20 15 through on or about
November 14, 2016. Therefore, it appears that the iPhone 5s was the device Stone was using
through November 14, 2016 to communicate with individuals including Credico and Corsi.
provided to investigators was associated with the same Stone phone number ending in . As
discussed above, toll records produced by AT&T pursuant to subpoena indicate that Stone used an
iPhone 7 from at least on or about November 14, 2016 through on or about February 25, 2018. As
described above, Stone communicated extensively with Credico during this time. Toll records
also indicate Stone continued to communicate with Corsi during this time period using the x3034
number.
The government believes copies of later-in-time text messages from late 2016 and early 2017 could
be located on another device, such as the iPhone 7, or on backup storage media.
Page 31 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 39 of 48
64. further told investigators that the external hard drive contained forensic
images of Stone' s computers. stated that the hard drive contained backups created by a
separate company in September 2017 from Stone' s computers in both Florida and New York.
According to the backups were created as "clone copies," which are copies of Stone' s
computer systems. also indicated that the drive contained a separate image
created in March 2018 of Stone' s computer in Florida, as well as backup images of the iPhones
discussed above. As explained further herein, there is reason to believe that these images contain
communications made by Stone with Credico, Corsi, and others made during the relevant time
search the Subject Devices. One form in which the records might be found is data stored on a
device 's hard drive. Thus, the warrants applied for would authorize the search of electronic storage
media.
66. Probable cause. I submit that there is probable cause to believe those records will
be stored on the Subject Devices (the term "computer" below refers to Subject Devices), for at
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
Page 32 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 40 of 48
computer, the data contained in the file does not actually disappear; rather, that data
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer' s operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
data structures, and virtual memory "swap" or paging files. Computer users
typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how computers
were used, the purpose of their use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence will be on the Subject Devices because:
Page 33 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 41 of 48
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file) . Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
medium that can reveal information such as online nicknames and passwords.
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the criminal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent ·
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for " indicia of occupancy" while executing a
Page 34 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 42 of 48
malware detection programs may indicate whether the computer was remotely
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains information that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media ( e.g., a thumb drive).
The geographic and timeline information described herein may either inculpate or
exculpate the computer user. Last, information stored within a computer may
provide relevant insight into the computer user's state of mind as it relates to the
offense under investigation. For example, information within the computer may
indicate the owner's motive and intent to commit a crime (e.g., internet searches
Page 35 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 43 of 48
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
contextual information necessary to understand other evidence also falls within the
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular thing
Page 36 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 44 of 48
requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
CONCLUSION
68. Based on the foregoing, your affiant respectfully requests that this Court issue a
search warrant for the Subject Devices, more particularly described in Attachment A authorizing
Respectfully submitted,
~ ~ d e, 4 . / ~
Special Agent
Federal Bureau of Investigation
Page 37 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 45 of 48
ATIACHMENTA
Property to be Searched
Columbia:
Page 38 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 46 of 48
ATTACHMENT B
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section I 00 I (false statements); and (iii) Title 18,
United States Code 1512(b)(l) (witness tampering), those violations involving Roger Stone, for
and p
telephone number ;
Page 39 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 47 of 48
h. Records and information relating to the Signal account associated with telephone
numbe
1. Records and information relating to the Wickr account associated with telephone
numbe
above;
k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
history, user profiles, email, email contacts, "chat," instant messaging logs,
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
software;
Page 40 of 41
Case 1:19-mc-00029-CRC Document 29-31 Filed 04/28/20 Page 48 of 48
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
e. evidence indicating the computer user's state of mind as it relates to the crime under
investigation;
1. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 41 of 41
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 1 of 56
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Southern District of New York
(identify the person or describe the property to be searched and give its location):
See Attachment A
The person or property to be searched, described above, is believed to conceal (identify the person or describe the property
to be seized):
See Attachment A
The search and seizure are related to violation(s) of (insert statuto,y citations):
0 I find that immediate notification may have an adverse result listed in 18,HS·'.C. § 2705 (except :for delay
of trial), and authorize the officer executing this warrant to delay notice to the p'ers9ri \\'.hO,: or whose prop(;)rty, will be
searched or seized (check the appropriate box) Ofor days (not to exceed 30). · ' ' , ·
· I J I \
Ountil, the facts justifying, the later specific. •dat,e: of, ·, -------
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant
to the Court.
Date:
Executing officer's signature
ATTACHMENT A
The premises to be searched (the "Subject Premises") are described as follows, and
The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
1
. '
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 4 of 56
c. Documents that reflect communications between Roger Stone and Jerome Corsi
Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
2016 U.S. presidential election and related matters by the U.S. House of
accounts ;
h. Records and information demonstrating who uses, owns, or controls the WhatsApp
1. Records and information demonstrating who uses, owns, or controls the Signal
J. Records and information demonstrating who uses, owns, or controls the Wickr
2
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 5 of 56
form; and
form.
The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1. Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2. Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3. Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C. Review of ESI
Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.
3
I P \. 'I
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 6 of 56
In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
• surveying various file "directories" and the individual files they contain (analogous to
looldng at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);
• opening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;
• scanning storage areas to discover and possibly recover recently deleted files or
.deliberately hidden files;
• performing key word searches through all electronic storage areas to determine whether
occuITences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and
• reviewing metadata, system inf01mation, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.
Law enforcement personnel will make reasonable effo1is to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.
4
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 7 of 56
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~vidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
~roperty designed for use, intended for use, or used in committing a crime;
0 a person to be· arrested or a person who is unlawfully restrained.
~ C / } 1 f . 's., s/gl1ati~re
) '. ,( / '\ i 11:' '· ( '11 ''}
., '$A rylic~ei_
-------,,--.,, ) ! ,, .
J, 'Robi1?Js0h ~ - - - - - -
-\......--.---,
0
'· f JI!
Prinzed ,iame
'
and titleI J
,
' \ ' ' '
Sworn to before me and signed in my presence. , ;."'J
• I./;; I I '
. I' '
..I
.Yi;'i '.-r'~..--·--···,··
J~r/;/J/2
I.. I •
,··, J ! \ I • r ,
. /'
*'~/\LY< /I ·,, ' ~ , )
Date: - - - - - ~ - ~ - ' , , ·~--.-;..,--'+'~ ·-'------
I .
' .. ' J~dge 's sig,!atuta '
.I I I ) j ' ·,\ '
-----------J'
I. Introduction
A. Affiant
1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have
been since September 2012. I successfully completed New Agent Training at Quantico, Virginia,
Rules of Criminal Procedure for a warrant to search the premises specified below (the "Subject
Premises") for, and to seize, the items and informatiQn described in Attachment A. This affidavit
conversations with other law enforcement personnel; and my training, experience and advice
received concerning the use of computers in criminal activity and the forensic analysis of
electronically stored information ("ESI"). Because this affidavit is being submitted for the limited
purpose of establishing probable cause, it does not include all the facts that I have learned during
the course of my investigation. Where the contents of documents and the actions, statements, and
conversations of others are reported herein, they are reported in substance and in part, except where
otherwise indicated.
1
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 9 of 56
4. For the reasons detailed below, I believe that there is probable cause to believe that
the Subject Premises contain evidence, fmits, and instrumentalities of violations of (i) Title 18,
United States Code, Section 1505 (obstruction of proceedings before departments, agencies, and
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code, Section l 512(b)(1) (witness tampering); (collectively the "Subject Offenses").
contained herein based on my own investigation, as well as my review of documents, records, and
6. This affidavit is intended to show merely that there is sufficient probable cause for
the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I asse1i that an event took place on a particular date, I am asserting that it took
2
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 10 of 56
7. For the reasons set forth in this Affidavit, there is probable cause to believe that one
or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., ("Roger Stone")
and others known and unknown to the government. Further, there is probable cause to believe the
Subject Premises have been used to facilitate the commission of one or more of the Subject
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises.
a. Roger Stone is a political consultant who has worked for decades in U.S. politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential
2015, and subsequently maintained regular contact with and publicly supported the
documents stolen from the U.S. government. At all relevant times, Assange was
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi
spoke regularly with Stone throughout the campaign, including about the release of
3
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 11 of 56
e. ,Randy Credico was a radio host who has lmown Stone for more than a decade. In
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr.
Stone" that Assange, had "' [e] mails related to Hillary Clinton which are pending
publication.'"
f. Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November
2016, Gates served as the deputy campaign chairman of the Trump Campaign. On
February 23, 2018, Gates pled guilty to one count of conspiracy against the United
States and one count of making false statements to federal law enforcement officers.
in or around August 2016 and through the 2016 U.S. presidential election, Bannon
4
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 12 of 56
9. John Podesta is a U.S. citizen who served for years as a political consultant. During
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation through which an actor would have gained access to Podesta' s email
account allowing the actor to steal emails and documents from that account.
