Roger Stone Search Warrants - Compressed

Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 1 of 21
AO 93 (Rev. 11/13) Search and Seizure Warrant
UNITED STATES DISTRICT COURT

for the
District of Columbia
In the Matter of the Search of )

(Briefly describe the property to be searched )
or identify the person by name and address) ) Case No. 17-MJ-567
INFORMATION ASSOCIATED WITH THE TWITTER )
ACCOUNTS )
)
SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement officer
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
(identify the person or describe the property to be searched and give its location):
See Attachment A
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 21, 2017 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued:
City and state: Washington, D.C. Hon. Beryl A. HoweJL,,-Chief U.S. District Judge
· Printed name and title
ATTACHMENT A
Property to Be Searched
This warrant applies to information associated with the Twitter profile with usemarnes:
that is stored at premises owned, maintained, controlled, or operated by Twitter, a company
headquartered in San Francisco, California.

ATTACHMENT B
Particular Things to be Seized
I. Information to be disclosed by Twitter
To the extent that the information described in Attachment A is within the possession,
custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the
government for each account listed in Attachment A:
a. All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers;
b. All past and current usernames, account passwords, and names associated with
the account;
c. The dates and times at which the account and profile were created, and the
Internet Protocol ("IP") address at the time of sign-up;
d. All IP logs and other documents showing the IP address, date, and time of each
login to the account;
e. All data and information associated with the profile page, including photographs,
"bios," and profile backgrounds and themes;
f. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;
g. All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account
(i.e., "mentions" or "replies");
h. All photographs and images in the user gallery for the account;
1. All location data associated with the account, including all information collected
by the "Tweet With Location" service;
J. All information about the account's use of Twitter's link service, including all
longer website links that were shortened by the service, all resulting shortened
links, and all information about the number of times that a link posted by the
account was clicked;
k. All data and information that has been deleted by the user;
I. A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user's "following" list and "followers" list);
m. A list of all users that the account has "unfollowed" or blocked;
n. All "lists" created by the account;
o. All information on the "Who to Follow" list for the account;
p. All privacy and account settings;
q. All records of Twitter searches performed by the account, including all past
searches saved by the account;
r. All information about connections between the account and third-party websites
and applications;
2
s. All records pertaining to communications between Twitter and any person
regarding the user or the user's Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.
3
II. Information to be seized by the government
All information described above in Section I that constitutes fruits, evidence, and
instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection
with computers) involving since March 1, 2016 including, for each user ID identified on
Attachment A, information pertaining to the following matters:
a. Any correspondence regarding hacked emails or other data from the
Democratic National Committee (DNC) and the email belonging to John
Podesta ("the email hack");
b. Any communications between the Target Accounts and individuals
associated with the email hack;
c. Any communications indicating any advance knowledge or direction,
planning, or control of the email hack;
d. Evidence indicating how and when the Twitter account was accessed or used,
to determine the chronological and geographic context of account access, use,
and events relating to the crime under investigation and to the Twitter account
owner;
e. Evidence indicating the Twitt~r account owner's state of mind as it relates to
the crime under investigation;
f. The identity of the person(s) who created or used the user ID, including
records that help reveal the whereabouts of such person(s).
g. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.
4
AO 106 (Rev. 04/10) Application fora Search Warrant

for the FILED
AUG -7 2017
In the Matter of the Search of ) Clerk, U.S. District and
(Briefly describe the property to be searched ) Bankruptcy Courts
or identify the person by name and address) Case No. 17-MJ-567
)
INFORMATION ASSOCIATED WITH THE TWIITER )
ACCOUNTS )
)
APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A.
located in the - - -
Northern
- - - - - District of - - - - -
California
- - - - - - - , there is now concealed (identify the
person or describe the property to be seized):
See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
(y{ property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers
The application is based on these facts:
See attached Affidavit.
'J Continued on the attached sheet.

0 Delayed notice of_.__ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Reviewed by AUSA/SAUSA: ~ p p U r o n t ' , ,ignatu,e
IAaron Zelinsky (ASC) ] Mickey Robinson, Special Agent, FBI

Printed name and title
Sworn to before me and signed in my presence.
Date: 08/07/2017
Judge's signature
City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
IN THE UNITED STATES DISTRICT COURT

FILED
FOR THE DISTRICT OF COLUMBIA AUG -7 2017
IN THE MATTER OF THE SEARCH OF Clerk, U.S. District and
B8nkruptcy Courts
INFORMATION ASSOCIATED WITH THE Case No. 17-MJ-569
Filed Under Seal
AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEARCH WARRANT
I, Mickey Robinson, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I make this affidavit in support of an application for a search warrant for
information associated with the Twitter Accounts (hereafter "Target Account
1") and (hereafter "Target Account 2") and that is stored at premises owned,
maintained, controlled, or operated by Twitter, a social-networking company headquartered in
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(1 )(A).
2. I am a Special Agent with Federal Bureau oflnvestigation ("FBI") assigned to
FBI Headquarters working directly with the Special Counsel's Office. I have been a Special
Agent with the FBI since 2012. Since then, I have conducted national security investigations of
foreign intelligence services, espionage, and counter proliferation matters. I have training and
experience related to foreign intelligence services national security investigations, as well as
federal financial crimes. I have conducted and participated in various investigations involving
multiple threat countries as well as national security threats and applicable criminal violations.
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that certain individuals with whom Target Account 1 was in
communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in
connection with computers), and that communications related to these violations will be found
on the Target Accounts. There is therefore probable cause to search the information described
in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as
described in Attachment B.
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
Specifically, the Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraphs 6, 20, and 28.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
Disseminate Hacked Information.
6. According to the public and unclassified intelligence report conducted by the
United States Intelligence Community, the Russian military intelligence (General Staff Main
2
Intelligence Directorate or "GRU") probably began cyber operations aimed at the U.S. election
by March 2016. The GRU operations resulted in the compromise of the personal e-mail
accounts of Democratic National Committee (DNC) and other Democratic Party officials and
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC.
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
7. The public and unclassified intelligence report assessed that the GRU used a
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets.
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory
statements and false claims about his likely Russian identity throughout the election. Press
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
B. Roger Stone's Interactions with Guccifer 2.0 and Wikileaks.
8. Roger Stone is a self-employed political strategist/consultant and has been
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of
Donald J. Trump (the "Campaign") until he was fired in August 2015. Although Stone had no
official relationship with the Campaign thereafter, Stone maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign.
9. As discussed further below, Stone made a number of public references to
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
Twitter with Guccifer 2.0.
10. On June 14, 2016, news reports indicated that the computer systems of the DNC
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC
3
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
21, 2016 release of hacked documents.
11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from
the DNC.
12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled,
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of
Guccifer 2.0." Stone embedded publicly available Tweets from Guccifer 2.0 in the article and
wrote: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
he did the hack of the DNC." Stone also stated: "Guccifer 2.0 made a fateful and wise decision.
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
themselves how the Democrats had rigged the game."
13. On August 8, 2016, Stone addressed the Southwest Broward Republican
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
Assange to Russia Today (RT) several days earlier about an upcoming "October Surprise" aimed
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard to the
October surprise, what would be your forecast on that given what Julian Assange has intimated
he's going to do?" Stone responded: "Well, it could be a number of things. I actually have
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton
Foundation but there's no telling what the October surprise may be." A few days later, Stone
clarified that while he was not personally in touch with Assange, he had a close friend who
served as an intermediary.
4
14. On August 12, 2016, Guccifer 2.0 publicly tweeted: [Target
Account 1] thanks that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released
the personal cellphone numbers and email addresses from the files of the Democratic
Congressional Campaign Committee (DCCC).
15. On August 13, 2016, Stone posted a tweet using Target Account 1 calling
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day,
Guccifer 2.0's Twitter account was reinstated.
16. On August 14, 2016, Stone sent a private message on Twitter using Target
Account 1 to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle reinstated
after having been suspended. 1
17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating:
"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
interesting in the docs I posted."
18. On August 16, 2016, Stone sent a private message using Target Account 1
asking Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016
presidential elections.
19. On August 17, 2016, Guccifer 2.0 publicly tweeted, [Target
Account 1] paying you back." Guccifer also sent a private message to Target Account 1 stating
"i 'm pleased to say u r great man. please tell me if I can help u anyhow. it would be a great
pleasure to me."
1
These messages were release by Stone on March I 0, 2017, as described further below in paragraph 28.
5
20. On August 18, 2016, Paul Manafort, Stone's longtime friend and associate,
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
that investigators were also examining the Podesta Group.
21. On August 21, 2016, using Target Account 1, Stone directed a tweet at John
Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon the
[sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
the public [could] expect to see much more from the exiled whistleblower in the form of
strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio
that he expected Wikileaks to "drop a payload of new documents on a weekly basis fairly soon.
And that of course will answer the question of exactly what was erased on that email server."
23. On Saturday, October 1, 2016, using Target Account 1, Stone Tweeted,
"Wednesday@HillaryClinton is done. #Wikileaks."
24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the
6
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement -
which was part of Wikileaks' 1O,..year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
· used Target Account 1 to tweet: "Payload coming. #Lockthemup."
25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in
which Mr. Trump had made a series oflewd remarks.
26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link
to approximately 2,050 emails that had been hacked from John Podesta's personal email account.
27. Wikileaks continued to release John Podesta's hacked emails throughout October
10-14, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 C-
SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails]
and the Trump campaign had advanced warning about what Assange was going to do. I think
there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: "I have never met or spoken with
Assange, we have a mutual friend who's traveled to London several times, and everything I
know is through that channel of communications. I'm not implying I have any influence with
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were
deleted. I hear that through my emissary."
7
28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged
he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter's
private message system to do so. Stone provided a copy of the private messages to The
Washington Times.
29. On or about May 12, 2017, United States Magistrate Judge Michael S.
Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b)
requiring Twitter to disclose certain records, including subscriber and user activity information,
associated with the Target Accounts described above (Case number 17-GJ-0835). On or about
May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts
are registered to Stone.
30. As described above, it appears that Stone has used the private messaging function
of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience
that individuals with multiple accounts on the same service, such as Stone has on Twitter, often
use both accounts for their communications. A review of Target Account 2's publicly available
information indicates that it has been in use since November 2015. Stone also appears to
comment using Target Account 2 frequently. Stone also often publicly "Retweets" messages
using Target Account 2 which originated from Target Account 1. Therefore there is probable
cause to believe that messages pertaining to the investigation, including messages to individuals
regarding the hack, as well as communications with Guccifer 2.0, will be found on Target
Account 1 and Target Account 2.
INFORMATION CONCERNING TWITTER
8
31. Twitter owns and operates a free-access social-networking website of the same
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own
profile pages, which can include a short biography, a photo of themselves, and location
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
described in more detail below.
32. Upon creating a Twitter account, a Twitter user must create a unique Twitter
username and an account password, and the user may also select a different name of 20
characters or fewer to identify his or her Twitter account. The Twitter user may also change this
username, password, and name without having to open a new Twitter account.
33. Twitter asks users to provide basic identity and contact information, either during
the registration process or thereafter. This information may include the user's full name, e-mail
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers. For each user, Twitter may retain information about
the date and time at which the user's profile was created, the date and time at which the account
was created, and the Internet Protocol ("IP") address at the time of sign-up. Because every
device that connects to the Internet must use an IP address, IP address information can help to
identify which computers or other devices were used to access a given Twitter account.
34. A Twitter user can post a personal photograph or image (also known as an
"avatar") to his or her profile, and can also change the profile background or theme for his or her
account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.
9
35. Twitter also keeps IP logs for each user. These logs contain information about the
· user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed his or her profile.
36. As discussed above, Twitter users can use their Twitter accounts to post "Tweets"
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was
posted to Twitter. TwiUer users can also "favorite," "retweet," or reply to the Tweets of other
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign,
Twitter designates that Tweet a "mention" of the identified user. In the "Connect" tab for each
account, Twitter provides the user with a list of other users who have "favorited" or "retweeted"
the user's own Tweets, as well as a list of all Tweets that include the user's username (i.e., a list
of all "mentions" and "replies" for that username ).
37. Twitter users can include photographs or images in their Tweets. Each Twitter
account also is provided a user gallery that includes images that the user has shared on Twitter,
including images uploaded by other services.
38. Twitter users can also opt to include location data in their Tweets, which will
reveal the users' locations at the time they post each Tweet. This "Tweet With Location"
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users
may delete their past location data.
39. When Twitter users want to post a Tweet that includes a link to a website, they
can use Twitter's link service, which converts the longer website link into a shortened link that
begins with http://t.co. This link service measures how many times a link has been clicked.
40. A Twitter user can "follow" other Twitter users, which means subscribing to
those users' Tweets and site updates. Each user profile page includes a list of the people who are
10
following that user (i.e., the user's "followers" list) and a list of people whom that user follows
(i.e., the user's "following" list). Twitters users can "unfollow" users whom they previously
followed, and they can also adjust the privacy settings for their profile so that their Tweets are
visible only to the people whom they approve, rather than to the public (which is the default
setting). A Twitter user can also group other Twitter users into "lists" that display on the right
side of the user's home page on Twitter. Twitter also provides users with a list of "Who to
Follow," which includes a few recommendations of Twitter accounts that the user may find
interesting, based on the types of accounts that the user is already following and who those
people follow.
41. In addition to posting Tweets, a Twitter user can also send DMs to one of his or
her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the inboxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
are stored on Twitter' s database.
42. Twitter users can configure the settings for their Twitter accounts in numerous
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the
user's mobile phone, and the user can also set up a "sleep time" during which Twitter updates
will not be sent to the user's phone.
43. Twitter includes a search function that enables its users to search all public
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to
25 past searches.
11
44. Twitter users can connect their Twitter accounts to third-party websites and
applications, which may grant these websites and applications access to the users' public Twitter
profiles.
45. If a Twitter user does not want to interact with another user on Twitter, the first
user can "block" the second user from following his or her account.
46. In some cases, Twitter users may communicate directly with Twitter about issues
relating to their account, such as technical problems or complaints. Social-networking providers
like Twitter typically retain records about such communications, including records of contacts
between the user and the provider's support services, a:s well as records of any actions taken by
the provider or user as a result of the communications. Twitter may also suspend a particular user
for breaching Twitter' s terms of service, during which time the Twitter user will be prevented
from using Twitter' s services.
47. As explained herein, information stored in connection with a Twitter account may
provide crucial evidence of the "who, what, why, when; where, and how" of the criminal conduct
under investigation, thus enabling the United States to establish and prove each element or
alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Twitter user's account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This "user
attribution" evidence is analogous to the search for "indicia of occupancy" while executing a
search warrant at a residence. For example, profile contact information, communications,
"tweets" (status updates) and "tweeted"photos (and the data associated with the foregoing, such
as date and time) may be evidence of who used or controlled the Twitter account at a relevant
time. Further, Twitter account activity can show how and when the account was accessed or
12
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from
which users access their accounts along with the time and date. By determining the physical
location associated with the logged IP addresses, investigators can understand the chronological
and geographic context of the account access and use relating to the crime under investigation.
Such information allows investigators to understand the geographic and chronological context of
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter
builds geo-location into some of its services. If enabled by the user, physical location is
automatically added to "tweeted" communications. This geographic and timeline information
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account
activity may provide relevant insight into the Twitter account owner's state of mind as it relates
to the offense under investigation. For example, information on the Twitter account may
indicate the owner's motive and intent to commit a crime (e.g., information indicating a criminal
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal
evidence from law enforcement).
48. Therefore, the computers of Twitter are likely to contain all the material described
above, including stored electronic communications and information concerning subscribers and
their use of Twitter, such as account access information, transaction information, and other
account information.
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED
49. I anticipate executing this warrant under the Electronic Communications Privacy
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A), by using the warrant
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
13
particularly described in Section I of Attachment B. Upon receipt of the information described in
Section I of Attachment B, government-authorized persons will review that information to locate
the items described in Section II of Attachment B.
CONCLUSION
50. Based on the forgoing, I request that the Court issue the proposed search warrant.
51. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not
required for the service or execution of this warrant.
REQUEST FOR SEALING
52. I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation, the full nature and extent of which is not
known to all of the targets of the investigation. Accordingly, there is good cause to seal these
documents because their premature disclosure may seriously jeopardize that investigation.
Respectfully submitted,
Special Agent
Federal Bureau of Investigation
-z-~
Subscribed and sworn to before me on this _1_ day of August, 2017.
Th~i11:t~
Chief United States District Judge
14
AO 93 (Rev. 11/ 13) Search and Seizure Warrant

for the
District ofC'" 111 mhi"
In the Matter of the Search of ) Case: 1: 17-mj-00661

(Briefly describe the property to be searched ) Assigned To : Howell, Beryl A
or identify the person by name and address) ) Assian. Date : 9/11 /201 7
INFORMATION ASSOCIATED WITH THE EMAIL )
Description: Search & Seizure Warrant
ACCOUNT )
)

(identify the person or describe the property to be searched and give its location) :
See Attachment A.
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before September 25, 2017 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
0 at any time in the day or night because good cause has been established.
property was taken.
Date and time issued: ~~ /~ 4?/ l@//:~;f-lJ

....1--_--c-P--
~_,'--'-- -'~d
~ '--=---
~/uc1ge,; signature
~'---
~- - - -- -
City and state: Washington, DC Hon . Beryl A. Howell , Chief U.S. District Judge
- -- -- - -- -- -- - -
AO 106 (Rev. 04/ 10) Application for a Search Warrant
UNITED STATES DISTRICT COURT SEP ~ 1 2017

for the
District of Columbia Cterk. U.S. Dis,,:;·! & 1]ank1•Jlltc,
. Courts for t~e o:r.t•i,;t of Go!u.1i1;1la
In the Matter of the Search of ) Case: 1: 17-mj-00661

or identify the person by name and address) ) Assigned To : Howell. Beryl A.
INFORMATION ASSOCIATED WITH THE EMAIL ) Assian . Date . 9/1 11201 7
ACCOUNT ) Description: Search & Seizure Warrant
)

See Attachment A
District of
located in the
- - -Northern
-----
- - - - -California
- - - - - - - , there is now concealed (identify the
See Attachment B
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a) , 2703(b)(1)(A), and 2703(c)(1)(A).
The basis for the search under Fed. R. Crim. P. 4 l (c) is (check one or more):
~ property designed fo r use, intended for use, or used in committing a crime;

18 U.S .C. § 1030; Fraud and related activities in connection with computers
18 U.S.C. § 371 Conspiracy to commit an offense against the United States

~ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ __ _ ) is requested
under 18U.S.C.§3 103a, the basis of which is set fo on the attached sheet.
Reviewed by AUSA/SAUSA:
IAaron Zelinsky {AS9 Amy Anderson , Special Agent. FBI
Date: 09/11/2017 (il11,' J,o,11>1

Judge's signature
City and state: Washington, D.C. Hon . Beryl A. Howell, Chief U.S. District Judge

FOR THE DISTRICT OF COLUMBIA
SEP 11 2017
C!er~·. 'v.,
I: "\ r s" ;n,
1.-l ,r,.,, & ..,ankru;:itny
:-"I
"' r 1·1" ' n·

Ct ur··- 'o ~ "
• ,nt,-', ·1 or· Co 1u ' Imo a
IN THE MATTER OF THE SEARCH OF . v - " ', '
Case No.
INFORMATION AS SOCIATED WITH THE
EMAIL ACCOUNT
Filed Under Seal
I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
information associated with the Email Account (hereafter the "Target
Account"), that is stored at premises owned, maintained, controlled, or operated by Microsoft
Corp. , d/b/a Hotmail, an email provider headquartered at One Microsoft Way, Redmond, WA
98052 (hereinafter "Microsoft"). The information to be disclosed by Microsoft and searched by
the Government is described in the following paragraphs and in Attachments A and B. This
affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a),
2703(b)( l)(A), and 2703(c)(l)(A).
2. I am a Special Agent with Federal Bureau of Investigation ("FBI") assigned to
experience related to espionage and foreign intelligence services national security investigations.
I have conducted and participated in various investigations involving multiple threat countries as
well as national security threats and applicable criminal violations.

there is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers) and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States). As set forth below,
Roger Stone used Twitter' s private direct messaging function to message Wikileaks, Julian
Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to disseminate hacked
information. Stone also repeatedly used Twitter' s private direct messaging function to instruct
individuals to email him on the Target Account to continue conversations begun on Twitter' s
private direct messaging system. These conversations included discussion of information related
to the Campaign and potential derogatory information concerning a presidential candidate in the
Republican primary. There is therefore probable cause to search the information described in
Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described
in Attachment B.
JURISDICTION
2
§ 27 11(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraphs 6, 20, and 28.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and Wikileaks to
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003.
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLe~ to release
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and Wikileaks.
Donald J. Trump (the "Campaign") until he was fired in August 20 15. Although Stone had no
3
official relationship with the Campaign thereafter, Stone maintained his suppo1i for Trump and
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via
11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from
theDNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: " It doesn't
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian
4
he ' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
14. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
numbers and email addresses from the files of the Democratic Congressional Campaign
Committee (DCCC).
15. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0' s
Twitter account was reinstated.
16. On August 14, 2016, Stone sent a private message on Twitter using
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter handle
reinstated after having been suspended. 1
17. On August 15, 20 16, Guccifer 2.0 replied to Stone on Target Account 1, stating:
"wow. thank u for writing back, and thank u for an article about me! !! did you find anything
1 These messages were released by Stone on March 10, 2017, as described further below in paragraph 28.
5
18. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.
19. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me if I can help u anyhow. it would be a great pleasure to me."
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S.
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and
that investigators were also examining the Podesta Group.
21. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John
[sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange] ,
6
23. On Saturday, October 1, 20 16, using @RogerJStoneJr, Stone Tweeted,
"Wednesday @ HillaryClinton is done. #Wikileaks."
which was part of Wikileaks' 10-year anniversary celebration - Stone told lnfowars that his
used @RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
which Mr. Trump had made a series of lewd remarks.
26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading
27. Wikileaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 20 16, John Podesta-referring back to Stone's August 21 , 2016 C-
there' s at least a reasonable belief that [Assange] may have passed this information on to
7
Assange, we have a mutual friend who' s traveled to London several times, and everything I
has all of the e-mails that Hurna ALeJiu auJ Cheryl Mill:s, the Clinton ai<le:s, thought wtm::
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he
Washington Times.
29. , On March 27, 2017, CNN reported that a representative of Wikileaks, writing
from an email address associated with Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came true."
C. Roger Stone's Private Twitter Direct Messages with Wikileaks and Julian Assange.
30. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
Twitter account @RogerJStoneJr. While the full review of that returned information is ongoing,
the initial review indicates that, contrary to Stone' s representation to CNN that he "never
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
8
Wikileaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
31. For example, on October 13, 2016, while Wikileaks was in the midst of releasing
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@Wikileaks. This account is the official Twitter account of Wikileaks and has been described as
such by numerous news reports. The message read: "Since I was all over national TV, cable and
print defending wikileaks and assange against the claim that you are Russian agents and
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
strategy of attacking me- cordially R."
32. Less than an hour later, @Wikileaks responded by direct message: "We
appreciate that. However, the false claims of association are being used by the democrats to
undermine the impact of our publications. Don't go there if you don't want us to correct you."
33. On October 16, 2016, @RogerJStoneJr sent a direct message to @Wikileaks:
"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
a sieve. You n,eed to figure out who your friends are."
34. On November 9, 2016, one day after the presidential election, @Wikileaks sent a
direct message to @RogerJStoneJr containing a single word: "Happy?" @Wikileaks
immediately followed up with another message less than a minute later: "We are now more free
to communicate."
35. In addition, @RogerJStoneJr has also recently exchanged direct messages with
Julian Assange, the founder of Wikileaks. For example, on June 4, 2017, @RogerJStoneJr
directly messaged @JulianAssange, an address associated with Julian Assange in numerous
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
9
information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumped-
up sexual assault charges dropped I don't know of any crimt:: you nt::t::c.l lo be pardoned for - best
regards. R." That same day, @J ulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
Trump trying to squeeze us into a deal."
36. On Saturday, June 10, 20 17, @RogerJStoneJr sent a direct message to
@Wikileaks, reading: "I am doing everything possible to address the-issues at the highest level
of Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this
forum as experience demonstrates it is monitored. Best regards R."
D. Roger Stone's Use of the Target Account to Continue Conversations Begun on

Twitter Direct Message.
37. Using the direct messaging function associated with the account @RogerJStoneJr,
Stone sent direct messages to individuals instructing them to email the Target Account to
continue conversations began via Twitter direct message. For example, on August 8, 2015, an
individual sent @RogerJStoneJr a direct message asking ifhe had "a few minutes this afternoon
to talk about all of today' s drama with Trump." Stone responded the next day: "Sorry I missed
this - my email [Target Account]."
38. On August 8, 2015, an individual sent a direct message to @RogerJStoneJr
reading: "Just got some stuff from the campaign you may want to respond to." That same day,
@RogerJStoneJr responded: "Such as-? My email is [Target Account] ."
10
39. On August 9, 20 15, an individual sent @RogerJStoneJr a direct message asking to
arrange an interview. @RogerJStoneJr replied, "Okay - what do you need from me." The
individual replied, " Your email address. Twitter too public." Stone replied with the Target
Account.
40. On September 7, 20 15, an individual sent a private direct message to
@RogerJStoneJr containing a " White Paper," regarding the "Most likely questions to be asked of
Mr. Trump on Foreign Policy." @RogerJStoneJr replied: "Send to me at [Target Account]."
41 . On February 17, 2016, an individual sent a direct message to Stone reading: "Mr.
Stone I have a delightful story about one foul tempered governor currently pretending to be Ned
Flanders up on the stage. Interested?" @RogerJStoneJr responded on Friday, February 19, 2016:
"Sure---tell me what u know-[Target Account]."
42. On March 21, 2016, an individual sent a private direct message to
@RogerJStoneJr reading: " Im trying to get a list of upcoming Trump events so I can Fly out and .
Film these Anti-Trump protesters. To show the American people that these are the people that
are actually creating the Chaos. No one is showing whats really going on outside at these events
honestly and quite frankly its pissing me off." The next day, @RogerJStoneJr responded: "Email
me at [Target Account]."
43. On April 30, 2016, an individual sent a private direct message to @RogerJStoneJr
stating: "Give me a shout if you need a story moved. My followers are RTing fiends! lol."
@RogerJStoneJr responded: "Great- please e-mail me again at [Target Account]."
44. On September 13, 2016, an individual send a private direct message to
@RogerJStoneJr asking for a "contact info so I can stay in touch in a more appropriate way than
Twitter DM." @RogerJStoneJr replied, "email me at [Target Account]."
11
BACKGROUND CONCERNING HOTMAIL
45. In my training and experience, I have learned that Microsoft provides a variety of
on-line services, including electronic mail ("email") access, to the public. Microsoft allows
subscribers to obtain email accounts at the domain name Hotmail.com, like the email account
listed in Attachment A. Subscribers obtain an account by registering with Hotmail. During the
registration process, Hotmail asks subscribers to provide basic personal information. Therefore,
the computers of Microsoft are likely to contain stored electronic communications (including
retrieved and unretrieved email for Hotmail subscribers and information concerning subscribers
and their use of Hotmail services, such as account access information, email transaction
information, and account application information. In my training and experience, such
information may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users.
46. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and
other identifiers, alternative email addresses, and, for paying subscribers, means and source of
payment (including any credit or bank account number). In my- training and experience, such
can be used to identify the account' s user or users. Based on my training and my experience, I
know that, even if subscribers insert false information to conceal their identity, this information
often provides clues to their identity, location, or illicit activities.
47. In my training and experience, email providers typically retain certain
transactional information about the creation and use of each account on their systems. This
12
information can include the date on which the account was created, the length of service, records
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account
· (including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage
of the account. In addition, email providers often have records of the Internet Protocol address
(" IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access
the email account.
48. In my training and experience, in some cases, email account users will
communicate directly with an email service provider about issues relating to the account, such as
technical problems, billing inquiries, or complaints from other users. Email providers typically
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a result of the communications. In my training and experience, such information may constitute
evidence of the crimes under investigation because the information can be used to identify the
account's user or users.
49. This application seeks a warrant to search all responsive records and information
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic
communications and any records or other information pertaining to the customers or subscribers
if such communication, record, or other information is within Microsoft's possession, custody, or
13
control, regardless of whether such communication, record, or other information is stored, held,
or maintained outside the United States.
50. As explained herein, information stored in connection with an email account
may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal
conduct under investigation, thus enabling the United States to establish and prove each element
or alternatively, to exclude the innocent from further suspicion. In my training and experience,
the information stored in connection with an email account can indicate who has used or
controlled the account. This "user attribution" evidence is analogous to the search for "indicia of
occupancy" while executing a search warrant at a residence. For example, email
communications, contacts lists, and images sent (and the data associated with the foregoing, such
as date and time) may indicate who used or controlled the account at a relevant time. Further,
information maintained by the email provider can show how and when the account was accessed
or used. For example, as described below, email providers typically log the Internet Protocol
(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
investigators can understand the chronological and geographic context of the email account
access and use relating to the crime under investigation. This geographic and timeline
information may tend to either inculpate or exculpate the account owner. Additionally,
information stored at the user's account may further indicate the geographic location of the
'
account user at a particular time (e.g., location information integrated into an image or video sent
via email). Last, stored electronic data may provide relevant insight into the email account
owner's state of mind as it relates to the offense under investigation. For example, information in
the email account may indicate the owner's motive and intent to commit a crime (e.g.,
14
communications relating to the crime), or consciousness of guilt (e.g. , deleting communications
in an effort to conceal them from law enforcement).
51 . I anticipate executing this warrant under the Electronic Communications Privacy
to require Hotmail to disclose to the government copies of the records and other information
(including the content of communications) associated with the account in Attachment A and
the items described in Section II of Attachment B. The items identified in Attachments A and B
will also be screened by reviewers not on the prosecution team to identify andilter out privileged
material.
CONCLUSION
52. Roger Stone used the @ RogerJStoneJr to communicate directly with Wikileaks
during the campaign, even though he publicly claimed to have "never" communicated with
Wikileaks. He also sent private messages to Julian Assange and Guccifer 2.0, the entity which
claimed responsibility for the DNC hack. Using @RogerJStoneJr, Stone has repeatedly
instructed individuals to continue conversations, including particularly sensitive issues related to
the Campaign, on the Target Account. There is therefore probable cause to believe that
evidence of the DNC hack and the hacking of other emails associated with the 2016 election will
be found on the Target Account.
15
REQUEST FOR SEALING
~f~e
~so~
Special Agent
Subscribed and sworn to before me on this / / ~y of September, 2017.
~d!f/k-d/
The Honorable Beryl A. Howell
16
ATTACHMENT A
This warrant applies to information associated with the Account
(the "Target Account") that is stored at premises owned, maintained,
controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered at One
Microsoft Way, Redmond, WA 98052.
17
ATTACHMENT B
I. Information to be disclosed by Microsoft, Corp.

custody, or control of the Microsoft, Corp. (hereinafter "the Provider"), regardless of whether
such information is stored, held or maintained inside or outside of the United States, and
including any emails, records, files, logs, ur iufunualiun lhal has been deleted but is still
available to the Provider, the Provider is required to disclose the following information to the
government for each account or identifier listed in Attachment A2:
a. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account, draft emails, the source
and destination addresses associated with each email, the date and time at which
each email was sent, and the size and length of each email;
b. All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP
addresses associated with session times and dates, account status, alternative
email addresses provided during registration, methods of connecting, log files,
and means and source of payment (including any credit or bank account number);
c. The types of service utilized;
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the
date on which the account was created, the length of service, the types of service
utilized, the IP address used to register the account, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the ~ubscriber, methods of connecting;
f. All search history or web history;

g. All records indicating the services available to subscribers of the account;
h. All usernames associated with or sharing a login IP address or browser cookie
with the account;
1. All cookies, including third-party cookies, associated with the user;
J. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile
Identification Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile
Subscriber Integrated Services Digital Network Number ("MSISDN"),
International Mobile Subscriber Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi").
II. Information to be Seized by the Government

All information described above in Section I that constitutes evidence, contraband, fruits,
and/or instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in
connection with computers) and 18 U.S.C. §371 (conspiracy to commit and offense against the
United States) involving Roger Stone or others associated with him and occurring after January
1, 2015, including, for each account or identifier listed on Attachment A, information pertaining
to the following matters:
(a) Communications, records, documents and other files that reveal efforts by Roger
Stone to communicate with any individuals associated with carrying out the hacks
of the DNC or individual email addresses associated with the Clinton Campaign.
(b) Records of any funds or benefits received by or offered to Roger Stone or an
individuals or entities associated with him by, or on behalf of, any individuals
associated with the hacks of the DNC or individual email addresses associated
with the Clinton Campaign.
2
(c) Evidence indicating how and when the account was accessed or used, to
determine the geographic and chronological context of account access, use, and
events relating to the crimes under investigation and. to the account owner;
(d) Evidence indicating the account owner' s state of mind as it relates to the crimes
under investigation;
(e) The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s).
(f) The identity of any person(s)- including records that help reveal the person(s)'
whereabouts-who communicated with the account about any matters relating to
activities conducted by Roger Stone on behalf of, for the benefit of, any
individual associated with hacks of the DNC or individual email addresses
associated with the Clinton Campaign.
3
ATTACHMENT A
Property to be Searched
This warrant applies to information associated with the following Google account:
that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043.
17
ATTACHMENT B
I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to Google or have been preserved
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment A:
a. The contents of all e-mails, attachments and chat messages stored in the
account, including copies of e-mails sent to and from the account, draft e-mails, the
source and destination e-mails sent addresses associated with each e-mail, the date and
time at which each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail
described above in Section LA. above;
c. All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above

in Section LA, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;
e. All records or other information stored by an individual using the account,

including address books, contact and buddy lists, calendar data, pictures, and files;
f. All records or other information regarding the identification of the account

described above in Section LA, to include application, full name, physical address,
telephone numbers and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized, the
IP address used to register the account, log-in IP addresses associated with session times
and dates, account status, alternative e-mail addresses provided during registration, all
screen names associated with subscribers and/or accounts, all account names associated
with the subscriber, methods of connecting, log files, means and source of payment
(including any credit or bank account number), and detailed billing records;
g. All records indicating the services available to subscribers of the

electronic mail address described above in Section LA.;
h. Google+ subscriber information, circle information, including name of

circle and members, contents of posts, comments, and photos, to include date and
timestamp;
18
i. Google Drive files created, accessed or owned by the account;
j. YouTube subscriber information, private videos and files, private

messages, and comments;
k. Google+ Photos contents to include all images, videos and other files, and
associated upload/download date and timestamp;
l. Google Talk and Google Hangouts conversation logs associated with the
account.
19
06 (Rev. 04/10) Application for a Search Warrant
UNITED STATES DISTRICT COURT OCT 1 7 2017

for the
Clerk, U.S. District & Bankruptcy
District of Columbia Courts for the District of Columbia
In the Matter of the Search of ) Case: 1:17-mj-00760

(Briefly describe the property to be searched
or identify the p erson by name and address) ~ Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH ) Assign . Date : 10/17/2017
) Description: Search and Seizure Warrant
)

property to be searched and give its location): ·
See Attachment A.
located in the - - -Northern
- ---- District of California
------=-='-=--'=- - - - , there is now concealed (identify the
See Attachment B.
This warrant is sought pursuant to 18 U.S .C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1 )(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
~ property designed for use, intended for use, or used in committing a crime;

18 U.S. C. § 1030 Fraud and Related Activities in Connection with Computers Agents
18 U.S.C. § 2 Aiding and Abetting
22 U.S.C. § 371 Conspiracy to Commit an Offense Against the United States
The appl ication is based on these facts:

under I 8 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
Rev;ewed by AUSA/SAUSk ~ ~ f!;;;;:;.=