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity ·
1
In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known ot trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicldng a malicious link or URL.
5
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 13 of 56
11. On or about June 14, 2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bJoth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
12. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia
returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, l:18-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
13. As alleged in the Netyksho indictment, after successfully hacking the DNC and
DCCC networks, as well as Podesta' s email account, GRU officers transmitted some of the stolen
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the
transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
14. On or about July 22, 2016, WildLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior DNC
6
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 14 of 56
officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
thousands of emails and documents stolen from Podesta's email account. Between on or about
documents that had been stolen from. John Podesta, releasing a total of over 50,000 stolen
documents.
16. In April 2018 interviews with the Special Counsel's Office, Gates stated that
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
WildLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed
17. According to Gates, Manafort directed Gates to contact Stone about any additional
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel's Office in or
around October 2018, Gates recalled that at one point during the campaign he was with then-
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.
7
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 15 of 56
2
show that shortly after the July 22, 2016 releas~ of stolen DNC emails
by WikiLeak:s, Stone coffesponded with other associates about contacting WikiLeaks in order to
a. On or about July 25, 20~6, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to who lived in the United Kingdom and was a supporter of
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that "should see Assange."
c. On or about August 2, 2016, Corsi emailed Stone and wrote that he was cuffently
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
the phrase "friend in embassy" refeffed to Assange. Corsi added in the same email,
"Time to let more than Podesta to be exposed as in bed w enemy if they are not
2
A search of was authorized on or about September 11, 2017 by the U.S.
District Cour umbia. Case No. 1:l 7-mj-661 (D.D.C. Sept. 11, 2017). A
second search o was authorized on or about August 3, 2018 by the U.S.
District Court fo a. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 27 03 (d) for records connected to Case No. 1:18-sc-2911 (D .D. C. Sept.
26, 2018). Records provided in r rporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
8
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 16 of 56
ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
19. According to recorded public statements recovered by the FBI, starting in early
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
During the interview, Stone stated that he was "in communication with Assange"
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communication with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN teleyision interview on or about August 18, 2016, Stone stated that he
9
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 17 of 56
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
produced a series of text messages between Stone and Credico during the 2016 presidential
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeak~ and Assange planned to
a. On or about August 19, 2016, Credico sent a text message to Stone that read in part,
August 21, 2016, Credico sent another text message to Stone, writing in part, "I
3
As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
10
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 18 of 56
b. On or about August 25, 2016, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Julian Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
added in a later text message, "Just remember do not name me as your connection
e. Later on or about September 18, 2016, Stone emailed Credico an article with
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.
11
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 19 of 56
g. On or about September 30, 2016, Credico sent Stone via text message a photograph
was located.
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
about Tuesday, October 4, 2016, which was rep01ied to be the 10-year anniversary
1. On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to-
J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it['Js on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
21. Emails and text messages recovered by the FBI show that, in or around October
2016, Stone made statements about Assange's future releases, including statements that were
12
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 20 of 56
which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Steve Bannon. In the exchange, the reporter asked,
"Assange - what's he got? Hope it's good." Stone responded, "It is. I'd tell
c. On or about October 4, 2016, Assange held a press conference but did not release
Bannon on or about October 4, 2016 that occurred after the press conference. In
the exchange, Bannon asked, "What was that this morning???," referring to
thinks they are going to kill him and the London police are standing do[wn].
messages between Stone and from on or about October 4, 2016. In one text
4
A search of was authorized on or about October 17, 2017 by the U.S.
District Court umbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
second search of was authorized on or about August 3, 2018 by the U.S.
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018).
5
A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Comi for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). · The
13
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 21 of 56
replied, "Yes -want to talk on a secure line- got Whatsapp." In an interview with
the Special Counsel's Office in or around May 2018, confirmed that he and
Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
22. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from
Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read, "well done." Similarly,
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
23. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating
allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HP SCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (paiiicularly those from August 2016)
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
6
On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.
14
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 22 of 56
24. In or around May 2017, HP SCI ~ent a letter requesting that Stone voluntarily appear
before the committee and produce relevant documents to HP SCI (a copy of the HPSCI letter was
25. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and .
stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
26. On or about September 26, 2017, Stone provided HPSCI with an "opening
statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
7
On or about December 14, 2018, the U.S. Depaiiment of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Depaiiment of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members ofHPSCI.
15
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 23 of 56
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
27. Also on or about September 26, 2017, Stone provided testimony in a closed session
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Department of Justice from HPSCI in or around
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearin~, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
28. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document
request and whether Stone had any documents or written communications that discussed Julian
[...]
16
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 24 of 56
29. In fact, and as described above, Stone had sent and received numerous emails and
text messages during the 2016 campaign in which he discussed WildLeaks, Assange, and
at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017. 8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016, that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WildLeaks emails . . . they deal with
8
The warrant for Stone's email account was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to acourtorderissued pursuant to 18 U.S.C. § 2703(d) confrrmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account was obtained on or about October 17, 2017 and executed
shortly thereaf tone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
17
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 25 of 56
Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that "should
see Assange"; (c) Corsi' s email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016
that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
30. During his HPSCI testimony on or about September 26, 2017, Stone was asked to
explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at libe1iy to discuss what I have."
31. Stone testified that these public references to having a means of contacting
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "go-
between, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentlem:an who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
18
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 26 of 56
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9-approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after to his August 12, 2016 statements of being "in communication
33. When interviewed by the FBI, Credico stated that the first time he ever spoke with
°
Assange was on or about August 25, 2016, when ~redico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between lie and another
member of WildLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
34. The FBI has not identified any communications between Stone and Credico from
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
35. In contrast, and as described above, the FBI has identified written communications
prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WildLeaks emails ... they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico-sent an email to Stone in which Corsi
9
As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."
°
1
Credico was first interviewed by the FBI in or around August 2018. He has subsequently
paiiicipated in multiple voluntary interviews.
19
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 27 of 56
wrote that "[w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
source for information from WikiLeaks. Stone also.never disclosed his written communications
with Corsi to HPSCI when answering HPSCI's questioning about the August 8, 2016_ and August
36. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to
communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
37. In fact, starting on or.about September 18, 2016, Stone directed Credico to pass on
a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
20
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 28 of 56
September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Assange." Credico responded, "I did." An email obtained from the account
forwarded the request to an attorney who had the ability to contact Assange;
38. During his HPSCI testimony, Stone was asked repeatedly about· his
communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
A: No.
A: No.
Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
A: No.
21
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 29 of 56
A: Correct.
39. As described above, Stone and Credico (who Stone identified as his intermediary)
engaged in :frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
40. Written communications between Stone and Credico continued up until Stone's
HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HP SCI and denied having ever sent or received emails or text messages :from
his identified intermediary, Stone and Credico exchanged over thirty text messages.
41. Certain of the electronic messages between Stone and Credico (which Stone denied
ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or a!ound September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HP SCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you[] said you have a back-channel way back a month before I had Assange on
my show . . . I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together ... so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this email was obtained through.
22
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 30 of 56
42. During his HPSCI testimony, Stone was asked, "[d]id you discuss your
conversations with the inteimediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
a. As described above, Gates confirmed to investigators that Stone spoke with senior
b. , on or about October
Credi co about the delay in WikiLeaks' s release of stolen materials, Stone emailed
Bannon that Assange had a "[sJerious security concern" but would release "a load
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HP SCI, but Stone did not do so. Stone then engaged in a prolonged
23
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 31 of 56
44. In or around November 2017, Credico received a request from HPSCI to testify
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, "' Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
account).
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, ''Are you sure you want to make something out of this now? Why
24
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 32 of 56
not wait to see what [Credico] does? You may be defending yourself too much-
raising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
11, who falsely claims not to lmow critical information before a congressional
committee that he does in fact lmow. On or about December 1, 2017, Stone told
from investigators.
f. On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you're a fool. Because of tromp I could never get away with a ce1iain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you're stupid enough to testify." (A copy of these text
account).
45. On or about December 12, 2017, Credico informed HPS CI that he intended to assert
25
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 33 of 56
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
46. Following Credico's invocation of his Fifth Amendment privilege not to testify
before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made statements intended to prevent
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi . . .
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip you
to shreds." Stone also said he would "take that dog away from you," referring to
Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready.
Let's get it on. Prepare to die [expletive]." (A copy ofthis email exchange was
).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
pe1jury charges like an idiot." Stone responded, "You are so full of [expletive].
26
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 34 of 56
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact Assange]." (A copy of this
47. As described above, the government has recovered the content of many of Stone's
electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
numerous other relevant electronic communications that it has not yet been able to recover the
content.
48. As described above, during his HPSCI testimony, Stone falsely denied having
emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico). In fact, emails and text messages recovered in this investigation show the two
communicated :frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone
49. In addition to these emails and text messages in the FBI's possession, the FBI has
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017 and
27
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 35 of 56
they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
;
for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
50. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed
that Stone has used encrypted applications to communicate with others. Similarly, records
obtained in this investigation indicate Stone uses multiple applications designed for encrypted
28
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 36 of 56
communic~tion, including (a) WhatsApp, 11 (b) Signal, 12 ( c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
email to that they "talk on a secure line" and proposed using WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal application
Additionally, text messages recovered from Stone's iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact
11
According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default message
application.
12
According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender's and the receivers' devices.
13
According to open sources, Wicla is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmi_tted through the network.
14
According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-
side encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
29
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 37 of 56
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
applications such as WhatsApp, Signal, ProtonMail, and Wicla are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
52. The FBI continues to seek evidence of Stone's communications and contacts dming
the period of the 2016 U.S. presidential election and through the present. The FBI believes these
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such
15
This attorney was a close friend of Credico' s and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
·30
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 38 of 56
investigation by showing additional contacts and communications about Assange and WikiLeaks
approximately December 2016 and resided in Stone's previous New York apartment for a period
of time. provided information technology support for Stone, but was not f01mally trained to
do so. was aware that Stone communicated with Trump during the 2016 presidential
campaign, and afterward, both in person and by telephone. provided information about c\.
meeting at Trump Tower between Trump and Stone during the time worked for him, to which
Sterne carried a "file booklet" with him. Stone tol the file booklet was important and that
no one should touch it. also said Stone maintained the file booklet in his closet.
("Person 1") who previously had a professional relationship with a reporter who provided Person
1 with info1mation about Stone. The reporter relayed to Person 1 that in or around January and
February 2016, Stone and Trump were in constant communication and that Stone kept
contemporaneous notes of the conversations. Stone's purpose in keeping notes was to later provide
31
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 39 of 56
55. Your affiant is aware through the investigation that Stone maintains the Subject
Premises as his secondary residence. 16 Associates of Stone's have confirmed that Stone maintains
the Subject Premises as his residence when he visits New York, New York. 17
Your affiant believes established the Charter Com.munications account at the Subject
58. Stone participated in an on camera interview that was aired on or about November
2018 at the Subject Prem.ises 18 . Your affiant observed an Apple MacBook Pro computer and an
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the
16
Stone's primary residence is
17
Public real estate listing indicates the Subject Premises has been listed since December 5, 2018
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing
stated it was not available for viewing until February 1, 2019 because it was still occupied by the
tenant.
18
https://www.washingtonpost.com./p~litics/2018/11/08/roger-stone-has-rule-deny-everything-
he-does/?utm. term=.5ab41ac5df22
32
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 40 of 56
determined that on or about December 2018, the user of the account associated with
Stone's telephone number and email address used Uber services at addresses at or close to the
Subject Premises. Your affiant is aware that users of Uber's services do not always use their
precise address when arranging for transportation, and believes the addresses close to the Subject
Premises are consistent with an individual whose destination is the Subject Premises.
60. Based on law enforcement interviews, your affiant is aware that Stone has used and
uses cellular telephones, desktop, and laptop computers to conduct electronic communications.
Stone also configures his computers to create regulars backups of his computers and maintains one
of these devices at the Subject Premises, which preserves documents and communications.
61. In or around May 2018, the FBI interviewed an individual ("Person 2") who
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
and invoices issued to Nydia Bertran-Stone for information technology ("IT") services dated
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for
IT services in connection with three different Apple computers. Specifically, the billing receipts
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name
with the name "Stone-Roger-iMac-NYC"; and (3) an Apple MacBookPro 10 (serial number
available information, the iMac is one of Apple's desktop models (i.e., a computer designed to be
33
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 41 of 56
suggests it is a stationary computer used by Stone and located at the Subject Premises. 19 According
to the billing records, Person 2 was requested to perfo1m remote support services on or about
62. In the aforementioned Washington Post interview of Stone, at least two electronic
devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop
computer.
63. Person 2 also told law enforcement that Stone used the Apple Time Machine
("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences. According to publicly available information,
Time Machine is the built-in backup feature of Apple computers and can create copies of files on
a computer, including applications, music, photos, email, documents, and system files. A Time
Machine backup allows users to restore files from a specific point in time if the original files are
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time
Machine, a user connects an external storage device to the computer and selects that external
2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone
November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s
19
According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
20
When the external is plugged in, 'the Time Machine will automatically make hourly backups for
the past 24 hours, daily backups for the past month, and weekly backups for all previous months.
The oldest backups are deleted when the external storage device selected as the backup disk is full.
The external device can be as small as a USB thumb drive.
34
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 42 of 56
("iPhone 5s") (IMSI 310410657061814). On or about November 14, 2016, Stone's cellular
telephone number was transferred to an Apple iPhone model 7 ("iPhone T') (IMSI
310410930460769). On or about September 28, 2018, Stone's cellular telephone number was
show that the account associated with Stone's telephone number and email address has the Uber
~pplic_~ti(?ll on multiple d~vic~s~ including a_device ide1!-tified as iPha.nel 1/, UDID - 668EDC?6-
"iPhonell,2" con-elates to an Apple iPhone model XS. Additionally, the subpoena returns
DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 correlates
35
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 43 of 56
67. Statements attributed to Stone in recent media articles also indicate that Stone
retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media repo1is began to publish excerpts of text
messages between Stone and Randy Credico that occuned during the 2016 U.S. election (copies
23
o_f these tex_t 11?-~s.s~ges su~sequ~11tly ~~re obtained from Sto!_l~ ).
According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements, your affiant believes the cellular telephone referenced in the article to be the
iPhone 5s documented in the aforementioned AT&T records (which records indicate he stopped
using on or about November 14, 2016).24 Further, your affiant believes Stone maintains other
there is probable cause to believe those records will be stored on that computer or storage medium,
23 See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger-
stone-wildleaks-randy-credico-mueller.
24 Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occuned on or about November 14,
201 6. The government believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.
36
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 44 of 56
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
computer, the data contained in the file does not actually disappear; rather, that data
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer's operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
data structures, and viliual memory "swap" or paging files. Computer users
typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
37
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 45 of 56
not only computer files that might serve as direct evidence of the crimes described on the warrant,
but also for forensic electronic evidence that establishes how computers were used, the purpose of
their use, who used them, and when. There is probable cause to believe that this forensic electronic
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or. of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
medium that can reveal inf01mation such as online nicknames and passwords.
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the crilninal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent
38
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 46 of 56
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
malware detection programs may indicate whether the computer was remotely
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains infmmation that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media (e.g., a digital camera
39
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 47 of 56
information described herein may either inculpate or exculpate the computer user.
Last, information stored within a computer may provide relevant insight into the
computer user's state of mind as it relates to the offense under investigation. For
example, information within the computer may indicate the owner's motive and
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
contextual information necessary to understand other evidence also falls within the
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a paiiicular thing·
40
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 48 of 56
70. Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search
for and seize property "may authorize the seizure of electronic storage media or the seizure or
copying of electronically stored information ... for later review." Consistent with Rule 41, this
application requests authorization to seize any computer devices and storage media and transport
them to an appropriate law enforcement facility for review. This is typically necessary for a number
of reasons:
• First, the volume of data on computer devices and storage media is often impractical
for law enforcement personnel to review in its entirety at the search location.
• Third, there are so many types of computer hardware and software in use today that it
can be impossible to bring to the search site all of the necessary technical manuals and
specialized personnel and equipment potentially required to safely access the
underlying computer data.
• Fourth, many factors can complicate and prolong recovery of data from a computer
device, including the increasingly common use of passwords, encryption, or other
features.or configurations designed to protect or conceal data on the computer, which
often take considerable time and resources for forensic personnel to detect and resolve.
71. In most cases, a thorough search of a premises for information that might be stored
on storage media often requires the seizure of the physical storage media and later off-site review
consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a
41
'
(
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 49 of 56
complete electronic picture of the computer's data, including all hidden sectors and deleted files.
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data
recorded on the storage media, and to prevent the loss of the data either from accidental or
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing evidence
of how a computer has been used, what it has been used for, and who has used it
requires considerable time, and taking that much time on premises could be
unreasonable. As explained above, because the warrant calls for forensic electronic
storage media to obtain evidence. Storage media can store a large volume of
information. Reviewing that information for things described in the warrant can
take weeks or months, depending on the volume of data stored, and would be
that might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
environment will allow its examination with the proper tools and lmowledge.