Amy Anderson, Special Agent, FBI
IAaron Zelinsky (ASC)
Date: 10/17/2017
Judge's s ignature
City and state: Washington , D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
FILED
OCT 17 2017
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy
Courts for the District of Columbia
FOR THE DISTRICT OF rnr f Th1fRT /:;.
Case: 1:17-mj-00760
IN THE MATIER OF THE SEARCH OF
Assigned To : Howell, Beryl A
INFORMATION ASSOCIATED WITH
Assign. Date : 10/1 7/2017
Description: Search and Seizure Warrant
I, Amy Anderson, being first duly sworn, hereby depose and state as follows :
information associated with the email account (hereafter the "Target
Account"), that is stored at premises owned, maintained, controlled, or operated by Google,
Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043 .
The information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments A and B. This affidavit is made in support of an
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
well as national security threats and applicable criminal violations.
3. The facts in this affidavit come from ~y personal observations; my training and
there.is probable cause to believe that the Target Account contains communications relevant to
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with co.mputers), 18
U.S.C. § 2 (aiding and abetting), and 18 U.S.C. § 371 (conspiracy to commit an offense against
the United States).
5. As set forth below, Roger STONE communicated directly via Twitter with
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used _by Russian intelligence to
disseminate hacked information. STONE, using his Account, also emailed instructions
to Jerome CORSI to " Get to Assange" in person at the Ecuadorian Embassy and "get pending
WikiLeaks emails[.]" CORSI emailed STONE back on his Account that it was "Time
to let more than Podesta to be exposed" (before any of Podesta' s were leaked). After Podesta's
emails were leaked, CORSI emailed STONE "talking points" about Podesta to the Target
Account. CORSI also emailed the Target Account to convey information "from a very trusted
source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. In addition,
STONE used the Target Account to continue conversations via email that he began on Twitter
and forwarded emails, including at least one related to WikiLeaks, from his account to
the Target Account.
JURISDICTION
2
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 7.
PROBABLE CAUSE
A. The 2016 Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003 .
Twitter account, "Guccifer 2.0," as well as the websitesDCLeaks.com, and WikiLeaks to release
B. Roger Stone's Publicly Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
3
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
12. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from
the DNC.
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote_: "It doesn't
Guccifer 2.0." Stone embedded publicly available Tweets froni Guccifer 2.0 in the article and
wrote: "Here' s Guccifer 2.0's website. Have a look and you'll see he explains who he is and why
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for
Organizat_ion. During his speech, he was asked about a statement by WikiLeaks founder Julian
4
he' s going to do?" Stone responded: "Well, it could be a number of things. I actually have
Foundation but there's no telling wha~ the October surprise may be." A few days later, Stone
Committee (DCCC).
2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0's
17. On August 14, 2016, Stone sent a private message on Twitter using
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user' s Twitter handle
reinstated after having been suspended. 1
18. On August 15, 2016, Guccifer 2.0 replied to Stone at@RogerJStoneJr, stating:
"wow. thank u for writing back, and thank u for an article about me!!! did you find anything
1 · ~~MA
These messages were released by Stone on March I 0, 2017, as described further below in paragraph 28-:
5
19. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the ' rigg[ing]' of the 2016 presidential
elections.
back." Guccifer also sent a private message to @RogerJStoneJr stating "i' m pleased to say u r
great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
21. On August 18, 2016, Paul Manafort, Stone' s longtime friend and associate,
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
Podesta, Hillary Clinton' s presidential campaign manager, stating: "Trust me, it will soon the
Stone reiterated that because of the work of a " ' mutual acquaintance' of both his and [Assange],
that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly soon.
6
24. On Saturday, October 1, 2016, using@RogerJStoneJr, Stone Tweeted,
"Wednesday @HillaryClinton is done. #WikiLeaks."
which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
27. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading
to approximately 2,050 emails that had been hacked from John Podesta' s personal email account.
28. WikiLeaks continued to release John Podesta's hacked emails throughout October
10-21, 2016. On October 12, 2016, John Podesta - referring back to Stone' s August 21 , 2016 C-
there' s at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the Miami Herald, Stone responded: " I have never met or spoken with
7
Washington Times.
30. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing
from an email address associated with WikiLeaks, denied that there was any backchannel
communication during the Campaign between Stone and WikiLeaks. The same article quoted
C. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
Twitter account@RogerJStoneJr. Contrary to Stone's representation to CNN that he "never
communicated with WikiLeaks," Stone in fact communicated via private direct messaging with
WikiLeaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account's private
direct messaging system to communicate directly with Julian Assange since at least June 2017.
32. For example, on October 13, 2016, while WikiLeaks was in the midst ofreleasing
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
8
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as
print defending WikiLeaks and assange against the claim that you are Russian agents and
33. Less than an hour later, @wikileaks responded by direct message: "We appreciate
that. However, the false claims of association are being used by the democrats to undermine the
impact of our publications. Don't go there if you don't want us to correct you."
34. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!
The more you \"correct\" me the more people think you're lying. Your operation leaks like a
sieve. You need to figure out who your friends are."
35. On November 9, 2016, one day after the presidential election, @wikileaks sent a
direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks immediately
followed up with another message less than a minute later: "We are now more free to
communicate."
36. In addition, @RogerJStoneJr has also recently exchanged direct messages with
Julian Assange, the founder of WikiLeaks. For example, on June 4, 20 17, @RogerJStoneJr
directly messaged @JulianAssange, an address associated with Julian Assange in numerous
public reports, stating: "Still nonsense. As a journalist it doesn't matter where you get
information only that it is accurate and authentic. The New York Times printed the Pentagon
Papers which were indisputably stolen from the government and the courts ruled it was legal to
do so and refused to issue an order restraining the paper from publishing additional articles. If
the US government moves on you I will bring down the entire house of cards. With the trumped-
9
up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best
regards. R." That same day, @JulianAssange responded: "Between CIA and DoJ they're doing
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down
Trump trying to squeeze us into a deal."
37. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@wikileaks, reading: " I am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this
D. Roger Stone's Emails Regarding WikiLeaks, Julian Assange, Russia, and John
Podesta
38. On September 11 , 2017, Chief Judge Beryl A. Howell of the District of Columbia
issued a search warrant for STONE's address, (the "
Account"). Emails recovered pursuant to that search warrant indicated the following:
39. On July 25, 20 16, STONE sent an email from his Account to JEROME
CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
WikiLeaks emails .. . they deal with Foundation, allegedly."
40. On or about August 2, 2016 (approximately 19 days before STONE publicly
tweeted about "Podesta's time in the barrel"), CORSI emailed the Account, " Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much
10
of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to Julian ASSANGE, the founder ofWikiLeaks, who resided
in Ecuador's London Embassy in 2016.
41. On or about August 16, 2016, CORSI emailed the Target Account link to a piece
CORSI had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to
Derail Hillary."
42. On or about August 31 , 2016, CORSI emailed the Account: "Did you get
the Podesta writeup." STONE replied "yes."
43 . On or about September 6, 2016, CORSI emailed the Account: "Roger[,]
Is NY Post going to use the Pedesta [sic] stuff?"
44. On or about October 4, 2016 STONE forwarded an email from his
Account to the Target Account with the subject line "Comment on WikiLeaks?" The email,
from a reporter, asked STONE for any comment on the "lack of an 'October surprise' release
from WikiLeaks today?"
45. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails.
46. On or about October 12, 2016, the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
Target Account and the Account, with a subject line "Podesta talking points." Attached
to the email was a file labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The
"talking points" included the statement that, "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
the Clinton Foundation." CORSI followed up several minutes later with another email to the
11
Target Account and the Account titled, "Podesta talking points," with the text "sent a
second time just to be sure you go it." STONE emailed CORSI back via the Account,
"Got them and used them."
47. On or about October 17, 2016, CORSI emailed the Target Account and the
Account with the subject, "Fwd: AS SAN GE . .. URGENT ... " CORSI wrote, "From a
very trusted source," and forwarded an email with the header information stripped out, showing
only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador
and U .K. He will drop the goods on them if they move to extradite him. My guess is that he has a
set of dead man files that include Hillary. It's what they used to call a ' Mexican stand off[.]'
Only hope is that if Trump speaks out to save him[.] Otherwise he'd dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
48. On or about January 7, 2017, emailed the Target Account,
the Account, CORSI, and with the subject line, "in case you need
his mail ... ...... " Attached to the message was a scan of a business card for John Podesta.
Several hours later, replied to all recipients, including the Target Account, "Ha ...
maybe he wants to go phishing with us?"
49. I know from my training and experience that the term "phishing" is used to refer
to the practice of sending emails purporting to be from a reputable party in order to induce
individuals to reveal personal information, including passwords. Public reports indicate that
Podesta's emails were obtaining through a "phishing" scheme.
E. Roger Stone's Use of the Target Account to Continue Conversations Begun on

Twitter Direct Message.
12
50. STONE has also used Target Account to continue conversations began via
Twitter direct message. For example, on August 18, 2016, an individual sent @RogerJStoneJr a
direct message asking "know where to send information to" regarding "Presidential polls and
why cycle favors Trump." Stone responded: "[Target Account] ."
51. On August 19, 2017, an individual sent a direct message to @RogerJStoneJr
concerning an offer for "$500 for a 30 minute phone call," stating that "My audience would be
fascinated by discussion." The individual then direct messages Stone, "Hi Roger! I'm striking
out with your rep. Hoping we can swing something this week. My offer still stands."
@RogerJStoneJr wrote back: "Email me direct (Target Account]."
BACKGROUND CONCERNING GOOGLE
52. Google provides numerous free services to the users with a Google profile. Some
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user' s Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view, and share videos. Google also retains a record of searches conducted by the user,
as well as location data for the use of some of the services described above. All of these services
may record information uploaded, inputted, or gathered from the user.
13
53. In my training and experience, in addition to information such as search history
can help to show the state of mind of an individual at the time the search was made, as well as
the individuals potential advance knowledge of events, as they search to see if the anticipated
event has occurred. Individuals who communicate via Gmail also often use other Google
products, including Google Talk, to communicate, and Google Drive to store or transfer, open, or
edit files.
to require Google to disclose to the government copies of the records and other information
particularly described in Section I of Attachment B. Upon receipt of the information described
in Section I of Attachments B, government-authorized persons will review that information to
locate the items described in Section II of Attachments B. The items identified in Attachments A
and B will also be screened by reviewers not on the prosecution team to identify and filter out
privileged material.
CONCLUSION
55. STONE instructed CORSI via the Account to "Get to Assange" at the
Ecuadorian Embassy regarding upcoming leaks, and CORSI emailed Stone on the
Account that it was "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC." CORSI later emailed STONE "talking points" about Podesta to the
Target Account, and also emailed the Target Account to convey information "from a very
trusted source" regarding ASSANGE, WikiLeaks, and potential disclosure. STONE also used
14
the Target Account to continue conversations via email that he began on Twitter and forwarded
emails related to WikiLeaks from the Account to the Target Account. There is
therefore probable cause to believe that evidence of the DNC hack and the hacking of other
emails associated with the 2016 election will be found in the information associated with the
Target Account.
15
REQUEST FOR SEALING
Special Agent
Federal Bureau of lnvestigati_o n
Subscribed and sworn to before me on this I J ~ of October, 2017.
~le~
16
ATTACHMENT A
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043.
17
ATTACHMENT B
I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and
the Present.
pursuant to a preservation request under 18 U.S.C. § 2703(±), Google is required to disclose the
time at which each e-mail was sent, and-the size and length of each e-mail;
described above in Section I.A. above;

in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;


described above in Section I.A, to include application, full name, physical address,

electronic mail address described above in Section I.A.;

timestamp;
18
1. Google Drive files created, accessed or owned by the account;
J. YouTube subscriber information, private videos and files, private

1. Google Talk and Google Hangouts conversation logs associated with the
account.
19
II. Information to be Seized by Law Enforcement Personnel
a. Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January
2015 to the present, including:
All records, information, documents or tangible materials that relate 'in any way to
communications regarding hacking, release of hacked material, communications
with persons or entities associated with WikiLeaks, including but not limited to
Julian Assange;
b. All images, messages, communications, calendar entries, search terms,

and contacts, including any and all preparatory steps taken in furtherance of the above-
listed offenses;
c. Communication, information, documentation and records relating to who

created, used, or communicated with the account or identifier, including records about
their identities and whereabouts;
d. Evidence of the times the account was used;
e. All images, messages and communications regarding wipmg software,

encryption or other methods to avoid detection by law enforcement;
f. Passwords and encryption keys, and other access information that may be
necessary to access the account and other associated accounts;
g. Credit card and other financial information, including but not limited to,
bills and payment records evidencing ownership of the subject account;
h. All existing printouts from original storage which concern the categories
identified in subsection II.A; and
1. All "address books" or other lists of contacts.
20
AO 106 (Rev. 04/ 10) Application for a Search Warrant
FILED
UNITED STATES DISTRICT COURT NOV -s 2017
for the
In the Matter of the Search of Case: 1: 17-mj-00a21

)
(Briefly describe the prop erty to be searched )
or identi.fj, the p erson by name and address) Ass!gned To : Howell, Beryl A
)
INFORMATION ASSOCIATED WITH THE TWITTER
)
Assign. Date : 11/6/2017 .
ACCOUNTS
)

I , a federal law enforcement officer or an attorney for the government, request a search warrant and state under
See Attachment A.
located in the Northern
- - - ' - - - - - -- District of _ _ __ California
__.:....c.;c.:,c.;:_;_:--=-- --- , there is now concealed (identi.fj, the
p erson or describe the property to be seized) :
See Attachment 8.
The basis for the search under Fed. R. Crim. P. 41 (c) is (check one or more) :
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers
18 U.S.C. § 371, § 2 Conspiracy Against the United States, Aiding and Abetting
50 U.S.C. § 30121 Foreign Contribution Ban
Rev:.::~~::::/::::::fue b~is ofwhich isset a;-~!:;

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ __ _ _ ) is requested
IAaron Zelinsky (ASC) Amy Anderson, Special Agent, FBI

Date: 11/6/2017
City and state: Washington , D.C. Hon . Beryl A. Howell, Chief U.S. District Judge
FILED
NOV -s 2017
FOR THE DISTRICT OF COLUMBIA Clerk us 0 . .
Courts fo.r the ';~ntc~ & Bankruptcy
is net ot Columbia
IN THE MATTER OF THE SEARCH OF Case: 1: 17-mj-00821
INFORMATION AS SOCIA TED WITH THE Ass!gned To : Howell, Beryl A
TWITTER ACCOUNT AND Assign. Date : 11/6/2017
I, Amy Anderson, being first duly sworn, hereby depose and state as follows:
I. I make this affidavit in support of an application for a search warrant for
information associated with the Twitter Accounts (hereafter "Target Account 1")
and (hereafter "Target Account 2"), that is stored at premises owned,
maintained, controlled, or operated by Twitter, a social-networkin? company headquartered in
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government
is described in the following paragraphs and in Attachments A and B. This affidavit is made in
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and
2703(c)(I )(A).
2. I am a Special Agent with Federal Bureau oflnvestigation ("FBI") working
directly with the Special Counsel's Office. I have been a Special Agent with the FBI since 2010.
Since then, l have conducted national security investigations of foreign intelligence services,
espionage, and counter proliferation matters. I have training and experience related to espionage,
foreign intelligence services, and national security investigations. I have conducted and
participated in various investigations involving multiple threat countries as well as national
security threats and applicable criminal violations.