42
, '
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 50 of 56
c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing with
72. Because multiple people share the Subject Premises as a residence, it is possible
that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as well.
· B. Review of ESI
73. Following seizure of any computer devices and storage media and/or the creation
of forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) will review the ESI contained therein for information responsive to the
warrant.
74. In conducting this review, law enforcement personnel may use various techniques
to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such
• surveying directories or folders and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);
• conducting a file-by-file review by "opening" or reading the first few "pages" of such
files in order to determine their precise contents (analogous to performing a cursory
examination of each document in a file cabinet to detennine its relevance);
• "scanning" storage areas to discover and possibly recover recently deleted data or
deliberately hidden files; and
43
I '
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 51 of 56
• reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, wl).en, and by whom the computer was used.
75. Law enforcement personnel will make reasonable efforts to restrict their search to
data falling within the cate~ories of evidence specified in the warrant. Depending on the
circumstances, however, law enforcement personnel may need to conduct a complete review of all
the ESI from seized devices or storage media to evaluate its contents and to locate all data
privileges. The procedures include use of a designated "filter team," separate and apart from the
C. Return of ESI
77. If the Government determines that the electronic devices are no longer necessary
to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request.
Computer data that is encrypted or unreadable will not be returned unless law enforcement
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of
25
Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover,
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword
search because the information does not contain the keywords being searched.
44
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 52 of 56
the ·criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the
Subject Offenses.
78. Based on the foregoing, I respectfully request the court to issue a warrant to seize
the items and information specified in Attachment A to this affidavit and to the Search and Seizure
Warrant.
request that this affidavit and all papers submitted herewith be maintained under seal until the
Court orders otherwise. Sealing is necessary because items and information to be seized are
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and
related documents may have a negative impact on this continuing investigation and may jeopardize
its effectiveness.
Respectfully submitted,
Special Agent
Federal Bureau of Investigation
i) I \ I \ , ,.1/
1' , ' ~
'
iYU_;f~· '
I
J
,, . /
/ ' - -..............
• . . . ; . _ , . . . . ._ _ __
45
I '
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 53 of 56
ATTACHMENT A
The premises to be searched (the "Subject Premises") are described as follows, and
The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
1
/ '
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 54 of 56
c. Documents that reflect communications between Roger Stone and Jerome Corsi
, Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
2016 U.S. presidential election and related matters by the U.S. House of
accounts ;
h. Records and information demonstrating who uses, owns, or controls the WhatsApp
i. Records and information demonstrating who uses, owns, or controls the Signal
J. Records and information demonstrating who uses, owns, or controls the Wickr
2
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 55 of 56
form; and
form.
The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones·,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1. Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2. Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3. Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C. Review of ESI
Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.
3
Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 56 of 56
In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
• surveying various file "directories" and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);
• op-ening or cursorily reading the first few "pages" of such files in order to determine
their precise contents; ·
• scanning storage areas to discover and possibly recover recently deleted files or
deliberately hidden files;
• performing key word searches through all electronic storage areas to determine whether
occunences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and
• reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.
Law enforcement personnel will make reasonable efforts to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.
4
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 1 of 53
... , .- .
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Southern District of Florida
(identify the person or describe the property to be searched and give its location):
Fort Lauderdale, Florida (further described in Allachmenl nAn)
The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized):
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken .
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)
o I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay
of trial), and authorize the officer executing this warran~ to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for days (not to exceed 30).
J,.SS 0 until, the facts justifying, the later specific date of
City and state: Fort Lauderdale, Florida Lurana S . Snow, United States Magistrate Judge
Printed name and title
. .
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 2 of 53
ATTACHMENT A
Two photographs of the exterior of the Subject Premises are attached below.
Page 1 of1
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 3 of 53
.'
ATTACHMENT B
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
and
telephone number ;
h. Records and information relating to the Signal account associated with telephone
number ;
Page 1 of3
. . ...
, Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 4 of 53
1. Records and infonnation relating to the Wic1er account associated with telephone
number ;
above;
this warrant, and any computer or storage medium that contains or in which is stored records or
a. evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
browsing history, user profiles, email, email contacts, "chat," instant messaging
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
software;
Page 2 of3
.. . . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 5 of 53
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
e. evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
1. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 3 of3
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 6 of 53
· "
Return
Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with:
19-6033-SNOW
InventOlY made in the presence of:
Certification
I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designated judge.
Date:
Executing officer 's signature
Attachment nAn) )
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
Southern
located in the --------------- District of Florida , there is now concealed (identify the
- -----------------------
person or describe the property to be seized):
The basis for the search under Fed . R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed ;
f'i property designed for use, intended for use, or used in committing a crime;
o a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18U.S.C.1505 Obstruction of Proceeding
18 U.S.C. 1001 False Statements
18 U.S.C. 1512(b)(1) Witness Tampering
The application is based on these facts :
see attached affidavit.
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge
Printed name and title
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 8 of 53
ATTACHMENT A
Two photographs of the exterior of the Subject Premises are attached below.
Page 1 of 1
t '>t' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 9 of 53
ATTACHMENT B
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
and ;
telephone number ;
h. Records and information relating to the Signal account associated with telephone
number ;
Page 1 of3
f .. I
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 10 of 53
1. Records and information relating to the Wickr account associated with telephone
number ;
above;
this warrant, and any computer or storage medium that contains or in which is stored records or
a. evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this wan'ant were created, edited, or deleted, such as logs,
browsing history, user profiles, email, email contacts, "chat," instant messaging
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
software;
Page 2 of3
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 11 of 53
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
e. evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
I. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 3 of3
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 12 of 53
AFFIDAVIT IN SUPPORT OF
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
1. I make this affidavit in support of an application for a search warrant for the
2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have
been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cybersecurity.
3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger
Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(1 ) (collectively the "Specified Federal
Offenses") .
and information provided to me by other law enforcement officers and technical experts.
5. This affidavit is intended to show merely that there is sufficient probable cause
for the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
Page 1 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 13 of 53
and part. Where I assert that an event took place on a particular date, I am asserting it took place
particularly described in Attachment A), in connection with the Specified Federal Offenses, for
the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and
7. For the reasons set forth in this Affidavit, there is probable cause to believe that
one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S. politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
Page 2 of42
,. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 14 of 53
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
10. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke
regularly with Stone throughout the campaign, including about the release of stolen documents
by WikiLeaks.
12. Based on the investigation to date, Randy Credico was a radio host who has
known Stone for more than a decade. In testimony before the U.S. House of Representatives
Permanent Selection Committee on Intelligence (" HPSCI") on or about September 26, 2017,
Stone described Credico (without naming him) as an "intermediary," "go-between," and "mutual
friend" to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that
Assange, had '" [e ]mails related to Hillary Clinton which are pending publication. '"
13 . Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gales, 1: 17-cr-20 1 (D .D.C.).
Page 3 of42
•
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 15 of 53
14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the
16. John Podesta is a U.S. citizen who served for years as a political consultant.
During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the
Hillary Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016,
copy of the email was recovered by the FBI from a subsequent release of stolen emails,
described below). During an interview with the FBI in or around May 2018, Podesta indicated
that after receiving the email, his assistant (who also had access to the account) clicked on a link
within the email and entered the account password when prompted (believing this prompt to be
part of a security protocol). Based on my training and experience, this activity appears to have
been a successful spearphishing operation through which an actor would have gained access to
Podesta's email account allowing the actor to steal emails and documents from that account.
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal
I In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.
Page 4 of 42
,
< Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 16 of 53
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by
the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
the cybersecurity company CrowdS trike to investigate the intrusions and remediate.
IS. On or about June 14,2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bloth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
19. On or about July 13, 20 IS, a federal grand jury sitting in the District of Columbia
returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of Jolm Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: IS-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
20. As alleged in the Netyksho indictment, after successfully hacking the DNC and
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the
Page 5 of 42
f. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 17 of 53
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks." CGRU officers separately used these personas to release some of the stolen
documents).
21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior
DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
thousands of emails and documents stolen from Podesta's email account. Between on or about
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
23. In April 2018 interviews with the Special Counsel's Office, Gates stated that
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
24. According to Gates, Manafort directed Gates to contact Stone about any
additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's
Page 6 of42
., ~
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 18 of 53
Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
show that shortly after the July 22, 2016 release of stolen DNC emails
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to , who lived in the United Kingdom and was a supporter
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that " should see Assange."
c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
Page 7 of 42
• Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 19 of 53
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
26. According to recorded public statements recovered by the FBI, starting in early
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
Stone attended a public event in Broward County, Florida. During the event,
Stone stated, "I actually have communicated with Assange. I believe the next
tranche of his documents pertain to the Clinton Foundation, but there's no telling
Stone was interviewed for a video segment on the show Info Wars, hosted by Alex
Jones. During the interview, Stone stated that he was "in communication with
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-channel communication with WikiLeaks
Page 8 of 42
., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 20 of 53
and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
during a C-SP AN television interview on or about August 18, 2016, Stone stated
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You ' ve been in touch indirectly with
Assange. Can you give us any kind of insight? Is there an October surprise
happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
good information."
produced a series of text messages between Stone and Credico during the 2016 presidential
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeaks and Assange planned to
3 As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
Page 9 of 42
'.