there is probable cause to believe that certain individuals with whom the Target Accounts were
in communication have committed violations of 18 U..S.C. § I 030 (fraud and related activities in
connection with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S .C. § 2 (aiding
and abetting), 18 U.S.C. § 371 (conspiracy to commit an offense against the United States), and
that communications related to these violations will be found on the Target Accounts. There is
therefore probable cause to search the information described in Attachment A for evidence of
these crimes and contraband or fruits of these crimes, as described in Attachment B.
5. As detailed further below, from on or about June 22, 20 I 6, through at least on or
about July 17, 2016, Target Account 1, belonging to WikiLeaks, exchanged numerous direct
messages concerning hacked information with Guccifer 2.0, which was a Twitter account used
by the Russian Government to release data obtained through hacking accounts of U.S. users.
Target Account 1 also sent direct messages via Twitter concerning a "guessed" password for the
website " " to Target Account 2 belongs to Julian Assange,
the founder of WikiLeaks. Beginning no later than on or about July 2016, former Campaign
adviser Roger Stone was in contact with Assange via an intermediary regarding upcoming leaks
of hacked information obtained by WikiLeaks. In addition, Assange, using Target Account 2,
communicated directly with Stone beginning no later than on or about April 7, 2017. Stone
stated to Target Account 2 that he was "doing everything possible to address the issues [related
2
to WikiLeaks] at the highest level of Government," and that he and Target Account 2 "must be
circumspect in this forum as experience demonstrates it is monitored."
JURISDICTION
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below
in paragraph 9.
PROBABLE CAUSE
A. Background on the Target Accounts, Julian Assange, and Roger Stone.
7. Target Account 1 is the public account of WikiLeaks. As detailed further below,
it frequently has been used to release hacked information, including during the 2016 election.
Target Account 2 is the public account of Julian Assange. Target Account 2 has over 500,000
followers, but only follows one account, Target Account 1. Target Account 2 frequently
tweets information related to WikiLeaks and tags Target Account 1.
8. Julian Assange is the founder of WikiLeaks. According to the publicly-accessible
profile of Target Account 2, Assange currently is the "Publisher @WikiLeaks [Target Account
1]." Target Account 2's profile contains a link to the website " IamWikiLeaks.org\donate."
According to publicly-available press reporting, Assange began hacking secure computer
systems when he sixteen years old, in 1987. On or about December 1996, Assange pied guilty in
Australia to twenty-five charges related to hacking secure computer systems. In 2006, Assange
and others established WikiLeaks, and he previously described himself as WikiLeaks's Editor-
3
in-Chief. Assange has stated in public interviews that he is deeply involved in running
WikiLeaks. Referring to the DNC emails, Assange stated in an August, 2017 interview that, "We
had quite some difficulties to overcome, in terms of the technical aspects, and making sure we
were comfortable with the forensics," and that "You have to get close and interact with it, then
you start to get a feel." Assange indicated that only a small number of people, including himself,
worked on the release of the DNC emails. Assange stated in August 20 16 to a news organization
that, "We are working around the clock. We have received quite ·a lot of material."
actively involved in U.S. politics sine~ 1975. Stone officially worked on the presidential
campaign of Donald J. Trump (the "Campaign") until August 2015. Although Stone had no
continued to make media appearances in support of Trump' s presidential campaign. After
Stone's public departure from the Campaign, Stone continued to correspond with individuals
related to the Campaign, including Paul Manafort (who worked for a time as Campaign
manager), Rick Gates (a campaign adviser), and Jason Miller (Campaign spokesman). As
discussed further below, Stone made a number of public references to WikiLeaks, Julian
Assimge, and the release of DNC-related emails.
B. The DNC Email Hack and Russia's Use of "Guccifer 2.0" and WikiLeaks to
10. According to the public and unclassified intelligence report prepared by the
United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence
4
Directorate or "GRU") probably began cyber operations aimed at the U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other
Democratic Party officials and political figures. By in or about May 2016, the GRU had
exfi ltrated large volumes of data from the DNC. The DNC headquarters is located at 43 0 South
Capitol Street SE, Washington, D.C. 20003.
11 . The public and unclassified intelligence report assessed that:
a. The GRU used a Twitter account, "Guccifer 2.0" and the website
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in
exclusives to media outlets and relayed material to WikiLeaks.
b. Guccifer 2.0, who claimed to be an independent Romanian hacker, made
multiple contradictory statements and false claims about hi s likely Russian identity
throughout the election.
c. Content that was taken from e-mail accounts targeted by the GRU in
March 2016 appeared on DCLeaks.com starting in June 20 16.
d. The GRU relayed material it acquired from the DNC and senior
Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not
contain any evident forgeries.
e. The Kremlin 's principal international propaganda outlet RT (formerly
Russia Today) has actively collaborated with WikiLeaks. RT's editor-in-chief visited
WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August
2013, where they discussed renewing his broadcast contract with RT, according to
Russian and Western media. Russian media has subsequently announced that RT had
5
become "the only Russian media company" to partner with WikiLeaks and had received
access to "new leaks of secret information."
f. On or about August 6, 2016, RT published an English-language video
called "Julian Assange Special: Do WikiLeaks Have the E-Mail That'll Put Clinton in
Prison?" and an exclusive interview with Assange entitled "Clinton and ISIS Funded by
the Same Money."
12. On or about June 14, 2016, the Washington Post reported that "Russian
government hackers" had penetrated the DNC computer network and stole opposition research
on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.
13. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack
and began posting hacked documents.
14. As detailed further below, on or about June 22, 2016, Guccifer 2.0 and Target
Account 1 initiated communication via Twitter private messaging regarding the transfer and
release of hacked information, including the hacked email accounts related to the DNC.
15. On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from
the DNC. Using Target Account 1, WikiLeaks publicly tweeted: "WikiLeaks releases thousands
of documents about Clinton and internal deliberations" and linked to a Washington Post article
and www.wiki leaks .org/dnc-emails/.
I 6. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers
and email addresses from the files of the Democratic Congressional Campaign Committee
(DCCC).
17. On or about August 21, 20 16, Roger Stone directed a publicly-available tweet at
John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it will soon
6
the [sic] Podesta's time in the barrel. #CrookedHi llary." In a C-SPAN interview that same day,
Stone reiterated that because of the work of a '" mutual acquaintance' of both his and [Assange],
18. On or about September 13, 2016, Target Account 1 tweeted a public message
stating, "678.4 MB of new ' DNC documents' from @Guccifer_2," with a link to a publicly
available file.
20. Approximately a half hour later, at 4:32 P.M., Target Account 1 sent out a Tweet
reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing
a link to approximately 2,050 emai ls that had been hacked from John Podesta's personal emai l
account. WikiLeaks, via Target Account 1, continued to release John Podesta's hacked emails
throughout October 10-14, 2016.
C. Communications Between the Target Account 1 and Guccifer 2.0
21 . On July 7, 2017 Magistrate Judge Maria-Elena James of the Northern District of
California issued a search warrant for the Twitter Account associated with Guccifer 2.0. The
communications obtained from the account are detailed further below.
7
22. On or about June 22, 2016, WikiLeaks sent Guccifer 2.0 sent a direct message
(OM) stating "Do you have secure communications?" Target Account 1 stated, "Send any new
material here for us to review and it will have a much higher impact than what you are doing. No
other media will release the full material." Guccifer 2.0 replied, "what can u suggest for a secure
connection? Soft, keys, etc? I'm ready to cooperate with you, but I need to know what's in your
archive 80gb? Are there only HRC emails? Or some other docs? Are there any DNC docs? If it's
not secret when you are going to release it?" Target Account 1 wrote back, "You can send us a
message in a .txt file here," and attached a web link. Guccifer 2.0 responded, "do you have
GPG?" I know from my training and experience that "GPG" refers to a program for exchanged
encrypted information.
23. On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, "How can
we chat? Do u have jabber or something like that?" I know from my training and experience that
"Jabber" is an instant messaging service. Target Account 1 wrote back, "Yes, we have
everything. We' ve been busy celebrating Brexit. You can also email an encrypted message to
[email protected]. They key is here." 1 A web link was attached to the message. I know from
my training and experience that an encryption "key" is a string of information created for
scrambling and unscrambling data.
24. On or about June 27, 2016, Guccifer 2.0 wrote to Target Account 1, "Hi, [I]'ve
just sent you an email with a text message encrypted and an open key." Target Account 1 wrote
back, "Thanks." Guccifer 2.0 replied, "waiting for ur response. I send u some interesting piece."
1
Target Account I sent each sentence as a separate message, though close in time. These messages have been
consolidated into a single quote for ease of reading. The same is done below with other close in time messages.
8
25. On or about July 4, 2016, Guccifer 2.0 wrote to Target Account 1, "hi there,
check up r email, waiting for [r]eply."
26. On or about July 6, 2016, Guccifer 2.0 wrote to Target Account 1, "have u
received my parcel?" Target Account 1 responded, "Not unless it was very recent. [we haven't
checked in 24h]." 2 Guccifer 2.0 replied, "I sent it yesterday, an archive of about 1 gb. via
[website link]. [A]nd check your email." Target Account 1 wrote back, "Wil[l] check, thanks."
Guccifer 2.0 responded, " let me know the results." Target Account 1 wrote back, "Please don't
make anything you send to us public. It' s a lot of work to go through it and the impact is severely
reduced if we are not the first to publish." Guccifer 2.0 replied, "agreed. How much time will it
take?" Target Account 1 responded, " likely sometime today." Guccifer 2.0 wrote back, "will u
announce a publication? and what about 3 docs [I] sent u earlier?" Target Account 1 responded,
" I don' t believe we received them. Nothing on 'Brexit' for example." Guccifer 2.0 wrote back,
"wow. have you checked ur mail?" Target Account 1 replied, "At least not as of 4 days ago . . . .
For security reasons mail cannot be checked for some hours." Guccifer 2.0 wrote back, "fuck, [I]
sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I]
spent the whole day uploading 1 gb." I know from my training and experience that the term "gb"
is an abbreviation for "gigabyte," a unit of measurement of information stored on a computer.
27. Target Account 1 wrote back, "We can arrange servers l00x as fast. The speed
restrictions are to anonymise the path. Just ask for custom fast upload point in an email."
Guccifer 2.0 wrote, "will u be able to check ur email?" Target Account 1 responded, "We're
best with very large data sets. e.g. 200gb. these prove themselves since they're too big to fake. "
2
The brackets appear in the original message.
9
Guccifer 2.0 responded, "or shall I send brexit docs via submission once again?" Target
Account 1 responded, "to be safe, send via [web link]."
28. On or about that same day, Guccifer 2.0 wrote, "can u confirm u received dnc
emails?" Target Account 1 wrote back several messages later, "for security reasons we can 't
confirm what we' ve received here. e.g., in case your account has been taken over by us
intelligence and is probing to see what we have." Guccifer 2.0 responded, "then send me an
encrypted email." Target Account 1 wrote back, "we can do that. but the security people are in
another time zone so it will need to wait some hours." Target Account 1 wrote, "what do you
think about the FBl ' s failure to charge? To our mind the clinton foundation investigation has
always been the more serious. we would be very interested in all the emails/docs from there. She
set up quite a lot of front companies. e.g in sweden." Guccifer 2.0 responded, "ok, [l]'ll be
waiting for confirmation. [A]s for investigation, they have everything settled, or else I don' t
know how to explain that they found a hundred classified docs but fail to charge her. " Target
Account 1 responded, "She' s too powerful to charge at least without something stronger. [A]s
far as we know, the investigation into the clinton foundation remains open[.] [W]e hear the FBI
are 4nhappy with Loretta Lynch over meeting Bill, because he' s a target in that investigation."
29. On or about that same day, Guccifer 2.0 wrote to Target Account 1, "[D]o you
have any info about marcel lazar? There've been a lot of rumors of late." "Marcel Lazar" is the
name of a Romanian Hacker who used the pseudonym "Guccifer," and who pied guilty on May
25, 2016 in the Eastern District of Virginia to hacking the personal accounts of a variety of
victims, including a former U.S. president. According to publicly available reporting, in May
20 16, Lazar also claimed to have hacked the email served belonging to then-candidate Clinton.
Lazar stated, " For me, it was easy ... easy for me, for everybody." Lazar's claims have not been
10
substantiated, and the undersigned is not aware of evidence indicating Lazar accomplished the
hack.
30. Target Account 1 wrote back, "the death? [A] fake story." Target Account 1
messaged: "His 2013 screen shots of Max Blumenthal's inbox prove that Hillary secretly deleted
at least one email about Libya that was meant to be handed over to Congress. So we were very
interested in his co-operation with the FBI." Guccifer 2.0 wrote back, "some dirty games behind
the scenes [I] believe[.] Can you send me an email now?" Target Account 1 wrote back, "No;
we have not been able to activate the people who handle it. Still trying." Guccifer 2.0 replied,
"what about tor submission? [W]ill u receive a doc now?" Target Account 1 replied, "We will
get everything sent on [weblink]." [A]s long as you see \"upload succseful\" at the end. [I]fyou
have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the
DNC is approaching and she will solidify bernie supporters behind her after." Guccifer 2.0
responded, "ok. I see."
31. Target Account 1 wrote, " [W]e think the public interest is greatest now and in
early october." Guccifer 2.0 responded, "do u think a lot of people will attend bernie fans rally in
philly? Will it affect the dnc anyhow?" Target Account 1 wrote, "bernie is trying to make his
own faction leading up to the DNC. [S]o he can push for concessions (positions/policies) or, at
the outside, if hillary has a stroke, is arrested etc, he can take over the nomination. [T]he question
is this: can bemies supporters+staff keep their coherency until then (and after). [O]r will they
dis[s]olve into hillary's camp? [P]resently many of them are looking to damage hilary [sic]
inorder [sic] to increase their unity and bargaining power at the DNC. Doubt one rally is going to
be that significant in the bigger scheme. [I]t seems many of them will vote for hillary just to
prevent trump from winning."
11
32. On or about that same day, Guccifer 2.0 sent Target Account 1 a message
reading, "sent brexit docs successfully." Target Account 1 responded, ":)))." Target Account 1
wrote back, "we think trump has only about a 25% chance of winning against hillary so conflict
between bernie and hillary is interesting." Guccifer 2.0 responded, "so it is." Target Account 1
wrote, "also, it' s important to consider what type of president hillary might be. If bernie and
trump retain their groups past 2016 in significant number, then they are a restraining force on
hillary."
33. On or about July 7, 2016, Target Account 1 wrote, "All good?" Guccifer 2.0
responded, "yeah, what about u? is smth wrong?" I know from my training and experience that
"smth" is used as an abbreviation for "something." Target Account 1 wrote back, "No. All
good." Guccifer 2.0 wrote back, "are working with the emails [I] sent u? [C]heck ur email. [I]
sent u a check archive from another email box. fuck, mail undelivered. [D]o you have another
way to receive large volumes of data? [B]esides for tor submission form?"
34. On or about July 11, 2016, Guccifer 2.0 wrote to Target Account 1, "sent it via
ur submission. check it."
35. On or about July 13, 2016, Guccifer 2.0 wrote, "r u there?" On or about July 14,
2016, Guccifer 2.0 wrote, "ping. Check ur email. sent u a link to a big archive and a pass."
Target Account 1 replied, "great, thanks; can' t check until tomorrow though ."
36. On or about July 17, 2016, Guccifer 2.0 wrote, "what bout now?" On or about
July 18, 2016, Target Account 1 responded, "have the 1Gb or so archive." Guccifer 2.0
responded, "have u managed to extract the files?" Target Account 1 responded, "yes. turkey
coup has delayed us a couple of days. [O]therwise all ready[.]" Guccifer 2.0 responded, "so
when r u about to make a release?" Target Account 1 wrote back, "this week. [D]o you have
12
any bigger datasets? [D]id you get our fast transfer details?" Guccifer 2.0 wrote back, "i'll check
it. did u send it via email? Target Account 1 responded , "yes." Guccifer 2.0 replied, "to [web
link]. [I] got nothing." Target Account 1 wrote, "check your other mail? this was over a week
ago." Guccifer 2.0 wrote back, "oh, that one, yeah, [I] got it."
37. On or about July 18, 20 16, Target Account 1 wrote, "great. [D]id it work?"
Guccifer 2.0 wrote back, " [I] haven't tried yet." Target Account 1 responded, "Oh. We arranged
that server just for that purpose. Nothing bigger?" Guccifer 2.0 wrote back, "let's move step by
step, u have released nothing of what [I] sent u yet." Target Account 1 replied, "How about you
transfer it all to us encrypted. [T]hen when you are happy, you give us the decrypt key. [T]his
way we can move much faster. (A]lso it is protective for you if we already have everything
because then there is no point in trying to shut you up." Guccifer 2.0 wrote back, "ok, i' ll ponder
it."
D. Contacts Involving the Julian Assange, Roger Stone, and the Target Accounts
38. Approximately eight days after the last communication between Guccifer 2.0 and
WikiLeaks described above, on or about July 25, 2016, Stone sent an email to Jerome Corsi, an
author and political commentator, with the subject line, "Get to Assange." 3 The body of the
message read: "Get to Assange [a]t Ecuadorian Embassy in London and get the pendin~
wiki leaks emails ... they deal with Foundation, allegedly."
39. On or about A:ugust 2, 2016, Corsi emailed Stone, " Word is friend in embassy
plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging
3
1. On August 7, 20 17, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for
Roger Stone's Twitter account, @RogerJStoneJr. On September 11, 2017, Chief Judge Beryl A. Howell of the
District of Columbia issued a search warrant for Stone's Hotmail address, The relvant
results of those search warrants are summarized in the paragraphs which fo llow.
13
... Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting
HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump
focus, setting stage for Foundation debacle." Based on my training, experience, and review of
materials in this case, it appears that Corsi's reference to a "friend in embassy [who] plans 2
more dumps" refers to Julian Assange (the user of Target Account 2), the founder of
WikiLeaks, who resided in Ecuador's London Embassy in 2016.
40. On or about August 16, 2016, Corsi emailed Stone a link to a piece Corsi had
written about Stone titled, "Trump Adviser: Wikileaks Plotting Email Dump to Derail Hillary."
41. As discussed above, on or about August 21, 2016, Roger Stone directed a
publicly-available tweet at John Podesta, Hillary Clinton' s presidential campaign manager,
stating: "Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary."
42. On or about August 31, 2016, Corsi emailed Stone: "Did you get the PODESTA
write-up." STONE replied "Yes."
43. On or about September 6, 2016, Corsi emailed: "Roger[,] Is NY Post going to use
the Pedesta [sic] stuff?"
44. On or about October 7, 2016, WikiLeaks began releasing emails hacked from
John Podesta' s account.
45. WikiLeaks continued to release John Podesta' s hacked emails throughout October
I 0-21, 2016. On October 12, 2016, John Podesta argued publicly that " [it is] a reasonable
assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the
release of his emails] and the Trump campaign had advanced warning about what Assange was
going to do. I think there' s at least a reasonable belief that [Assange] may have passed this
14
information on to [Stone]." Commenting to the Miami Herald on or about that same date, Stone
responded: "I have never met or spoken with Assange, we have a mutual friend who ' s traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I .have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
46. On or about that same day, October 12, 2016, Corsi emailed Stone on both the
with a subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER
STONE podesta talking points Oct 12 2016.docx." The "talking points" included the statement
that, "Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation." Corsi followed
up several minutes later with another email titled, "Podesta talking points," with the text "sent a
second time just to be sure you go it." Stone emailed Corsi back, "Got them and used them."
47. On or about the next day, October 13, 20 I 6, Stone sent a private direct message to
Target Account 1 stating, "Since I was all over national TV, cable and print defending
wikileaks and assange against the claim that you are Russian agents and debunking the false
charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking
me- cordially R." Target Account 1 responded, "We appreciate that. However, the false claims
of association are being used by the democrats to undermine the impact of our publications.
Don't go there if you don't want us to correct you."
48. On or about October 16, 2016, Roger Stone wrote to Target Account 1, "Ha! The
more you \"con-ect\" me the more people think you're lying. Your operation leaks like a sieve.
You need to figure out who your friends are."
15
49. On or about October 17, 2016, Corsi emailed Stone with the subject, "Fwd:
ASSANGE ... URGENT . .. " Corsi wrote, "From a very trusted source," and forwarded an email
with the header information stripped out, showing only the body text. The email read, "Yes[.] I
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if
they move to extradite him. My guess is he has a set of dead man files that include Hillary. It's
what they used to call a ' Mexican stand offt.]' Only hope is if Trump speaks out to save him[ .)
Otherwise he's dead anyway, once he' s dropped what he has. If HRC wins, Assange can kiss his
life away. Interesting gambit Assange has to play out. He' s called Podesta's bluff and raised him
the election."
50. The presidential election was held on November 8, 2016.
51. On or about November 9, 2016, Target Account 1 messaged Roger Stone,
" Happy?" and then wrote, "We are now more free to communicate."
52. On or about March 27, 2017, Target Account 1 wrote to Roger Stone, "FYI,
while we continue to be unhappy about false \"back channel\" claims, today CNN deliberately
broke our off the record comments."
Stone as stating: " Since I never communicated with WikiLeaks, I guess I must be innocent of
limited things I did predict (Oct disclosures) all came true. "
16
54. On or about April 7, 2017, Roger Stone wrote to Target Account 1, " I am JA's
only hope for a pardon the chances of which are actually (weirdly) enhanced by the bombing in
Syria (which I opposed) . You have no idea how much your operation leaks. Discrediting me
only hurts you. Why not consider saying nothing? PS- Why would anyone listen to that asshole
Daniel Ellsberg." Based on my training, experience, and review of materials in this case, I
believe that "JA" refers to Julian Assange, the user of Target Account 2.
55. On or about April 19, 2017, Assange, using Target Account 2, wrote to Stone,
"Ace article in infowars. Appreciated. But note that U.S. intel is engages in slight of hand
maoevers [sic]. Listen closely and you see they only claim that we received U.S. election leaks
\"not directly\" or via a \"third party\" and do not know \"when\" etc. This line is Pompeo appears
to be getting at with his \"abbeted\". This correspnds to the same as all media and they do not
make any allegation that WL or I am a Russia asset."
56. On or about June 4, 2017, Roger Stone wrote back to Target Account 2, "Still
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
from the government and the courts ruled it was legal to do so and refused to issue an order
restraining the paper from publishing additional articles. If the US government moves on you I
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I
don't know of any crime you need to be pardoned for - best regards. R." Target Account 2
responded, "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
strongly from those obsessed with taking down Trump trying to squeeze us into a deal."
57. On or about June 10, 2017, Roger Stone wrote to Target Account 2, "I am doing
everything possible to address the issues at the highest level of Government. Fed treatment of
17
you and Wikileaks is an outrage. Must be circumspect in this forum as experience demonstrates
it is monitored. Best regards R ." Target Account 2 wrote back, "Appreciated. Of course it is!"
E. Target Account 1 Sends the "Guessed" Password to " " to
58. During the events described above, Target Account 1 also engaged in a separate
proviate conversation regarding a "guessed" password to the non-public website
"PutinTrump.org." On or about September 20, 2016, at approximately 9:07PM, Target Account
1 publicly tweeted, " ' Let's bomb Iraq' Progress for America PAC to launch 'PutinTrump.org' at
9:30.a m . Oops pw is putintrump.org."
59. On or about September 20, 2016, at approximately 11 :59PM, Target Account 1
sent a private message to a high level individual associated with the Campaign (the "high-level ·
Campaign individual"). 4 The message stated: "A PAC run anti-Trump site ' ' is
about to launch. The PAC is a recycled pro-Iraq war·PAC. We have guessed the password. It is
'. See 'About ' for who is behind it. Any comments?"
60. According to publicly available reporting, at approximately 9:31AM on or about
September 21 , 2016, the website " " was launched. The website was run by
individuals who stated they wanted to focus attention to what they described as the "dangerous
and unprecedented ties" between Vladimir Putin and Donald J. Trump.
61. On or about September 21, 2016, at approximately I I :50AM (approximately two
hours after PutinTrump.org went " live" according to publicly available press accounts), the high-
4
These records were obtained via a search warrant signed by Chief Judge Beryl A. Howell of the District of
Columbia on October 12, 2017.
18
level Campaign individual sent Target Account 1 a private message: "Off the record I don't
know who that is but I' ll ask around. Thanks."
INFORMATION CONCERNING TWITTER
information. Twitter also permits users to create and read 140-character messages called
"Tweets," and to restrict their "Tweets" to individuals whom they approve. These features are
described in more detail below.
usemame and an account password, and the user may also select a different name of 20
usemame, password, and name without having to open a new Twitter account.
19
account page. In addition, Twitter users can post "bios" of 160 characters or fewer to their profile
pages.
user's logins to Twitter including, for each access, the IP address assigned to the user and the
date stamp at the time the user accessed hi s or her profile.
posted to Twitter. Twitter users can also "favorite," "retweet," or reply to the Tweets of other
the user's own Tweets, as well as a list of all Tweets that include the user' s username (i.e., a list
of all "mentions" and "replies" for that username).
reveal the users' locations at the time they post each Tweet. Thi s "Tweet With Location"
20
71 . A Twitter user can "follow" other Twitter users, which means ~ubscribing to
following that _user (i.e., the user' s "followers" list) and a list of people whom that user follows
setting). A Twitter user can also group other Twitter users into " lists" that display on the right
side of the user' s home page on Twitter. Twitter ilso provides users with a list of "Who to
people follow.
72. In addition to posting Tweets, a Twitter user can also send DMs to one of his or
her followers. These messages are typically visible only to the sender and the recipient, and both
the sender and the recipient have the power to delete the message from the in boxes of both users.
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs
are stored on Twitter's database.
Tweets for keywords, usemames, or subject, among other things. A Twitter user may save up to
25 past searches.
21
profiles.
between the user and the provider's support services, as well as records of any actions taken by
from using Twitter' s services.
provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct
Twitter user' s account information, IP log, stored electronic communications, and other data
retained by Twitter, can indicate who has used or controlled the Twitter account. This " user
"tweets" (status updates) and "tweeted" photos (and the data associated with the foregoing, such
22
indicate the owner' s motive and intent to commit a crime (e.g., information indicating a criminal
their use of Twitter, such as account access information, transaction information, and other
account information.
to require Twitter to disclose to the government copies of the records and other information
(including the content of communications) associated with the accounts in Attachment A and
23
the items described in Section II of Attachment B.
CONCLUSION
82. Pursuant to 18 U.S .C. § 2703(g), the presence of a law enforcement officer is not
REQUEST FOR SEALING
~AmyArson~
Special Agent
Subscribed and sworn to before me on this(; ~ay of November, 2017.
&~~
24
ATTACHMENT A
All information that is associated with the Twitter profile with usernames from the period
from July 1, 2015 to the present:
@Wikileaks (twitter.com/wikileaks) (Target Account 1)
@JulianAssange(twitter.com/JulianAssange) (Target Account 2)
that is stored at premises owned, maintained, controlled, or operated by Twitter, a company
headquartered in San Francisco, California.

ATTACHMENT B
custody, or control of Twitter, including any messages, records, files, logs, or information that
have been deleted but are still available to Twitter, or have been preserved pursuant to a request
made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following information to the
government for each account listed in Attachment A:
a. All identity and contact information, including full name, e-mail address, physical
address (including city, state, and zip code), date of birth, gender, hometown,
occupation, and other personal identifiers;
b. All past and current usernames, account passwords, and names associated with
the account;
c. The dates and times at which the account and profile were created, and the
Internet Protocol ("IP") address at the time of sign-up;
d. All IP logs and other documents showing the IP address, date, and time of each
login to the account;
e. All data and information associated with the profile page, including photographs,
"bios," and 'profile backgrounds and themes;
f. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the
account, and all photographs or images included in those Tweets and Direct
Messages;
g. All information from the "Connect" tab for the account, including all lists of
Twitter users who have favorited or retweeted Tweets posted by the account, as
well as a list of all Tweets that include the usemame associated with the account
(i.e., "mentions" or "replies");
h. All photographs and images in the user gallery for the account;
1. All location data associated with the account, including all information collected
by the "Tweet With Location" service;
J. All information about the account' s use ofTwitter's link service, including all
longer website links that were shortened by the service, ·all resulting shortened
links, and all information about the number of times that a link posted by the
account was clicked;
k. All data and information that has been deleted by the user;
I. A list of all of the people that the user follows on Twitter and all people who are
following the user (i.e., the user' s "following" list and "followers" list);
m. A list of all users that the account has "unfollowed" or blocked;
n. All "lists" created by the account;
o. All information on the " Who to Follow" list for the account;
p. All privacy and account settings;
q. All records of Twitter searches performed by the account, including all past
searches saved by the account;
r. All information about connections between the account and third-party websites
and applications;
2
s. All records pertaining to communications between Twitter and any person
regarding the user or the user' s Twitter account, including contacts with support
services, and all records of actions taken, including suspensions of the account.
3
II. Information to be seized by the government
All information described above in Section I that constitutes fruits, evidence, and
instrumentalities of violations of 18 U .S.C. § 1030 (fraud and related activities in connection
with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting) since
March 1, 2016 including, for each user ID identified on Attachment A, information pertaining to
the following matters:
a. Any correspondence regarding hacked emails or other data from:
1. the Democratic National Committee (DNC)
11. the email belonging to John Podesta ("the email hack")
111. any other individual related to the 2016 United States election.
b. Any communications between the Target Accounts and individuals
associated with the DNC email hack;
c. Any communications indicating any advance knowledge or direction,
planning, or control of the email hack;
d. Any communications related to the website PutinTrump.Org.
e. Evidence indicating how and when the Twitter account was accessed or used,
to determine the chronological and geographic context of account access, use,
and events relating to the crime under investigation and to the Twitter account
owner;
f. Evidence indicating the Twitter account owner's state of mind as it relates to
the crime under investigation;
4
g. The identity of the person(s) who created or used the user ID, including
records that help reveal the whereabouts of such person(s).
h. The identity of the person(s) who communicated with the accounts about
matters related to 18 U.S.C. § 1030, including records that help reveal their
whereabouts.
5
AO 93 (Rev. I l/13) Search and Seizure Warrant
UmrBI STATBS DTSTruCT COURT

for the

Case: 1'.17-mj-00982
)
or identify the person by name and address) )
Assigned To . Howell, BerylA.
) Assign. Date : 1211912017
)

of the following person or propefty located in the Northern District of California
(identify the person or describe the property to be searched and give its location)',
See Attachment A
described above, and that such search will reveal Qdentifu the person or describe the property to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before January 2, 2018 fuot to exceed t 4 days)
ilf in the daytime 6:00 a.m. to 10:00 p.m. ü at any time in the day or night because good cause has been established.
person from whom, or from whose premises, the propefty was taken, or leave the copy and receipt at the place where the
property was taken.
as required by law and promptly return this warrant and inventory to Hon. BervlA. Howell
(United States Magisffate Judge)
üPursuant to 18 U.S.C. $ 3103a(b), I find that immediate notification may have an adverse result listed in l8 U.S'C'
$ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized þheck the appropriate box)
fl for_days (nottoexceed30) il until,thefactsjustifying,thelaterspecificdateof
Date and time issued: 2ù/ ¿//h //ntu

Judge's signature
City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
AO 93 (Rev. I l/13) Search and Seizure Wanant (Page 2)
Return
Case No.: Date and time warrant executed Copy of warrant and inventory left with
Inventory made in the presence of
Inventory ofthe properfy taken and name ofany person(s) seized:
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing ffi cer's s ignature

AO l0ó (Rev. 04/10) Application t-or a Search Warrant
UmreD STATES DrsrRrcr Counr

0Ec Í e 20P
for the
Disfrict of Columbia ûlerk,
üourts å:-å5iifiåjÍ#,ffiffi*
In the Matter of the Search of Case: 1'.17-mi-O0982
or identify the person by name and address) Assigned To : Howell, BerYlA.
INFORMATION ASSOCIATED WTH
Assign. Date : 1211912017

, l, à federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to believe that on the followiñg person or prdperty (identifu the person or describe the
See Attachment A.
located in the Northern District of California , there is now concealed (dentifu the
person or describe Íhe property to be seized)i
See Attachment B.
This warrant is sought pursuant to l8 U.S.C. $$ 2703(a), 2703(bX1XA), and 2703(cXlXA).
The basis for the search under Fed. R. Crirn. P. a I (c) is (check one or more):
devidence of a crime;
dcontraband, fruits of crime, or other items illegally possessed;
dproperry designed for use, intended for use, or used in committing a crime;
ü a person to be arrested or a person who is unlawfully restrained.
Code Section
18 U.S.C. S 1030 F ra ud a nd re ated activiti es h !#{:&3:iííK33i 0r,"'.,
I
18 U.S.C. S 371; 2 Conspiracy against the United States; Aídíng and abetting
52 U.S.C. S 30121 Foreign contribution ban
f, Continued on the attached sheet.

f, Delayed notice of _...._ days (give exact ending date if more than 30 days ) is requested
under l8 U.S.C. $ 3 I 03 a, the basis of which is set forth on the attached sheet.
Reviewed by AUSA/SAUSA Applicant's signature
Aaron Zelinsky (ASC) Amy Anderson, Special Agent, FBI

Date: 12t19t2017 %2",æ

's signature
City and s1¿1s; Washington, D'C Hon. BerylA. Howell, Chief U.S. District J udge
FTI.EÞ
IN THE UNITED STATES DISTRICT COURT DEC Ig 20t7
FOR THE DISTzuCT oF'r-oT IT]\IRIÁ
case: 1 :1 7-mj lfå?åTifrå:fffi#mil:' -

IN THE MATTER OF THE SEARCH OF 'onrpffi*
BerYlA.
Assigned To : Howell,
INFORMATION ASSOCIATED WITH :
Assign. Date 1211912017
I, Amy A. Anderson, being first duiy sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT B ACKGROIINT)
information associated with the following email account (hereafter the Target Account),
described in more detail in Attachments A and B:
o (the "Target Account") an email address associated
with , described further in Attachment A, maintained by
Google;
The information to be disclosed by Google (hereafter "the Provider") and searched by the
government is described in the following paragraphs and in Attachments A and B. This affidavit
is made in support of an application for a search warrant under 18 U.S.C. $$ 2703(a),
27 03 (b)(I)(A), and 2703 (cX 1 XA).
well as national security.threats and appiicable criminal violations
3. The facts in this affidavit come fi'om my personal observations, my training and
to show merely that there is sufficient probable cause ftrr the requested warrant and does not set
there is probable cause to believe that the Target Account contáins communications relevant to
violations of 18 U.S.C. $ 1030 (fraud and related activities in connection with computers), 52
U.S.C. $ 30121 (foreign contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense
against the United States), and 18 U.S.C. $ 2 (aiding and abetting).
JURISDICTION
competent jurisdiction" as deftned by 18 U.S.C. ç2711. /d. $$ 2703(a), (bX1XA), & (cX1XA).
such a courl) . . . that has jurisdiction over the offense being investigated." 18 U.S.C.
$ 2711(3XAXi). The offense conduct included activities in Washington, D.C., as detailed below,
including in paragraph 1 1.
SUMMARY
6. On or about July 25,2016, Roger STONE emailed Jerome CORSI to "Get to
Assange" in person at the Ecuadorian Embassy and "get pending Wikileaks emails[.]" On or
about August I,2016, STONE also instructed CORSI to have (the user of
tlre Target Account) contact Julian ASSANGE. On or about August 2,2016, CORSI responded
2
to STONE that the "word is fi'iend in embassy IASSANGE] plans 2 more dumps. One shortly
after I'm b ack. 2nd in October. Impact planned 1o be. very .damaging. .. . Time to let Podesta to be
exposed as in bed w enemy if they are not ready to drop I{RC." Information disclosures
subsequently occurred on or about the times CORSI predicted: On or about August 12,2016, the
day CORSI was scheduled to return to the United States ("shortly after I'm back"), Guccifer 2.0
released hacked information related to the Democratic Congressional Campaign Committee
(DCCC). On October 7 ,2016 ("in October"), Wikileaks began releasing emails hacked from
John Podesta's email account.
7. On or about November 13,2016, , using the Target Account,
emailed Stone to congratulate him on "tak[ing] the country back," and stating, "You deserve a
lot of credit and working with you and Jeri Corsi, who is with me now in London has been a
great joy." On or about January 7,2017, using the Target Account emailed
recipients about John Podesta going "phishing."
PROBABLE CAUSE.
A. Background on Relevant Individuals
i. Roger STONE
8. Roger STONE is a self-employed political strategist/consultant and has been
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official
relationship with the Campaign thereafter, STONE maintained his support for Trump and
continued to make media appearances in support of Trump's presidential campaign. As
described further below, STONE also maintained contact with individuals employed by the
J
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick
.GATES
ii. Jerome CORSI
g. Jerome CORSI is a political commentator who, according to publicly available
information, serves as the "'Washington Bureau Chief for Inforwars.com." According to
publicly-available sources, from2014 until January 2017, CORSI was a "senior staff reporter"
for the website "World Net Daily" a"/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described fuither below, CORSI was in
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of
hacked information by Wikileaks, and appears to have obtained information regarding
upcoming disclosures which he relayed to STONE.
iii.
10.
4
B. Disclosure of Hacked Information by Wikileaks During the 2016 Presidential