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 21 of 53
a. On or about August 19, 2016, Credico sent a text message to Stone that read in
about August 21, 2016, Credico sent another text message to Stone, writing in
part, "I have Julian Assange on Thursday so I'm completely tied up on that day."
b. On or about August 25, 2016, Assange was a guest on Credico's radio show for
the first time. On or about August 26,2016, Credico sent a text message to Stone
that stated, "Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in
cahoots."
c. On or about August 27,2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in
charge" of the project. In a text message sent later that day, Credico added,
d. On or about September 18, 2016, Stone sent a text message to Credico that said,
added in a later text message, "Just remember do not name me as your connection
e. Later on or about September 18, 2016, Stone emailed Credico an article with
State. Stone stated, "Please ask Assange for any State or HRC e-mail from
Page 10 of 42
"j Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 22 of 53
20,2016,
forwarded request to a close who was an attorney
forwarded email.
messages stated, "big news Wednesday ... now pretend u don't know me ...
1. On or about October 2, 16, Stone emailed Credico, with the subject line
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement
Assange back off." Credico initially responded, "I can't tal[k] about it." After
II 42
, I
", Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 23 of 53
tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
28. Emails and text messages recovered by the FBI show that, in or around October
2016, Stone made statements about Assange's future releases that were similar to prior
which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange
what's he got? Hope it's good." Stone responded, "It is. I'd tell Bannon but he
c. On or about October 4, 2016, Assange held a press conference but did not release
Stone and Steve Bannon on or about October 4, 2016 that occurred after the press
conference. In the exchange, Bannon asked, "What was that this morning???,"
Page 12 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 24 of 53
concern. He thinks they are going to kill him and the London police are standing
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had
more material to release, and that the material was related to senior people
29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen
from Podesta. According to text messages recovered from Stone's iCloud account, shortly after
the release, an associate of Bannon sent a text message to Stone that read, "well done."
Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016
WikiLeaks release, Stone said, "I told you this was coming."
30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating
allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
S A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No.1: 18-sc-662 (D.D.C. Mar. 14, 2018). The
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
6On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
Page 13 of 42
., .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 25 of 53
March 20, 2017, multiple HPSCI committee members indicated that Stone's pnor public
statements about having communications with Assange (particularly those from August 2016)
31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account
32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and
stated, "Mr. Stone has no documents, records, or electronically stored information, regardless of
form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation'S publicly-announced parameters." (A copy of the letter was recovered
33. On or about September 26, 2017, Stone provided HPSCI with an "opening
statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection wi ththe 2016 election.
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Page 14 of 42
, I
" , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 26 of 53
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony In a closed
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was
transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI
in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the
record that he would tell the truth. At the beginning of the hearing, Stone was admonished that
"it is unlawful to deliberately provide false information to Members of Congress or staff' and
that "providing false information to this committee or concealing material information from this
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017
document request and whether Stone had any documents or written communications that
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 42
, i Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 27 of 53
[... ]
that, at the time of his testimony, Stone was still in vv,",,,,,-,,, many these and text
8
warrant for Stone's email account was obtained on or about
September 11, 17 and executed shortly Records provided in or around September
18 in response to a court order issued pursuant to 18 § 2703(d) confinned that the
account was and emails question were not from account. The warrant
Page 16 42
" . , . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 28 of 53
communications included (a) Stone's email to Corsi on or about July 25, 2016, that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ...
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
Malloch "should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part: "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or
about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to
explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38. Stone testified that these public references to having a means of contacting
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "go-
between, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
for Stone's email account was obtained on or about October 17,2017 and
executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text
messages described above) was obtained on or about March 14, 2018 and executed shortly
thereafter.
Page 17 of42
, I ., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 29 of 53
consistent with Credico. (On or about October I 2017, Stone caused a letter to be to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. that
had '" [e] mails to Hillary Clinton which are pending publication. ''').
39. In fact, documents recovered during the investigation (including those obtained
communicating with Credico about .~~.~u ..,~ or WikiLeaks until on or about August 19, 2016 9
approximately days Stone first claimed on or about August 8, 2016 to "actually have
40. When interviewed by the FBI, Credico stated that the time he ever spoke
also provided the FBI with partially redacted emails that were between he
another member WikiLeaks from on or about August 25, which the two discuss the
contact WikiLeaks.
9
described on or about August 19, Stone by text message that
Credico intended to interview Assange the or about August 25, 2016,
Credico interviewed Julian the first time, on or about 1
"Assange has kryptonite on Hillary."
18 of 42
'. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 30 of 53
email to in which wrote that "[w lord is friend in embassy plans 2 more dumps,"
Stone also never disclosed written communications with Corsi to when answering
HPSCI's about the August 2016 and August 12, 2016 statements about
communication with
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intennediaryJ to
"Did you [the intermediary] to do on your own behalf?" Stone responded, did
not."
September 18, 2016, Stone sent a text v"''''''''~v to Credico said, "I am e-
Page 19 of 42
" . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 31 of 53
to her service as Secretary of State. Stone added, "Please ask Assange for any
2011 that mention [the subject of the article] or confinn this narrative." (A copy
).
September 19,2016, Stone texted Credico again, writing "Pass my message ... to
Assange." Credico responded, "I did." An email obtained from the account
forwarded the request to an attorney who had the ability to contact Assange;
45. During his HPSCI testimony, Stone was asked repeatedly about his
communications with the person he identified as his intennediary. Stone stated that he had never
communicated with his intennediary in writing in any way. During one exchange, Stone claimed
A: No.
Page 20 of 42
'. .
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 32 of 53
A: No.
Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
A: No.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his
intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19,2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.
47. Written communications between Stone and Credico continued up until Stone's
HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary, Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone
denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
Page 21 of 42
'. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 33 of 53
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your
conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
a. As described above, Gates confirmed to investigators that Stone spoke with senior
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
Page 22 of 42
,, Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 34 of 53
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
51. In or around November 2017, Credico received a request from HPSCI to testify
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
responded, "That was the point at which your lawyers should have told them you
Page 23 of 42
, . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 35 of 53
iCloud account).
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1,2017, Stone told
from investigators.
f On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You
Page 24 of 42
, , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 36 of 53
need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
account).
52. On or about December 12, 2017, Credico informed HPSCI that he intended to
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
53. Following Credico's invocation of his Fifth Amendment privilege not to testify
before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[ r] sept 7 ... docs prove that ... You should be honest w fbi ...
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip
Page 25 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 37 of 53
you to shreds." Stone also said he would "take that dog away from you,"
referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
account ).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact Assange]." (A copy of
54. As described above, the government has recovered the content of many of Stone's
electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election). However, the government is aware of the
existence of numerous other relevant electronic communications, the content of which it has not
55. As described above, during his HPSCI testimony, Stone falsely denied having
emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico). In fact, emails and text messages recovered in this investigation show the two
Page 26 of 42
"
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 38 of 53
email and iCloud accounts confirm that Stone still had those communications at the time he
discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
56. In addition to these emails and text messages in the FBI's possession, the FBI has
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
57. Additionally, the FBI has interviewed multiple associates of Stone, who
confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses mUltiple applications designed for
Page 27 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 39 of 53
encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)
14
ProtonMail. To date, the FBI has not obtained any of Stone's communications conducted
WhatsApp.
18, 2016. Additionally, text messages recovered from Stone's iCloud account
II According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default
message application.
13 According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.
Page 28 of42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 40 of 53
revealed that on or about November 15, 2016, Stone sent an attorney with the
Approximately fifteen minutes sending the link, Stone texted the attorney,
"I'm on signal just dial my number." attorney responded, "I'll call you."
2016.
5, 17.
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
data extraction device (such as Cellebrite). of the physical device can reveal messages,
including text and messages exchanged over WhatsApp, Signal, ProtonMail, and
Wickr, that have not backed to cloud accounts (such as an iCloud account).
Additionally, review of the device and the downloaded application can reveal other evidence
15
attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September 2016 to Stone's request to emails connected to the
against then-candidate Clinton to of
Page 29 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 41 of 53
I. Other Relevant
through approximately .lJ"-"v'-'H 2016 resided in Stone's previous York apartment for
a of time. provided information technology support for Stone but was not formally
trained to so. was aware that Stone communicated Trump the 2016
worked for to which carried a "file booklet" with him. told the file
booklet was important and that no one should it. said maintained file
booklet in closet.
around January and February 2016, Stone and Trump were constant communication that
300f42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 42 of 53
62. Your affiant is aware through the investigation that Stone maintains the Subject
Premises as his primary residence. 16 During physical surveillance of the Subject Premises on or
about January 14, 2019, the FBI observed Stone at the residence.
show that the subscriber of high-speed internet service and digital voice services at the
Subject Premises was Nydia Stone. According to public reporting and law enforcement
recipient "update your files with my new address"; Stone identified the Subject Premises as his
new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the
65. Based on law enforcement interviews, your affiant is aware that Stone has used
and uses cellular telephones, desktop, and laptop computers to conduct electronic
communications. Stone also configures his computers to create regulars backups of his
computers and maintains one of these devices at the Subject Premises, which preserves
Page 31 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 43 of 53
66. In or around May 2018, the FBI interviewed an individual ("Person 2") who
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
receipts and invoices issued to Nydia Bertran-Stone for infonnation technology ("IT") services
dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was
billed for IT services in connection with three different Apple computers. Specifically, the
billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQ 17)
configured with the name "Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number
D25TC077GQ 17) configured with the name "Stone-Roger-iMac-NYC"; and (3) an Apple
MBPR." According to publicly available infonnation, the iMac is one of Apple's desktop
models (i.e., a computer designed to be stationary). The naming convention of the computer
at the Subject Premises. I7 According to the billing records, the computer was serviced on or
67. Person 2 also told law enforcement that Stone used the Apple Time Machine
("Time Machine") application to facilitate backups of his computers and that he believed Stone
information, Time Machine is the built-in backup feature of Apple computers and can create
copies of files on a computer, including applications, music, photos, email, documents, and
system files. A Time Machine backup allows users to restore files from a specific point in time
17 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
Page 32 of42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 44 of 53
if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create
backups with Time Machine, a user connects an external storage device to the computer and
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
310410930460769). On or about September 28, 2018, Stone's cellular telephone number was
show that the account associated with Stone's telephone number and email address has the Uber
application on multiple devices, including a device identified as iPhonell ,2, UDID - 668EDC66
"iPhone 11,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
DE0840 1EOA 74. Publicly available information indicates that the identifier iPhone9,4
70. Records obtained from a court-authorized pen register/trap & trace ("PRTT")
18 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 33 of42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 45 of 53
indicating Stone continues to use the number and its associated device. For example, these
records show that between January 1, 2019 and January 10, 2019, telephone number was
used to make or receive over 150 telephone calls and send or receive over 750 text messages.
telephone number 20 showed the WhatsApp account was used to send or receive
approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about
71. Statements attributed to Stone in recent media articles also indicate that Stone
retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media reports began to publish excerpts of text
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
According to these news articles, Stone released these messages to the media outlets, which
Stone claimed were extracted by his lawyers from "a cell phone he stopped using in 2016."
Based on these statements, your affiant believes the cellular telephone referenced in the article to
be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he
19 Installation and use of PRTT devices for was authorized by the U.S. District Court for
the District of Columbia on or about November 28, 2018. Case No.1: 18-pr-l72 (D.D.C. Nov.
28,2018).
20 Installation and use of PRTT devices for Stone's WhatsApp account was authorized by the
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No.1: 18
pr-250 (D.D.C. Dec. 11,2018).
21 See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at
https:lldailycaller.coml20 18/11 I 14/roger-stone-wikileaks-randy-credico-mueller.
Page 34 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 46 of 53
stopped using on or about November 14, 2016)?2 Further, your affiant believes Stone maintains
search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule
41 (e )(2)(B).
73. Probable cause. I submit that if a computer or storage medium is found on the
Subject Premises, there is probable cause to believe those records will be stored on that computer
remnants of such files can be recovered months or even years after they have been
Electronic files downloaded to a storage medium can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.
Page 35 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 47 of 53
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
system data structures, and virtual memory "swap" or paging files. Computer
users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d. Similarly, files that have been viewed via the Internet are sometimes
permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Page 36 of 42
.
,
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 48 of 53
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
storage mediwn that can reveal information such as online nicknames and
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
Page 37 of 42
I
\
•
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 49 of 53
The existence or absence of anti-virus, spyware, and mal ware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data
typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under
Page 38 of 42
.
r' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 50 of 53
investigation. For example, infonnation within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
advance the records to be sought, computer evidence is not always data that can
the computer and the application of knowledge about how a computer behaves.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
Page 39 of42
• r
• ,
I' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 51 of 53
75. Necessity ofseizing or copying entire computers or storage media. In most cases,
a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media. Generally speaking, imaging is the taking of a complete
electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
examine storage media to obtain evidence. Storage media can store a large
warrant can take weeks or months, depending on the volume of data stored, and
that might not be present on the search site. The vast array of computer hardware
Page 40 of 42
Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 52 of 53
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
environment will allow its examination with the proper tools and knowledge.
c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing
76. Nature of examination. Based on the foregoing, and consistent with Rule
41 (e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
77. Because multiple people share the Subject Premises as a residence, it is possible
that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as
well.
Page 41 of 42
.. .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 53 of 53
requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
78. It is further respectfully requested that this Court issue an Order sealing, until
further order of this Court, all papers submitted in support of this application, including the
application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary
because items and information to be seized are relevant to an ongoing investigation, and
premature disclosure of the contents of this affidavit and related documents may have a negative
CONCLUSION
79. Based on the foregoing, your affiant respectfully requests that this Court issue a
search warrant for the Subject Premises, more particularly described in Attachment A,
Respectfl By submitted,
v/I~ ') . ~~
Curtis A. Heide
pecial Agent
Federal Bureau of Investigation
1~~A-J_~~~_ J. ~
~
UNITED STATES MAGISTRATE JUDGE
Page 42 of 42
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 1 of 57
)
Oakland Park, Florida
(further described in Attachment "A") )
)
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Southern District of Florida
(identifY the person or describe the property to be searched and give its location):
Oakland Park, Florida (further described in Attachment "A")
The person or property to be searched, described above, is believed to conceal (identifY the person or describe the
property to be seized):
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property.
~ in the daytime 6:00 a.m. to 10 p.m. o at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)
o I find that immediate notification may have an adverse result listed in 18 U.S.c. § 2705 (except for delay
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for days (not to exceed 30).
o until, the facts justifying, the later specific date of
Date and time issued: I : :;).6
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Jud~
Printed name and title
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 2 of 57
ATTACHMENT A
The Subject Premises is a commercial space with a glass front door and glass windows covered
with a black fabric; a green awning bearing the letters "JVR" is above the door. A photograph of
Page 1 of1
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 3 of 57
- .,
ATTACHMENT B
I. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code l512(b)(I) (witness tampering), those violations involving Roger Stone, for
and ;
telephone number ;
h. Records and information relating to the Signal account associated with telephone
number ;
Page 1 of3
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 4 of 57
1. Records and infonnation relating to the Wickr account associated with telephone
number ;
above;
this warrant, and any computer or storage medium that contains or in which is stored records or
a. evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
browsing history, user profiles, email, email contacts, "chat," instant messaging
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
software;
Page 2 of3
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 5 of 57
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
e. evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
1. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 3 of3
, . . Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 6 of 57
Return
Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with:
19-6034-SNOW
Inventory made in the presence of:
Certification
I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designatedjudge.
Date:
Executing officer's signature
in Attachment "A") )
located in the Southern District of Florida , there is now concealed (identify the
------------------------
person or describe the property /0 be seized):
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):
~ evidence of a crime;
~ property designed for use, intended for use, or used in committing a crime;
o a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. 1505 Obstruction of Proceeding
Date rt it1'-I
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge
Printed name and /itle
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 8 of 57
ATTACHMENT A
Page 1 of1
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 9 of 57
ATTACHMENT B
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
and
telephone number ;
h. Records and information relating to the Signal account associated with telephone
number ;
Page 1 of3
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 10 of 57
I. Records and information relating to the Wickr account associated with telephone
number ;
above;
this warrant, and any computer or storage medium that contains or in which is stored records or
a. evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
browsing history, user profiles, email, email contacts, "chat," instant messaging
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
software;
Page 2 of3
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 11 of 57
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
e. evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
I. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
web pages, search terms that the user entered into any Internet search engine, and
attachment.