Campaign
1 1. According to the public and unclassified intelligenòe report prepared by the
United States Intelligence Community, Russian intelligence gained access to the Democratic
National Committee (DNC) networks in July 2015 and maintained that access until at least June
2016. By March 20I6,the Russian military intelligence (General Staff Main Intelligence
Directorate or "GRU") probably began cyber operations aimed atthe U.S. election. The GRU
operations resulted in the compromise of personal e-mail accounts within the DNC and other
Democratic Party officials and political figures. By in or about }/ray 20ï6, the GRU had
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South
Capitol Street SE, Washington, D.C. 20003.
12. The public and unclassified intelligence report assessed that:
a. The GRU used a Twitter account, "Guccifer 2.0" andthe website
DCleaks.com to release the U.S. victim data obtained in cyber operations publicly and in
exclusives to media outlets and relayed material to Wikileaks.
b. Guccifer 2.0, who claimed to be an independent Romanian hacker, made
multiple contradictory statements and false claims about his likely Russian identity
throughout the election.
c. Content that was taken from e-mail accounts targeted by the GRU in
March 2016 appeared on DCleaks.com starting in June 2016.
5
d. The GRU relayed material it acquired from the DNC and senior
Democratic officials to Wikileaks. Wikileaks .was mostly likely, chosen.because of its
self-proclaimed reputation for authenticity. Disclosures through Wikileaks did not
contain any evident forgeries.
e. The Kremlin's principal international propaganda outlet RT (formerly
Russia Today) has actively collaborated with Wikileaks. RT's editor-in-chief visited
Wikileaks founder Julian ASSANGE at the Ecuadorian Embassy in London in August
z}I3,where they discussed renewing his broadcast contract with RT, according to
Russian and Vy'estern media. Russian media has subsequently announced that RT had
become "the only Russian media company" to partner with V/ikileaks and had received
access to "new leaks of secret information."
13. On or about June 14, 2016, the Washington Post reported that "Russian
government hackers" had penetrated the DNC computer network and stole opposition research
on Donald J. Trump. The Kremlin's spokesman denied any Russian involvement in the hack.
14. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack
and began posting hacked documents.
15. On or about JuIy 22,20ì6,V/ikileaks published about 20,000 emails stolen from
the DNC.
16. On or about August 12,2016, Guccifer 2.0 released personal cellphone numbers
and email addresses from the files of the Democratic Congressional Campaign Committee
(DCCC).
17. On or about August 2I,2016, Roger STONE sent a publicly-available tweet
referring to John Podesta, Hillary Clinton's presidential campaign manager, stating: "Trust me, it
6
will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that
,same day, Stone reiterated that because of the work of a "imutual acquaintancel.of both his and
[Assange], the public fcould] expect to see much more from the exiled
whistleblower in the form
of strategically-dun'rped Clinton email batches." He added: "'Well, first of all, I think Julian
Assange is a hero... I think he's taking on the deep state, both Republican and Democrat. I
18. On Friday, October 7,2016,at approximately 4:03 P.M., the V/ashington Post
published an article containing a recorded conversation from a2005 Access Hollywood shoot in
lg. Approximately a half hour later, at 4:32 P.M., Wikileaks sent out a public Tweet
reading "RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing
a link to approxim ately 2,050 emails that had been hacked from John Podesta's personal email
account. V/ikileaks continued to release John Podesta's hacked emails throughout October 10-
14,2016.
C. Roger STONE's Private Twitter Messagbs with Guccifer 2.0, Wikileaks, and Julian
ASSANGE.
20. As discussed above, on or about July 22,2016, Wikileaks published
approximately 20,000 emails stolen from the DNC.
21. On August 5,2076,Roger Stone published an article on Breitbart.com entitled,
ooDear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." Stone wrote: "It doesn't
Guccifer 2.0."
7
22. On August 12,2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
u believe in the,leal #Guccifer2." That same day, Guccifer 2.0 released the personal cellphone
Committee (DCCC).
'¿3. On August l3,2olti, Stone posted a tweet using @RogerJStoneJr calling Guccifer
2.0 a "HERO" after Guccifer 2.0 hadbeen banned from Twitter. The next day, Guccifer 2.0's
24. On August 14,20l6,Stone sent a private message on Twitter using
@RogerJStoneJr to Guccifer 2.0, stating he was "delighted" to see the user's Twitter
handle
reinstated after having been suspended.l
25. On August 15,2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating:
"wow. thank u for writing back, and thank u for an article about me!!! did you find an¡hing
26. On August 16,2016, Stone sent a private message using @RogerJStoneJr asking
Guccifer to retweet an article he had written regarding the 'rigg[ing]' of the 2016 presidential
elections.
27. On August 17,2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJr paying you
back." Guccifer also sent a private message to @RogerJStoneJr stating "i'm pleased to say u r
great man. please tell me if I can help u anyhow. it would be a greatpleasure to me."
28. On August 18,2016, Paul Manafoft, Stone's longtime friend and associate,
I On or about August7,2017, Chief Judge Beryl A. Howell issued a search warant for the Twitter account
@RogerJStoneJr.
8
toward Ukrairre.
29. On August 2L,2016, using @RogerJStoneJR, Stone directed a tweet at John
lsicl Podesta's time in the barrel. #CrookedHillary."
3 1 . On Saturday, October 1,2016, using @RogerJStoneJr, Stone Tweeted,
"Wednesday @ Hillary Clinton i s done. #Wiki Leaks. "
32. On Sunday, October 2,20\6,MSNBC Morning Joe producer Jesse Rodriquez
tweeted regarding an announcement Julian Assange had scheduled for the next day from the :
which was part of V/ikileaks' 1O-year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load."
33. On Tuesday, October 4,2016, Stone used @RogerJStoneJr to tweet: "Payload
coming. #Lockthemup."
34. As discussed above, on Friday, October 7,2016, Wikileaks began to release
emails that had been hacked from John Podesta's personal email account.
35. On or about October 12,2016, John Podesta - referring back to Stone's August
2I,2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that fStone] had advanced warning [of the release of his
emails] and the Trump campaign had advanced warning about what Assange was going to do. I
9
think there's at least a reasonable belief that fAssange] may have passed this information on to
him or that I have aclvanced knowledge of the specifics of what he is going to do. I do believe he
36. On or about the next day, Octòber 13, 2016, @RogerJStoneJr sent a private direct
message to the Twitter account @Wikileaks. The message read: "Since I was all over national
TV, cable and pri.nt defending Wikileaks and assange against the claim that you are Russian
agents and debunking the false charges of sexual assault as trumped up bs you may want to
rexamine the strategy of attacking me- cordially R." Less than an hour later, @wikileaks
responded by direct message: "We appreciate that. However, the false claims of association are
being used by the democrats to undermine the impact of our publications. Don't go there if you
don't want us to correct you."
37. On October 16,2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!
38. On November 9,2016, one day after the presidential election, @wikileaks sent a

ooWe
followed up with another message less than a minute later: are now more free to
communicate."
10
39 . On March 70, 2Al7 , Stone spoke with The Washington Times and acknowledged
Washington Times.
40. On or about March 27 ,2017 ,CNN reported that a representative of Wikileaks,
writing from an email address associated with'Wikileaks, denied that there was any backchannel
communication during the Campaign between Stone and Wikileaks. The same article quoted
Stone as stating: "Since I never communicated with Wikileaks, I guess I must be innocent of
or scope oftheir subsequent disclosures. So I am clairvoyant orjust a good guesser because the
4I. On or about June 4, 2017,@RogerJStoneJr directly messaged @JulianAssange,
an address associated with Julian Assange in numerous public reports, stating: "Still nonsense.
As a journalist it doesn't matter where you get information only that it is accurate and authentic.
The New York Times printed the Pentagon Papers which were indisputably stolen from the
government and the courts ruled it was legal to do so and refused to issue an order restraining the
paper from publishing additional articles. If the US government moves on you I will bring down
the entire house of cards. V/ith the trumped-up sexual assault charges dropped I don't know of
any crime you need to be pardoned for - best regards. R." That Same day, @JulianAssange
responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
11
42. On or about June i0, 2017, @RogerJStoneJr sent a direct message to @wikileaks,
reading: "l am doing everything possible to address the issues at the highest level of
Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this
D. Roger S'l'ONl-'s !-maits with Jerome CORSI and

43. On September 11, 2017 " Chief Judge Beryl A. Howell of the District of Columbia
issued a search warant for STONE's l address, Emails
recovered pursuant to that search warrant indicated the following:
44. On or about June 20, 20|6, , using the Target Account, emailed
STONE and Paul MANAFORT, the Campaign Chairman, asking to "know imrnediately how I
can help" the Campaign. also wrote that his "research on Rhodes House" was
nearing completion. The "Rhodes House" research appears to be a reference to STONE's
previous tweet on or about October T3,2015 that, "In 1969, Bill Clinton was expelled from
Oxford for raping nineteen-year-old ." Rhodes House is the headquarters of the
Rhodes Trust, and STONE mentioned again to a month later, as
discussed below.
45. On or about luly 7,2016, , using the Target Account, emailed Stone
that he had "my tickets to Cleveland[.] [D]o you have my credential pack?" appears
to be referencing the Republican National Convention held in Cleveland.
46. On or about July 25,20ì6, , using the Target Account, forwarded
an email to STONE and CORSI with the subject line: "Fwd: The Bill Gates of Turkey wants to
createa campaign for Donald J Trump in Turkey." wrote: "Do you want to have a
talk about this? Turkey is for Trump!" Below was a forwarded message sent to the Target
12
Account from an individuat who stated that he had been contacted by the "Bill Gates of Turkey,
in regards to creating a robust campaign for Mr Donald J Trump'"
47. On or about that same day, .Tuly 25,2016, (approximately three days after
Wikileaks began releasing emaiis hacked from the DNC), emailed Roger
STONE with the subject line, "You need to get to Assange." The body of the message read: "At
Ecuadorian Embassy in London and get the pending wikileaks emails...they deal with
Foundation, allegedly."
48. According to records , approximately ninety
minutes later STONE called CORSI and they spoke for 26 minutes.
49. Less than two hours after the phone call to CORSI, STONE emailed CORSI at
with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending Wikileaks emails...they deal with Foundation,
allegedly." It appears that STONE cut and pasted the email from to CORSI.
50. On or about July 27,2016, then-candidate Donald Trump stated in a press
conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if
that happens. That will be next."
51. On or about July 28, 2016, Roger STONE called Richard GATES (then the
deputy-chair of the Campaign). The two spoke for approximately twelve minutes.
52. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the
Campaign) called STONE. The two spoke for approximately one hour and seven minutes. The
Government has analyzedtoll records from January 1,2016 to November 9,2016. Sixty-seven
13
minutes is the longest call (by almost a halÊhour) that took place between STONE and
MANAFORT in this time period.
53. On or about July 31,2016, STONE called GATES and the two spoke for
approximately 5 minutes. Approximately ninety minutes later, STONE emailed CORSI at with
the subject [ine, "Call me MON."'l'he tsody read: should see Assange[.]
should find Bemie sanders brother who called Bill a Rapist - turn him for Trump[.]
should find or more proof of Bill getting kicked out."
54. On or about August 2,2016(approximately 19 days before STONE publicly
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE: "V,/ith family, 25th
wedding anniversary Aug 9. Return Home Aug12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2ndinOct. Impact planned to be very damaging . . .Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
o'friend in embassy
case, it appears that CORSI's reference to a [who] plans 2 more dumps"
refers to Julian ASSANGE; the founder of Wikileaks, who resided in Ecuador's London
Embassy in2016. As discussed above, Guccifer released information hacked from the DCCC on
August 12,2016 (the date CORSI identified as when he would "return home.").
55. On or about August 16,2016, CORSI, emailed STONE a link to a piece CORSI
had written about STONE titled, "Trump Adviser: Wikileaks Plotting Email Dump to Derail
Hillary."
T4
56. On or about August 3I,2016, CORSI, using emailed STONE: "Did you get the
. Podesta writeup." STONE replied "yes."
57. On or about September 6,2016, CORSI, emailed STONE: "Roger[,] Is NY Post
going to use the Pedesta [sic] stuff?"
58. On or about October 7,2016, Wikileaks began releasing the Podesta emails.
59. On or about October 12,2016,the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE with the
subject line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that,
"Podesta is at the heart of a Russian-government money laundering operation that benefits
financially Podesta personally and the Clintons through the Clinton Foundation." CORSI
followed up several minutes later with another email to STONE titled, "Podesta talking points,"
with the text "sent a second time just to be sure you go it." STONE emailed CORSI, "Got them
and used them."
60. On or about October 17,2016, CORSI emailed STONE with the subject, "Fwd:
ASSANGE...URGENT..." CORSI wrote, 'oFrom a very trusted source," and forwarded an email
they move to extradite him. My guess is that he has a set of dead man files that include Hillary.
It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he'd dead anyway, once he's dropped what he has. If HRC wins, Assange can
kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's bluff and
raised him the election."
15
6I. On or about November 1,2016, , using the Target Account, emailed
CORSI and STONE with the subject: "Turkey is a'GO'- FULL GREEN LIGHT."
wrote: "My good friend Husyein will be caking [sic] you he is in the Presidents office. The call
is a go. He has all the information you and DJT need for an article and another October surprise."
CORSI emailed back to the'l'arget Account and S'I'ON.tr: "And I have everything in progress
for a phone call tomorrow with DJT. I'm working with Roger Stone to accomplish this Roger
-
is copied above so he is up to date on status."
62. On or about November 2,20\6, using the Target Account, wrote to
STONE and CORSI: "The message from President Erdogan has been sent to you for DJT has
just been sent wrapped in an article about baseball as header. If there is a response please let me
know."
63. On or about November 13,2016, , using the Target Account,
emailed Stone. wrote, o'Well, we did it and now have an opportunity of a lifetime to
take the country back. God is good and we are well placed to steer things well. You deserve a lot
of credit and working with you and Jeri Corsi, who is with me now in London has been a great
joy."
64. On or about January 7,2017 , emailed STONE, and
(using the Target Account) with the subject line, "in case you need his
mail. . ......." Attached to the message was a scan of a business card for John Podesta. Several
hours later, , using the Target Account, replied to all recipients, "Ha... maybe he
wants to go phishing with us?"
65. I know from my training and experience that the term'ophishing" is used to refer
I6
E. Use of the Target Account to Communicate with Other Campaign

Officials
66. According to documents produced by the Campaign (both voluntarily
) has used the Target Account to correspond with
individuals throughout the Campaign. For example, on or about October 23,2015, ,
using the Target Account, emailed
stated that "[it] was so good talking to you earlier in the week it has sustained me all week.
-
Thank you for your contribution to this campaign and to our great country. I look forward to
working with you on a host of things."
67. On or about February 28,2016, , using the Target Account, emailed
, with the subject line "Trump on Putin." The text of the
message read: "Pass this to Donald," and contained an article by CORSI about how Putin
"fear[ed] impact on his plans if Trump takes victory."
68. On or about April4, 20ì6,
to introduce an individual who was interested in working with the Trump Campaign.
69. On or about }r/ray 25,2016, emailed the Target Account about a book
he was "toying with the idea of writing." wrote back noting that, "Roger Stone is
getting me on the list to go to Cleveland [the site of the Republican National Convention]."
70. On or about August 30, 106 , using the Target Account, emailed
Steve BANNON to report that he had been writing ¿'op-eds" and strategy pieces, "laboring non
stop for the Trump campaign even though I am all the way over here in Oxford."
T7
wïote that he had been "in constant touch with the campaign, Roger Stone, and Jeri Corsi."
suggested a "clever idea for . . . the first debate." In his idea, then-candidate Trump
would present then-candidate Clinton with a "Writ of Indictment," for "undeniable crimes
against America, destruction of evidence in the form of mails, and theft of funds to your own
personal benefit and enrichment."
71. On or about October 25,2016, , using the Target Account, emailed
regarding a piece had written about how
BACKGROUND CONCERNING EMAIL
72. In my training and experience, I have learned that the Providers provide avatiety
of on-line services, including electronic mail ("email") and search engines (in the case of Google
and Yahoo), to the public. The Providers allow subscribers to obtain email accounts at the
domain names identified in the email addresses contained in Attachment A. Subscribers obtain
an account by registering with the Providers. During the registration process, the Providers ask
subscribers to provide basic personal information. Therefore, the computers of the Providers are
likely to contain stored electronic communications (including retrieved and unretrieved email)
for their subscribers and information concerning subscribers and their use of services, such as
account access information, email transaction information, and account application information.
In my training and experience, such information may constitute evidence of the crimes under
investigation because the information can be used to identify the account's user or users.
provide certain personal identif ing information when registering for an email account. Such
18
payment (including any credit or bank account number). In my training and experience, such
informatio \ may constitute evidence of the crimes under investigation because the information
can be used to identify the account's user or users. Based on my training and my experience, I
often provides clues to their identit¡', location' or illicit activities'
74. tn my training and experience, email providers typically retain certain
of log-in (l.e., session) times and durations, the types of service utilized, the status of the account
(including whether the account is inactive or closed), the methods used to connect to the account
(such as logging into the account via the provider's website), and other log files that reflect usage
of the account. In addition, email providers often have records of the Internet Protocol address
("IP address") used to register the account and the IP addresses associated with particular logins
to the account. Because every device that connects to the Internet must use an IP address, IP
address information can help to identify which computers or other devices were used to access
the email account.
communÍcate directly with an email service provider about issues relating to the account, such as
retain records about such communications, including records of contacts between the user and
the provider's support services, as well as records of any actions taken by the provider or user as
a result of the communications. In my training and experience, such information may constitute
I9
76. As explained herein, information stored in connection with an email account may
provide crucial evidence of the "who, what, wh¡t, when, where, and how" of the criminal conduct
alternatively, to exclude the innocent from further suspicion. In my training and experience, the
infiormation stored in connection with an email account can indicate who has used or controlled
the account. This "user attribution" evidence is analogous to the search for "indicia of
or used. For example, as described below, email providers typically log the Internet Protocol
(IP) addresses from which users access the email account, along with the time and date of that
access. By determining the physical location associated with the logged IP addresses,
information stored at the user's account may fuither indicate the geographic location of the
account user at a particular time (e.g.,location information integrated into an image or video sent
via email). Last, stored electronic datamay provide relevant insight into the email account
the email account may indicate the owner's motive and intent to commit acúme (e.g.,
20
communications relating to the crime), or consciousness of guilt (e.g., deleting communications
in an effort to conceal them fiom law enforcement).
77. In my training and experience, information such as search history can help to
show the state of mind of an individual atthe time the search was made, as well as the
individuals potential advance knowledge of events, as they search to see if the anticipated event
has occurred.
INFORMATION TO BE SEARCHED AND THING TO BE SEIZED
.
Act, in particular 18 U.S.C. $$ 2703(a),2703(b)(l)(A) and 2703(c)(I)(A), by using the warrant
particularly described in Section I of Attachment B. Upon receipt of the information described
in Section I of Attachments B, government-authorized persons will review that information to
locate the items described in Section II of Attachment B. The items identified in Attachments A
will also be screened by reviewers not on the prosecution team to identify and filter out
privileged material.
CONCLUSION
79. STONE instructed CORSI to "Get to Assange" at the Ecuadorian Embassy
regarding upcoming leaks. STONE then instructed CORSI to have (the user of the
Target Account) talk to ASSANGE. CORSI subsequently emailed STONE that'oword is friend
in embassy IASSANGE] plans 2 morc dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." Two releases, one from Guccifer and the other from
2T
Wikileaks, occuned at the times predicted by CORSI. CORSI later emailed STONE "talking
points" about Podesta. In January, (using the Target Account), STONE, and
CORSI received an email from an individual regarding Podesta, and wrote back,
using the Target Account, "Ha... maybe he wants to go phishing with us?"
80. Based on the forgoing, I request that the Court issue the proposed search warant.
81. Pursuant to 18 U.S.C. $ 2703(g), the presence of a law enforcement officer is not
nnQunsr ron snÀuNi

documents because their premature disclosure may seriously je opardízethat investigation.
E.
Special Agent
Subscribed and sworn to before me on tn¡, Íl1of Decemb er,2017