Page 3 of3
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 12 of 57
AFFIDAVIT IN SUPPORT OF
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
1. I make this affidavit in support of an application for a search warrant for the
2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have
been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cy bersecuri ty.
3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger
Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(l) (collectively the "Specified Federal
Offenses").
and information provided to me by other law enforcement officers and technical experts.
5. This affidavit is intended to show merely that there is sufficient probable cause
for the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
Page 1 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 13 of 57
and part. Where I assert that an event took place on a particular date, I am asserting that it took
as is more particularly described in Attachment A), in connection with the Specified Federal
Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband,
7. For the reasons set forth in this Affidavit, there is probable cause to believe that
one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S . politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
Page 2 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 14 of 57
with Stone throughout the campaign, including about the stolen documents
by WikiLeaks.
known Stone for more than a decade. In testimony before the U.S. Representatives
.~_ ....,...,_, had '" [e]mails to Hillary Clinton which are pending publication.'"
along with Paul From in or around June 2016 until November 16, Gates
as the deputy campaign chainnan of the Trump Campaign. On February 2018, Gates
Page 3 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 15 of 57
guilty to one count conspiracy against States and one count making false
that receiving his assistant (who had access to the account) clicked on a link
Podesta's email account, allowing the actor to emails and documents that account.
4 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 16 of 57
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by
the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
IS. On or about June 14, 2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdS trike
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
19. On or about July 13, 201S, a federal grand jury sitting in the District of Columbia
returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, I: lS-cr-21S
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
Page 5 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 17 of 57
20. As alleged in the Netyksho indictment, after successfully hacking the DNC and
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks." (GRU officers separately used these personas to release some of the stolen
documents).
21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior
DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
thousands of emails and documents stolen from Podesta's email account. Between on or about
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
23. In April 2018 interviews with the Special Counsel's Office, Richard Gates stated
that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then
candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC
emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they
Page 6 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 18 of 57
24. According to Gates, Manafort directed Gates to contact Stone about any
additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's
Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
show that shortly after the July 22, 2016 release of stolen DNC emails
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
Stone's email to , who lived in the United Kingdom and who was a
Page 7 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 19 of 57
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that "should see Assange."
c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
26. According to recorded public statements recovered by the FBI, starting in early
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
Stone attended a public event in Broward County, Florida. During the event,
Stone stated, "I actually have communicated with Assange. I believe the next
tranche of his documents pertain to the Clinton Foundation, but there's no telling
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex
Page 8 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 20 of 57
Jones. During the interview, Stone stated that he was "in communication with
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-chatmel communications with WikiLeaks
and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
during a C-SP AN television interview on or about August 18, 2016, Stone stated
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with
Assange. Can you give us any kind of insight? Is there an October surprise
happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
good information."
produced a series of text messages between Stone and Credico during the 2016 presidential
Page 9 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 21 of 57
WikiLeaks planned to
the first time. On or about August 26, 2016, Credico sent a text
that stated, 'UU~.",",_ talk[ed] about you " Stone replied and asked what
cahoots."
c. On or about August 2016, Credico sent text messages to that said, "We
3 As below, Stone had previously released some these text "''''''''''F>'''''' to members of
the media, who had written about and published them in part.
10 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 22 of 57
added in a later text message, "Just remember do not name me as your connection
e. Later on or about September 18, 2016, Stone emailed Credico an article with
State. Stone stated, "Please ask Assange for any State or HRC e-mail from
f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
20, 2016, Credico forwarded the request to a close friend who was an attorney
with the ability to contact the Assange. Credico blind-copied Stone on the
forwarded email.
g. On or about September 30, 2016, Credico sent Stone via text message a
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
Page 11 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 23 of 57
1. On or about October 2, 2016, Stone emailed Credico, with the subject line
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement
J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it[']s on for
tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
28. Emails and text messages recovered by the FBI show that, in or around October
2016, Stone made statements about Assange's future releases that were similar to prior
which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange
Page 12 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 24 of 57
confirmed that and Stone and that told him WikiLeaks had
Podesta. According to text messages recovered Stone's iCloud account, shortly after
the an associate Bannon sent a text message to that read done." Similarly,
iCloud account was authorized on or about March 14, 2018 by the U.S.
District Columbia. Case 1: 18-sc-662 Mar. 1 18). The
r"'''ArC1<' for Stone's iCloud account contained some, but not all, of Stone's communications
the period.
Page 13 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 25 of 57
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating
allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (particularly those from August 2016)
31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account
32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and
stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any
6 On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.
Page 14 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 26 of 57
facts within the investigation's publicly-arulOunced parameters." (A copy of the letter was
33. On or about September 26, 2017, Stone provided HPSCI with an "opening
statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony in a closed
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was
transcribed, and a copy of the transcript was obtained by the Special Counsel ' s Office from
HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for
the record that he would tell the truth. At the beginning of the hearing, Stone was admonished
that "it is unlawful to deliberately provide false information to Members of Congress or staff'
and that "providing false information to this committee or concealing material information from
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017
document request and whether Stone had any documents or written communications that
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 27 of 57
[ ... ]
36. In fact, and as described above, Stone had sent and received numerous emails and
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and
Page 16 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 28 of 57
that, at the time of his testimony, Stone was still in possession of many of these emails and text
messages at the time he testified on or about September 22, 2017. 8 These written
communications included (a) Stone's email to Corsi on or about July 25, 2016 that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails . ..
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
"should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part, "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or
about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
37. During his HPSCI testimony on or about September 26,2017, Stone was asked to
explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
Page 17 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 29 of 57
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38. Stone testified that these public references to having a means of contacting
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "go-
between, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13,2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had '" [e]mails related to Hillary Clinton which are pending pUblication. "').
39. In fact, documents recovered during the investigation (including those obtained
via search warrant returns ) show that Stone did not begin
communicating with Credico about Assange or WikiLeaks until on or about August 19,2016 9
approximately eleven days after Stone first claimed on or about August 8, 2016 to "actually have
communicated with Assange" and a week after his August 12, 2016 statements of being "in
40. When interviewed by the FBI, Credico stated that the first time he ever spoke
with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico
also provided the FBI with partially redacted emails that he claimed were between he and
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the
9 As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016,
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico
texted Stone that "Assange has kryptonite on Hillary."
10Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews.
Page 18 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 30 of 57
technical logistics for the interview later that day. During the exchange, Credico offered
41. The FBI has not identified any communications between Stone and Credico from
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to
contact WikiLeaks.
42. In contrast, and as described above, the FBI has identified written
communications prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [aJt
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
email to Stone in which Corsi wrote that "[w Jord is friend in embassy plans 2 more dumps,"
including one in October. These communications occurred days before Stone's first public
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a
Stone also never disclosed his written communications with Corsi to HPSCI when answering
HPSCI's questioning about the August 8, 2016 and August 12, 2016 statements about being in
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary J to
communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
Page 19 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 31 of 57
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass
on a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
September 18, 2016, Stone sent a text message to Credico that said, "I am e
to her service as Secretary of State. Stone added, "Please ask Assange for any
2011 that mention [the subject of the article] or confirm this narrative." (A copy
).
September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Assange." Credico responded, "I did." An email obtained from the account
forwarded the request to an attorney who had the ability to contact Assange;
45. During his HPSCI testimony, Stone was asked repeatedly about his
communications with the person he identified as his intermediary. Stone stated that he had never
Page 20 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 32 of 57
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
A: No.
A: No.
Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
A: No.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his
intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.
Page 21 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 33 of 57
47. Written communications between Stone and Credico continued up until Stone's
HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary-Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone
denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your
conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
Page 22 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 34 of 57
a. As described above, Gates confirmed to investigators that Stone spoke with senior
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
51. In or around November 2017, Credico received a request from HPSCI to testify
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
Page 23 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 35 of 57
a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' .. . Richard Nixon." (A copy of these text messages was recovered through
2017, Credico informed HPSCI that he declined HPSCl's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "1 was told that the house
responded, "That was the point at which your lawyers should have told them you
iCloud account).
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."
Page 24 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 36 of 57
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1, 2017, Stone told
from investigators.
f. On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You
need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
account).
52. On or about December 12, 2017, Credico informed HPSCI that he intended to
sUbpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
53. Following Credico's invocation of his Fifth Amendment privilege not to testify
before HPSCI, Stone and Credico continued to have discussions about the various investigations
Page 25 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 37 of 57
into Russian interference in the 2016 election and what infonnation Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi ...
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
b. On or about April 9,2018, Stone wrote in an email to Credico, "You are a rat.
You are a stoolie. You backstab your friends-run your mouth my lawyers are
dying Rip you to shreds." Stone also said he would "take that dog away from
you," referring to Credico's dog. On or about the same day, Stone wrote to
Credico, "I am so ready. Let's get it on. Prepare to die [expletive]." (A copy of
email account ).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee ... you've opened yourself up to
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact the head of Assange]."