22
ATTACHMENT A
1.
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043'
23
ATTACHMENT B
I. Files and Accounts to be produced by the Provider:
custody, or control of the Provider including any messages, records, files, logs, images, videos,
or information that have been deleted but are still available to the Provider or have been
preserved pursuant to a preservation request under 18 U.S.C. $ 2703(Ð, the Provider is required
to disclose the following information to the government for each account or identifier listed in
Attachment A:
time at which each e-mail was sent, and the size and length of each e-mail;
c All internet search data including all queries and location data;

andlor locations;



electroniç mail address described above in Section I.A.;
24
il. Information to be Seized by Law Enforcement Personnel
a. Any and all records that relate in any way to the account described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations of l8 U.S.C. $ 1030
(fraud and related activities in connection with computers), 52 U.S.C. $ 30121 (foreign
contribution ban), 18 U.S.C. $ 371 (conspiracy to commit an offense against the United
States), and 18 U.S.C. g 2 (aiding and abetting) for the period from January 1,2015 to the
present, including:
a. All records, information, documents or tangible materials that reiate in any

way to communications regarding hacking, release of hacked material, communications
with persons or entities associated with Wikileaks, including but not limited to Julian
Assange;
b. All records, information, documents or tangible materials that relate in any

way to communications or meetings between , Jerome Corsi, Roger
Stone, and individuals associate with Wikileaks or Turkey;
b. All images, messages? communications, calendar entries, search terms,

and contacts, includingaîy and all preparatory steps taken in fuitherance of the above-
listed offenses;

e. All images, messages and communications regarding wiping software,

All "address books" or other lists of contacts.
25
IN THE LINITED STATES DISTRICT COURT

FOR THE DISTRICT OF' COI,I IMRIA
Case: 1.17-mj-0o982
IN THE MATTER OF THE SEARCH OF
Assigned To : Howell, BerylA.
TNFORMATION ASSOCI-ATED WITH
MOTION TO SEAL W ARRANT AND REI,ATEI) IMtr,NTS AND

2705
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notiffing any person of the Warrant pursuant to 18 U.S.C. $ 2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further ãrder of the Court.
JURISDICTION AND LEGAL BACKGROUND
l. The Court has the inherent power to seal court fìlings when appropriate,
including the Warrant. lJnited States v. Hubbard,650 F.2d 293, 31 5- l6 (D.C. Cir. 1980) (citing
Nixonv. llarner Communications, 1nc.,435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warranf . See lI/ashington Post v. Robinson, 935 F .2d 282,287 -89 (D.C. Cir. 1991).
2. In addition, this Court has jurisdiction to issue the requested order because it is'oa
court of competent jurisdiction" as defined by 18 U.S.C. ç 2711. Specifically, the Court is a
"district court of the United States . . . that - has jurisdiction over the offense being investigated."
l8'U.S.C. ç2711(3XAXi). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occurred within Washington, D.C. See 18 U.S.C. ç 3237.
3. Further, the Court has authority to require non-disclosure of the Warrant under l8
U.S.C. $ 2705(b). Google provides an "electronic communications service," as defined in l8
U.S.C. $ 2510(15), and/or "remote computing service," as defined in 18 U.S.C.ç 271l(2). The
Stored Communications Act ("SCA"), 18 U.S.C. çç2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, court order, or search
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic
"subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other
"non-content" information using a court order, and Section 2703(a)-(bXlXA) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. 5 2703.
4. The SCA does not set forth any obligation for providers to notify subscribers about
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary,
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such
notification. In relevant part, Section 2705(b) provides as follows:l
(b) Preclusion of notice to subject of governmental access. A governmental

entity acting under section 2703 .. . may apply to a court for -
an order commanding
a provider of electronic communications service or remote computing service to
whom a warrant, subpoena, or court order is directed, for such period as the court
deems appropriate, not to noti$ any other person of the existence of the warrant,
subpoena, or couft order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will resultin-
(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
I Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
$ 2703(bX I )(B), but the Government does not seek to use the proposed Order for any legal
process
under that provision.
2
(3) destruction of or tampering with evidence;

(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying atrial
18 U.S.C. $ 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [slc] fìnds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under $ 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under $ 2705(b), the court is required to
issue the non-disclosure order.
In re Applicationfor Order of Nondisclosure Pursuant to I8 U.S.C. S 2705(b) for Grand Jury
Subpoena #GJ2014031422765,41 F. Supp. 3d l, 5 (D.D.C. 2014).
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Couft.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6. At the present time, law enforcement officers of the FBI are conducting an
investigation into violations related to 1S U.S.C. $ 1030 (fraud and related activities in connection
with computers), 52 U.S.C. $ 30121 (foreign contribution ban), l8 U.S.C. $ 371 (conspiracy to
commit an offense against the United States), and 18 U.S.C. $ 2 (aiding and abetting), arising out
of the conduct of Roger Stone, , and others. The investigation in ongoing, and
individuals associated with these offenses are not aware of the investigation. If they are made
awaro of the existence and contents of this search warrant, they may seek to delete additional
information contained in online platforms or otherwise destroy records related to the investigation.
3
REOUEST FOR SEALING AND NON-DISCLOSURE
7 . In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may aleft these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potentialtargets would
be immediately prompted to destroy or conceal incriminating evidence, alter their operational
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potentia I targetcould quickly and easily destroy or encrypt digital
evidence relating to their criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notif, the Court and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. ,See l8 U.S.C.
$ 2705(bX2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
compelling governmental interest in confidentiality to justify the government's sealing request.
See Robinson, 935 F.2d at 287 -8g.
10. Based on prior dealings with Google the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
of the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and fufthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or
until further order of the Court.
Respectfully subm itted,
ROBERT S. MUELLER, III

Special Counsel
Dated: lzlltt¿r,l? By:

Aaron S.J.
The Spec 's Office
(202)-s 37
5
FTI.EÞ
DEC I g 20r
IN THE trNtrED STATES DISTRICT COURT ctsrk, u,s. Disrricr & Bankrunrcv
FOR THE DISTRICT oF COt.I IMRTA {;ourté for ttreÐistrietof Cotirünlia:
Case: 1 .17 -mj-A0982

Assigned To : Howell, BerylA.
Description: Search and Seizure Warrani
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application arrd affidavit in support thereof (collectively the "Warrant"),
and to require Google, an electronic communication and/or remote computing service s
headquartered at 1600 Amphitheatre Parkway, Mountain View, California not to disclose the
existence or contents of the Warrant pursuant to l8 U.S.C. $ 2705(b)'
The Court finds that the United States has established that a compelling governmental
interest exists tojustiS the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate
witnesses. See t8 U.S.C..$ 2705(bX2)-(5).
IT IS TIIEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
IT IS FURTHER ORDERED that, pursuant to l8 U.S.C. $ 2705(b), Google and its
or the Warrant to any ôtliei' þilrion' (eiðêþt
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until
further order of the Court.
THE HON LE BERYL A. HOWELL

CHIEF UNITED STATES DISTRICT JUDGE
J /f talf
2

for the

(Briefly describe the property to be searched ) Case: 1:18-sc-00662
Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH VARIOUS APPLE ) Assign. Date : 3/14/2018
ACCOUNTS ) Description: Search & Seizure Warrant
)

See Attachment A.
described above, and that such search wi 11 reveal (identify the person or describe the property to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before March 28, 2018 (not to exceed 14 days)
property was taken.
as required by law and promptly return this warrant and inventory to Hon. Be I A. Howell
0 Pursuant to 18 U .S.C. § 3103a(b), I find that immediate notification may have an adverse result Iisted in 18 U .S.C.
0 for _ _ days (not to exceed 30) •
until, the facts justifying, the later specific date of
Date and time issued: ;:;/J f/ Z£J ;g a,;f ~ 'f_zf;n_ __~-----~t'/_•~-¼

-~---- - Judge 's signature
- -- - - - - - -- - - - Printed name and title
AO 93 (Rev. l J/13) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:
Certification
designated judge.
Date:
Executing officer's signature

ATTACHMENT A
This warrant applies to information associated with the following Apple Accounts:
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business
with offices located at 1 Infinite Loop, Cupertino, California 95014.
26
ATTACHMENT B
I. Information to be disclosed by Apple
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
a. All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers, email addresses (including primary,
alternate, rescue, and notification email addresses, and verification information for each email
address), the date on which the account was created, the length of service, the IP address used to
register the account, account status, methods of connecting, and means and source of payment
(including any credit or bank account numbers);
b. All records or other information regarding the devices associated with, or used in
connection with, the account (including all current and past trusted or authorized iOS devices
and computers, and any devices used to access Apple services), including serial numbers, Unique
Device Identifiers ("UDID"), Advertising Identifiers ("IDF A"), Global Unique Identifiers
("GUID"), Media Access Control ("MAC") addresses, Integrated Circuit Card ID numbers
("ICCID"), Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
27
Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber
Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers
("MSISDN"), International Mobile Subscriber Identities ("IMSI"), and International Mobile
Station Equipment Identities ("IMEI");
c. The contents of all emails associated with the account, including stored or
preserved copies of emails sent to and from the account (including all draft emails and deleted
emails), the source and destination addresses associated with each email, the date and time at
which each email was sent, the size and length of each email, and the true and accurate header
information including the actual IP addresses of the sender and the recipient of the emails, and
all attachments;
d. The contents of all instant messages associated with the account, including stored
or preserved copies of instant messages (including iMessages, SMS messages, and MMS
messages) sent to and from the account (including all draft and deleted messages), the source and
destination account or phone number associated with each instant message, the date and time at
which each instant message was sent, the size and length of each instant message, the actual IP
addresses of the sender and the recipient of each instant message, and the media, if any, attached
to each instant message;
,.
e. The contents of all files and other records stored on iCloud, including all iOS
device backups, all Apple and third-party app data, all files and other records related to iCloud
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address
28
books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
device settings, and bookmarks;
f. All activity, connection, and transactional logs for the account (with associated IP
addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g. All records and information regarding locations where the account was accessed,
including all data stored in connection with Location Services;
h. All records pertaining to the types of service used;
1. All records pertaining to communications between Apple and any person
regarding the account, including contacts with support services and records of actions taken; and
J. All files, keys, or other information necessary to decrypt any data produced in an
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and
fileinfolist.txt files).
29
All records, information, documents or tangible materials that relate in any way to
Julian Assange;

listed offenses;

e. All images, messages and communications regarding w1pmg software,

30
AO I 06 (Rev 04/10) App lication for a Search Warran t
UNITED STATES DISTRICT COURT MAR f 4 2018

for the
_Glerk, U.S. District & Bankruptcy
In the Matter of the Search of ) Case: 1: 18-sc-00662

(Briefly de.rcrih the proper/JI rob.~ .1·eardred )
or idem ify 1h person by na111e ar,d address)
)
INFORMATION ASSOCIATED WITH VARIOUS APPLE ) Assign. Date : 3/14/2018
ACCOUNTS ) Description: Search & Seizure Warrant
)

See Attachment A.
located in the District of
Northern
- -- - - -- -
- - ----- , there is now concealed (identify the
-- - --California
See Attachment B.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A), and 2703(c)(1 )(A).
ref evidence of a crime;
ref contraband, fruits of crime, or other items illegally possessed;
rJ property designed for use, intended for use, or used in committing a crime;

ode Section Offense Description
18 U.S.C. §§ 2, 3, 4, 371, 1343 Aiding & Abetting (§2); Accessory after the Fact (§3); Misprison of a Felony (§4);
and 1349; and Conspiracy (§371 ); Computer Fraud (§1030); Wire Fraud (§1343); Attempt and
52 U.S.C. § 30121(a)(1)(C) Conspiracy to Commit Wire Fraud (§1349); and Foreign Expenditure Ban (§30121)

0 Delayed notice of days (give exact ending date if more than 30 days: ) is requested
under 18U.S.C.§3103a, the basis of which is set forth on the attached sheet.
&-4 /44~
!Aaron Zelinsky (ASC)

= Curtis Heide, Special Agent, FBI
Date: 3/14/2018
Judge 's signature
IN THE UNITED STATES DISTRICT COURT MAR 14 2018

Clerk , -·-· 1~+•/~• • a .
,, c: ..,,oo v, a anM. t
Court11 tor th ·District at·Col~~ik-----
IN THE MATTER OF THE SEARCH OF Case: 1: 18-sc-00662
INFORMATION AS SOCIA TED WITH Assigned To : Howell, Beryl A,
VARIO US APPLE ACCOUNTS Assign . Date : 3/14/2018
I, Curtis Heide, being first duly sworn, hereby depose and state as follows:
INTRODU TION AND AGENT BACKGROUND
information associated with the following Apple Accounts:
with offices located at llnfinite Loop, Cupertino, California 95014. The information to be
disclosed by Apple and searched by the government is described in the following paragraphs and
in Attachments A and B. This affidavit is made in support of an application for a search warrant.
2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of
investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.