Page 26 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 38 of 57
that Credico was sensitive to having this friend's name publicly disclosed.
54. As described above, the government has recovered the content of many of Stone's
electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election). However, the government is aware of the
existence of numerous other relevant electronic communications, the content of which it has not
55. As described above, during his HPSCI testimony, Stone falsely denied having
emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
Credico). In fact, emails and text messages recovered in this investigation show the two
email and iCloud accounts confirm that Stone still had those communications at the time he
discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
56. In addition to these emails and text messages in the FBI's possession, the FBI has
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
Page 27 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 39 of 57
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
57. Additionally, the FBI has interviewed mUltiple associates of Stone, who
confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses multiple applications designed for
encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)
II According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device's default
message application.
13 According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
Page 28 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 40 of 57
14
ProtonMail. To date, the FBI has not obtained any of Stone's communications conducted
WhatsApp.
revealed that on or about November 15, 2016, Stone sent an attorney with the
Approximately fifteen minutes after sending the link, Stone texted the attorney,
"I'm on signal just dial my number." The attorney responded, "I'll call you."
2016.
14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.
IS This attorney was a close friend of Credico's and was the same friend Credico em ailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
Page 29 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 41 of 57
201
applications such as WhatsApp, ProtonMail, and Wickr are sometimes maintained on the
applications can be obtained by law enforcement by searching the device either manually or via a
Wickr, that have not been up to cloud accounts (such as an iCloud account).
during the period of the 2016 U.S. presidential and through the The
through approximately December 16 and resided Stone's New York apartment for
30
a period of time. provided infonnation technology support for Stone but was not fonnally
trained to do so. was aware that Stone communicated with Trump during the 2016
infonnation about a meeting at Trump Tower between Trump and Stone during the time
worked for him, to which Stone carried a "file booklet" with him. Stone told the file
booklet was important and that no one should touch it. also said Stone maintained the file
individual ("Person 2") who previously had a professional relationship with a reporter who
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or
around January and February 2016, Stone and Trump were in constant communication and that
Stone kept contemporaneous notes of the conversations. Stone's purpose in keeping notes was to
62. Your affiant is aware through the investigation that Stone maintains the Subject
Premises as his personal office and has done so since at least the 2016 Campaign. Public
reporting indicates that Stone occupied SUbject Premises as his office during the 2016
Campaign. 16 An April 17,2017 news article also described Stone's "personal office" at a
16 See Roger Stone.' Inside The World Of A Political Hitman, CBS Miami, April 17, 2016,
available at https:llmiami.cbslocal.comJ20 16/04117lroger-stone-inside-the-world-of-a-political
hitmanl ("CBS4's Jim DeFede has known Stone for years and visited him recently at his office in
a nondescript building in an industrial section of Oakland Park that houses his collection of
Nixon memorabilia.").
17 See Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,
Washington Post, April 19, 2017, available at https:llwww.washingtonpost.comJlifestyle/style/
Page 31 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 43 of 57
(The recovered contained no further content). On or about November 27, 2017, Stone
sent another individual address of the Subject Premises while arranging a meeting.
Premises as office.
Premises.
"Yes - let me figure out " The photographer then wrote that "[t]he
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth ("The
next part of the directions to his personal and broadcast studio calls for locating a "door
marked ' " which helpful, the crucial that there is no
discreetly "A" at the new next to a supplies There is,
a blacked-out door with no markings, and the man who emerges behind it, shorts,
loafers with no socks, a loosened tie and an untucked dress shirt, is unmistakably
").
Page 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 44 of 57
"Warehouse has very high cable if u want to use ' office. '" On or about
November 10,2017, Stone wrote an individual, "U don't need an speed [inter] net at
66. On or about May 18, 2018, investigators interviewed an individual ("Person 1")
Campaign and afterwards through May 18. Those communications included matters related to
2019, the FBI observed enter the Subject Premises. Stone was accompanied by two
33 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 45 of 57
69. Based on law enforcement interviews, your affiant is aware that Stone has used
and uses cellular telephones, desktop, and laptop computers to conduct electronic
70. As described above, in text messages recovered from Stone's iCloud account,
Stone indicated the Subject Premises has high-speed internet service (referred to as having "very
71. As described above, on or about April 8, 2017, Stone and a photographer hired by
the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order
Page 34 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 46 of 57
for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post
published a lengthy article about Stone that featured the following two photographs 18:
18"Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,"
Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.comllifestyle/style/
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worthl2017/
041l81l518184e-236f-lle7-b503-9d616bd5a305 _story.html?utm_term=. 7576648d5cel.
Page 35 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 47 of 57
Both photographs were credited to the photographer with the first name " ," and the
caption of the latter photograph read in part, "Stone in his memorabilia-overrun office." The
photographs depict, among other things, multiple computer accessories, including a monitor,
iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from
his office, further indicating he likely has a computer present there. 19 For example, on or about
December 13, 2017, Stone coordinated an upcoming interview with another individual by text
message. Stone confirmed the interview, writing that he would participate via "Skype from our
73. In or around May 2018, as discussed above, the FBI interviewed Person 1, who
worked for Stone. Person 1 told the FBI that Stone maintained a computer at the Subject
Premises.
74. In or around May 2018, the FBI interviewed an individual (Person 2) who
provided information technology services to Stone. Person 2 stated that Stone used the Apple
Time Machine ("Time Machine") application to facilitate backups of his computers. According
to publicly available information, Time Machine is the built-in backup feature of Apple
computers and can create copies of files on a computer, including applications, music, photos,
email,documents, and system files. A Time Machine backup allows users to restore files from a
specific point in time if the original files are ever deleted, or if the hard drive is erased or
Page 36 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 48 of 57
replaced. In order to create backups with Time Machine, a user connects an external storage
device to the computer and selects that external storage device as the backup disk,zo
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
310410930460769). On or about September 28, 2018, Stone's cellular telephone number was
show that the account associated with Stone's telephone number and email address has the Uber
"iPhonel1,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
DE08401 EDA 74. Publicly available information indicates that the identifier iPhone9,4
77. Records obtained from a court-authorized pen register/trap & trace ("PRTT")
20 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 37 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 49 of 57
indicating Stone continues to use the number and its associated device. For
records show that between January 1, 19 January 10, 2019, telephone number was
to make or receive over 150 calls and send or receive over text
retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 18, media reports began to publish excerpts text
messages between Stone and Randy that occurred during the 2016 U.S.
23
text messages subsequently were from Stone
21 Installation and use of PRTT was authorized by the U.S. District Court
District of Columbia on or about 18. Case No.1: 18-pr-l
2018).
38
stopped using on or about November 14, 2016).24 Further, your affiant believes Stone maintains
search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule
41 (e)(2)(B).
80. Probable cause. I submit that if a computer or storage medium is found on the
Subject Premises, there is probable cause to believe those records will be stored on that computer
remnants of such files can be recovered months or even years after they have been
Electronic files downloaded to a storage mediwn can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.
Page 39 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 51 of 57
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
system data structures, and virtual memory "swap" or paging files. Computer
users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d. Similarly, files that have been viewed via the Internet are sometimes
permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Page 40 of46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 52 of 57
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
storage medium that can reveal information such as online nicknames and
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
Page 41 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 53 of 57
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data
typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under
Page 42 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 54 of 57
investigation. For example, information within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
advance the records to be sought, computer evidence is not always data that can
the computer and the application of knowledge about how a computer behaves.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
Page 43 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 55 of 57
82. Necessity ofseizing or copying entire computers or storage media. In most cases,
a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media. Generally speaking, imaging is the taking of a complete
electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
examine storage media to obtain evidence. Storage media can store a large
warrant can take weeks or months, depending on the volume of data stored, and
that might not be present on the search site. The vast array of computer hardware
Page 44 of 46
9 I' Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 56 of 57
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
environment will allow its examination with the proper tools and knowledge.
c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing
83. Nature of examination. Based on the foregoing, and consistent with Rule
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
84. Because multiple people share the Subject Premises as a residence, it is possible
that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as
well.
Page 45 of 46
Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 57 of 57
privileges. The procedures include use of a designated "filter team," separate and apart from the
CONCLUSION
86. Based on the foregoing, your affiant respectfully requests that this Court issue a
search warrant for the Subject Premises, more particularly described in Attachment A,
Respectfully submitted,
. A. Heide
Special Agent
Federal Bureau of Investigation
)f~J, ~
L.4tfRANA S. SNOW
UNITED STATES MAGISTRATE JUDGE
Page 46 of46