---- - - - -----there is-probable-Gause-t0-believe-that-the-T'-arget--Accounts--00ntain--eommunications relevant-to -- - --- - ---- -
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy),, 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349
(attempt and conspiracy to commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution
ban) (the "Subject Offenses"). 1
5. As set forth below, Roger STONE communicated directly via Twitter with
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used to disseminate hacked
information. STONE, using his Account, also emailed instructions to Jerome CORSI to
"Get to Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]"
CORSI emailed STONE back that it was "Time to let more than Podesta to be exposed" (before
any of Podesta's emails were leaked). After Podesta's emails were leaked, CORSI emailed
STONE "talking points" about Podesta. CORSI also emailed Stone to convey information "from
a very trusted source" regarding Julian ASSANGE, WikiLeaks, and potential future disclosures.
BANNON also sent text messages to STONE discussing potential upcoming leaks by
ASSANGE. The Target Accounts are STONE's iCloud accounts, which are registered to the
email accounts STONE used to communicate with CORSI.
JURISDICTION
1
Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent
expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id. § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").
2
------- ----c-0mpetent-jur-isdieti0n?2-as-de-fined--by-l--8--{:1.,.S"G,--§--2'.7-l--l--,-/da-§~-2-70J(aj,fbj(--1-)E-A0,&-(-G-)E-I-)(Aj.
§ 271 l(J)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
PROBABLE CAUSE
A. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed
Hacking Activity during the 2016 Presidential Election
7. On October 7, 2016, the U.S. Department of Homeland Security and Office of the
Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. 2 In the report, the USIC
assessed the following:
8. The U.S. Intelligence Community (USIC) is confident that the Russian
Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are
intended to interfere with the US election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to
2
"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 20 I 6, available at ttps://www.dhs.gov/news/2016/10/07 /joint-statement-department-
homeland-security-and-office-director-national.
3
influence public opinion there. We believe, based on the scope and sensitivity of these efforts,
- -that-only Russia's senior-most officials could have authorized these activities
9. On January 6, 2017, the USIC released a declassified version of an intelligence
assessment of Russian activities and intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US Elections." 3 In the report, the USIC
10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
at the US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her
electability and potential presidency. We further assess Putin and the Russian Government
developed a clear preference for President-elect Trump."
11. In its assessment, the USIC also described, at a high level, some of the techniques
that the Russian government employed during its interference. The USIC summarized the efforts
as a "Russian messaging strategy that blends covert intelligence operations-such as cyber
activity-with overt efforts by Russian Government agencies, state-funded media, third-party
intermediaries, and paid social media users or 'trolls."'
12. With respect to hacking activity, the USIC assessed: "Russia's intelligence
services conducted cyber operations against targets associated with the 2016 US presidential
election, including targets associated with both major US political parties." In addition, "In July
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks
and maintained that access until at least June 2016." The USIC further assessed that cyber
3 "Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_2017 _ 0 l .pdf.
4
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU)
"resulted in the compromise of the personal e-mail accounts of Democratic Paiiy officials and
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
13. With respect to the release of stolen materials, the USIC assessed "with high
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
release US victim data obtained in cyber operations publicly and in exclusives to media outlets."
1. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with j oumalists.
A. Roger Stone's Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via
· hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June,
5
the DNC.
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian
6
Committee (DCCC).
toward Ukraine.
Stone reiterated that because of the work of a "'mutual acquaintance' of both his and [Assange],
7
"Wednesday@ HillaryClinton is done. #WikiLeaks."
which was part of WikiLeaks' 10-year anniversary celebration - Stone told Info wars that his
inten,nediary described this release as the "mother load." On Tuesday, October 4, 2016, Stone
"RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer" and containing a link
10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone's August 21, 2016 C-
SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
8
Assange, we have a mutual friend who ' s traveled to London several times, and everything I
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser·because the
B. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
Twitter account @RogerJStoneJr.
21. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the hacked
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
9
23. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: "Ha!
communicate."
25. In addition, @RogerJStoneJr also exchanged direct messages with Julian
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
messaged @JulianAssange, an address associated with Julian Assange in numerous public
reports, stating: "Still nonsense. As a journalist it doesn't matter where you get information only
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were
indisputably stolen from the government and the courts ruled it was legal to do so and refused to
issu~ an order restraining the paper from publishing additional articles. If the US government
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault
charges dropped I don't know of any crime you need to be pardoned for - best regards. R." That
same day, @JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to
squeeze us into a deal."
10
@wikileaks, reading: "I am doing everything possible to address the issues at the highest level of
C. Roger Stone's Private Email and Text Messages Regarding WikiLeaks, Julian
Assange, Russia, and John Podesta
27. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
issued a search warrant for STONE's address, . On October
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE's address,
. Information recovered pursuant to those search warrant indicated the
following:
28. On July 25, 2016, STONE sent an email from his Account to Jerome
CORSI, an author and political commentator, with the subject line, "Get to Assange." The body
of the message read: "Get to Assange [a]t Ecuadorian Embassy in London and get pending
WikiLeaks emails ... they deal with Foundation, allegedly."
tweeted about "Podesta's time in the barrel"), CORSI emailed the Account, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to
be very damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much
of next dump focus, setting stage for Foundation debacle." Based on my training, experience,
and review of materials in this case, it appears that CORSI's reference to a "friend in embassy
11
[who] plans 2 more dumps" refers to Julian AS SAN GE, the founder of WikiLeaks, who resided
in Ecuador's London Embassy in 2016.
30. On or about August 5, 2016, , an associate of STONE's emailed
him a link to a poll indicated that Clinton lea Trump by 15 points. STONE responded "enjoy it
while u can[.] I dined with my new pal Julian Assange last night." subsequently
stated to investigators that, around the same time, STONE told him he had gone to London to
meet ASSANGE. also stated that in 2018, told STONE he would be
interviewed by the FBI and would have to divulge the conversation about meeting AS SAN GE.
STONE told he was joking and had not actually met Assange.
31. On or about August 16, 2016, CORSI emailed STONE a link to a piece CORSI
had written about STONE titled, "Trump Adviser: WikiLeaks Plotting Email Dump to Derail
Hillary."
32. On August 19, 2016, Bannon sent Stone a text message asking ifhe could talk
that morning. On August 20, 2016, Stone replied, "when can u talk???"
33. On or about August 31, 2016, CORSI emailed STONE: "Did you get the Podesta
writeup." STONE replied "yes."
34. On September 4, 2016, Stone texted Bannon that he was in New York City for a
few more days, and asked if Bannon was able to talk.
35. On or about September 6, 2016, CORSI emailed STONE: "Roger[,] Is NY Post
going to use the Pedesta [sic] stuff?"
36. On September 7, 2016, Stone and Bannon texted to arrange a meeting on
September 8, 2016 at the Warner Center in New York.
12
37. On September 7, 2016, Bannon texted Stone asking him ifhe could "come by
trump tower now???"
38. On September 8, 2016, Stone and Bannon texted about arranging a me~ting in
New York.
39. On October 3, 2016, an associate of Stone emailed Stone and asked: "Assange -
what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he doesn't call me
back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled." The
associate forwarded the email to Bannon and wrote: "You should call Roger. See below. You
didn't get from me." Bannon wrote back, "I've got important stuff to worry about." The
associate responded, "Well clearly he knows what Assange has. I'd say that's important."
40. On or about October 4, 2016, ASSANGE gave a press conference at the
Ecuadorian Embassy. There had been speculation in the press leading up to that event that
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, ASSANGE promised more documents, including
information "affecting three powerful organizations in three different states, as well as, of course,
information previously referred to about the lJ.S. election process." AS SAN GE also stated that
WikiLeaks would publish documents on various subjects every week for the next 10 weeks, and
vowed that the U.S. election-related documents would all come out before Election Day.
41. Later that day, BANNON emailed STONE, "What was that this morning???"
STONE replied, "Fear. Serious security concern. He thinks they are going to kill him and the
London police are standing done [sic]." BANNON wrote back, "He didn't cut deal w/
clintons???" Stone replied, "Don't think so BUT his lawyer is a big democrat."
13
42. When BANNON spoke with investigators during a voluntary proffer on February
14, 2018, he initially denied knowing whether the October 4, 2017 email to STONE was about
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
BANNON had been hoping for releases of damaging information that morning.
44. On or about October 12, 2016, the same day on which Podesta accused STONE of
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the
email accounts, with a subject line "Podesta talking points." Attached to the email was a file
labeled, "ROGER STONE podesta talking points Oct 12 2016.docx." The "talking points"
included the statement that "Podesta is at the heart of a Russian-government money laundering
operation that benefits financially Podesta personally and the Clintons through the Clinton
Foundation." CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you go it." STONE emailed
CORSI back via the Account, "Got them and used them."
45. On or about October 17, 2016, CORSI emailed the STONE with the subject,
"Fwd: AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded
an email with the header information stripped out, showing only the body text. The email read,
"Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on
them if they move to extradite him. My guess is that he has a set of dead man files that include
Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if Trump speaks out
to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins,
14
Assange can kiss his life away. Interesting gambit Assange has to play out. He's called Podesta's
bluff and raised him the election."
46. On or about January 7, 2017, emailed STONE, CORSI, and
with the subject line, "in case you need his mail. ........ " Attached to the
message was a scan of a business card for John Podesta. Several hours later, replied
to all recipients: "Ha ... maybe he wants to go phishing with us?"
D. STONE's Recent Public Statements Regarding Contact with Assange
48. As described above, STONE stated that on October 12, 2016 that he was in
contact with ASSANGE via a "a mutual friend who's traveled to London several times," and that
"everything I know is through that channel of communications."
49. On March 13, 2018, the Washington Post published an article about STONE's
previous claims of contact with Assange. 4 The cited an anonymous source who claimed to have a
conversation with STONE in the "spring of 2016" where STONE indicated that he had learned
from "Julian Assange that his organization had obtained emails that would torment senior
Democrats such as John Podesta," and that the conversation occurred before it became publicly
known that hackers had obtained the "emails of Podesta and of the Democratic National
4
https://www.washingtonpost.com/politics/roger-stone-claimed-contact-with-wikileaks-founder-julian-assange-in-
20 l 6-according-to-two-associates/20 l 8/03/l 3/a263 f842-2604- l l e8-b79d-t3d93 I db7f68_ story.html?hpid=hp_rhp-
top-table-main_ stone-656am%3Ahomepage%2Fstory
15
Committee." The article also cited statements that STONE stated he had spoken to
ASSANGE. The article cited STONE denying any advance notice about the hacked emails or
any "contact with Assange." The Article stated that STONE "said he only recalled having one
conversation with anyone in which he alluded to meeting the WikiLeaks founder - a comment he
said he made as a joke to Nunberg." STONE was quoted as stating, "The allegation I met with
Assange, or asked for a meeting or communicated with Assange, is provably false."
50. The article also stated that STONE told the House Intelligence Committee in
September 2017 that his August 21 tweet was meant as a prediction that Podesta's business
opportunities would come under scrutiny after Paul MANAFORT was forced to resign amid
allegations about his work for a pro-Russian party in Ukraine. MANAFORT resigned from the
Campaign on or about August 19, 2016. CORSI's email to STONE about WikiLeaks and "Time
to let more than Podesta to be exposed as in bed w_enemy if they are not ready to drop HRC,"
occurred on August 2, 2016, over two weeks before MANAFORT's resignation.
E. STONE's use of the Target Accounts
51. On November 21, 2017, Chief Judge Beryl A. Howell signed an order pursuant to
18 U.S.C. §2703(d) for header information related to the Target Accounts. Pursuant to that
order, Apple prov_ided the following information:
52. Target Account 1 has the Apple ID , an email address
associated with STONE discussed above. The associated email address is
. The company registered as the account user is Citroen Associates, a
company linked to STONE by investigators. Additionally, the "rescue email" is
, which is STONE's account. IP login information shows that the
account was in use as of the time of the service of the Order According to Apple, the system has
16
been set to a "Full iCloud" backup. I know from my training and experience that a full iCloud
backup can include other databases and messaging features, including third party messaging
programs. Often individuals are unaware that the information is being stored in their iCloud, and
therefore the iCloud may contain additional communications not contained in the standard mail
accounts. STONE's email account ( ) also contains messages regarding
his iCloud account, including an indication that iCloud storage was "full." STONE also used
Target Account 1's associated iCloud email account, , to send an email
in March, 201 7.
53. Target Account 2 has the Apple ID , an email address
associated with STONE. Target Account 2 is registered to "Roger Stone," and according to
information provided by Apple pursuant to the§ 2703(d) order, contains a full iCloud backup as
well. The account is currently locked.
INFORMATION REGARDING APPLE ID AND iCLOUD 5
54. Apple is a United States company that produces the iPhone, iPad, and iPod
Touch, all of which use the iOS operating system, and desktop and laptop computers based on
the Mac OS operating system.
The information in this section is based on information published by Apple on its website, including, but
not limited to, the following document and webpages: "U.S. Law Enforcement Legal Process Guidelines," available
at htlp://images.applc.com/ privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://suppo11.apple.co111/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/;
"iCloud: iCloud storage and backup overview," available at https://suppo1i.apple.com/kb/PT-l l 25 L9; and "iOS
Security," available at lmp://images.app le.com/privacy/docs/iO, Security Guide.pdf.
17
55. Apple provides a variety of services that can be accessed from Apple devices or,
in some cases, other devices via web browsers or mobile and desktop applications ("apps"). As
described in further detail below, the serv,ices include email, instant messaging, and file storage:
a. Apple provides email service to its users through email addresses at the
domain names mac.com, me.com, and icloud.com.
b. iMessage and FaceTime allow users of Apple devices to communicate in
real-time. iMessage enables users of Apple devices to exchange instant messages ("iMessages")
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to
conduct video calls.
c. iCloud is a file hosting, storage, and sharing service provided by Apple.
iCloud can be utilized through numerous iCloud-connected services, and can also be used to
store iOS device backups and data associated with third-party apps.
d. iCloud-connected services allow users to create, store, access, share, and
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user
to share those images and videos with other Apple subscribers. iCloud Drive can be used to
store presentations, spreadsheets, and other documents. iCloud Tabs enables iCloud to be used
to synchronize webpages opened in the Safari web browsers on all of the user's Apple devices.
iWorks Apps, a suite of productivity apps (Pages, Numbers, and Keynote), enables iCloud to be
used to create, store, and share documents, spreadsheets, and presentations. iCloud Keychain
18
enables a user to keep website usemame and passwords, credit card information, and Wi-Fi
network information synchronized across multiple Apple devices.
e. Game Center, Apple's social gaming network, allows users of Apple
devices to play and share games with each other.
f. Find My iPhone allows owners of Apple devices to remotely identify and
track the location of, display a message on, and wipe the contents of those devices.
g. Location Services allows apps and websites to use information from
cellular, Wi-Fi, Global Positioning System ("GPS") networks, and Bluetooth, to determine a
user's approximate location.
h. App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and dow11loaded through App Store on iOS devices, or
through iTunes Store on desktop and laptop computers running either Microsoft Windows or
Mac OS. Additional digital content, including music, movies, and television shows, can be
purchased .through iTunes Store on iOS devices and on desktop and laptop computers running
either Microsoft Windows or Mac OS.
56. Apple services are accessed through the use of an "Apple ID," an account created
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID
can be linked to multiple Apple services and devices, serving as a central authentication and
syncing mechanism.
57. An Apple ID takes the form of the full email address submitted by the user to
create the account; it can later be changed. Users can submit an Apple-provided email address
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a
19
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user
accesses and responds to a "verification email" sent by Apple to that "primary" email address.
Additional email addresses ("alternate," "rescue," and "notification" email addresses) can also be
associated with an Apple ID by the user.
58. Apple captures information associated with the creation and use of an Apple ID.
During the creation of an Apple ID, the user must provide basic personal information including
the user's full name, physical address, and telephone numbers. The user may also provide means
of payment for products offered by Apple. The subscriber information and password associated
with an Apple ID can be changed by the user through the "My Apple ID" and "iForgot" pages on
Apple's website. In addition, Apple captures the date on which the account was created, the
length of service, records of log-in times and durations, the types of service utilized, the status of
the account (including whether the account is inactive or closed), the methods used to connect to
and utilize the account, the Internet Protocol address ("IP address") used to register and access
the account, and other log files that reflect usage of the account.
59. Additional information is captured by Apple in connection with the use of an
Apple ID to access certain services. For example, Apple maintains connection logs with IP
addresses that reflect a user's sign-on activity for Apple services such as iTunes Store and App
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
also maintains records reflecting a user's app purchases from App Store and iTunes Store, "call
invitation logs" for FaceTime calls, and "mail logs" for activity over an Apple-provided email
20
account. Records relating to the use of the Find My iPhone service, including connection logs
and requests to remotely lock or erase a device, are also maintained by Apple.
60. Apple also maintains information about the devices associated with an Apple ID.
When a user activates or upgrades an iOS device, Apple captures and retains the user's IP
address and identifiers such as the Integrated Circuit Card ID number ("ICCID"), which is the
serial number of the device's SIM card. Similarly, the telephone number of a user's iPhone is
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may
maintain records of other device identifiers, including the Media Access Control address ("MAC
address"), the unique device identifier ("UDID"), and the serial number. In addition,
information about a user's computer is captured when iTunes is used on that computer to play
content associated with an Apple ID, arid information about a user's web browser may be
captured when used to access services through icloud.com and apple.com. Apple also retains
records related to communications between users and Apple customer service, including
communications regarding a particular Apple device or service, and the repair history for a
device.
61. Apple provides users with five gigabytes of free electronic space on iCloud, and
users can purchase additional storage space. That storage space, located on servers controlled by
Apple, may contain data associated with the use of iCloud-connected services, including: email
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWorks and iCloud Drive); and
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain).
iCloud can also be used to store iOS device backups, which can contain a user's photos and
21
videos, iMessages, Short Message Service ("SMS") and Multimedia Messaging Service
("MMS") messages, voicemail messages, call history, contacts, calendar events, reminders,
notes, app data and settings, and other data. Records and data associated with third-party apps
may also be stored on iCioud; for example, the iOS app for WhatsApp, an instant messaging
service, can be configured to regularly back up a user' s instant messages on iCloud. Some of
this data is stored on Apple's servers in an encrypted form but can nonetheless be decrypted by
Apple.
62. In my training and experience, evidence of who was using an Apple ID and from
where, and evidence related to criminal activity of the kind described above, may be found in the
files and records described above. This evidence may establish the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the United States to
establish and prove each element or, alternatively, to exclude the innocent from further
suspicion.
63. The stored communications and files connected to an Apple ID may provide
direct evidence of the offenses under investigation. For example, stored iMessage
communications, voicemails, and emails may contain conversations with foreign government
officials similar to those described above in PAPADOPOULOS 's Linkedin and Gmail accounts.
Based on my training and experience, instant messages, emails, voicemails, photos, videos, and
documents are often created and used in furtherance of criminal activity, including to
communicate and facilitate the offenses under investigation.
64. In addition, the user's account activity, logs, stored electronic communications,
and other data retained by Apple can indicate who has used or controlled the account. This "user
22
search warrant at a residence. For example, subscriber information, email and messaging logs,
documents, and photos and videos (and the data associated with the foregoing, such as geo-
location, date and time) may be evidence of who used or controlled the account at a relevant
time. As an example, because every device has unique hardware and software identifiers, and
because every device that connects to the Internet must use an IP address, IP address and device
identifier information can help to identify which computers or other devices were used to access
the account. Such information also allows investigators to understand the geographic and
chronological context of access, use, and events relating to the crime under investigation.
65. Account activity may also provide relevant insight into the account owner's state
of mind as it relates to the offenses under investigation. For example, information on the account
may indicate the owner's motive and intent to commit a crime (e.g., information indicating a
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort
to conceal evidence from law enforcement).
66. Other information connected to an Apple ID may lead to the discovery of
additional evidence. For example, the identification of apps downloaded from App Store and
iTunes Store may reveal services used in furtherance of the crimes under investigation or
services used to communicate with co-conspirators. For instance, ifthere are secured and
encrypted communication applications downloaded from the App Store, that can show an
attempt to hide information from investigators. In addition, emails, instant messages, Internet
activity, documents, and contact and calendar information can lead to the identification of co-
conspirators and instrumentalities of the crimes under investigation.
23
67. Therefore, Apple's servers are likely to contain stored electronic communications
and information concerning subscribers and their use of Apple's services. In my training and
experience, such information may constitute evidence of the crimes under investigation including
information that can be used to identify the account's user or users.
CONCLUSION
68. STONE instructed CORSI to "Get to Assange" at the Ecuadorian Embassy
regarding upcoming leaks, and CORSI emailed Stone on the Account that it was "Time
to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC."
STONE also texted and emailed BANNON about potential forthcoming leaks from ASSANGE
and WikiLeaks. There is therefore probable cause to believe that evidence of the DNC hack and
the hacking of other emails associated with the 2016 election will be found in the information
associated with the Target Accounts.
24
REQUEST FOR SEALING
, ·t. 4 - d/{,,. . .
• ----
li-s-Heide
Special Agent
Federal Bureau oflnvestigation
Subscribed and sworn to before me on this d .faf of March, 2018.
~;/~
The Honorabl Beryl A. Howell
25
ATTACHMENT A
This warrant applies to information associated with the following Apple Accounts:
with offices located at 1 Infinite Loop, Cupertino, California 95014.
26
ATTACHMENT B
custody, or control of Apple, including any messages, records, files, logs, or information that
have been deleted but are still available to Apple, or have been preserved pursuant to a request
made under 18 U.S.C. § 2703(f), Apple is required to disclose the following infonnation to the
government, in unencrypted form whenever available, for each account or identifier listed in
Attachment A:
register the account, account status, methods of connecting, and means and source of payment
(including any credit or bank account numbers);
27
all attachments;
,.
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks
(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address
28
books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails,
device settings, and bookmarks;
addresses including source port numbers), including FaceTime call invitation logs, mail logs,
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs
associated with web-based access of Apple services (including all associated identifiers);
g. All records and information regarding locations where the account was accessed,
including all data stored in connection with Location Services;
1. All records pertaining to communications between Apple and any person
J. All files, keys, or other information necessary to decrypt any data produced in an
29
Julian Assange;

listed offenses;

e. All images, messages and communications regarding w1pmg software,

30
AO 93 (Rev. l l/13) Search and Seizure Warrant

for the
In the Matter of the Search of Case: 1:18-sc-01518

(Briefly describe the property to be searched Assigned To : Howell, Beryl A.
or identify the person by name and address)
Assign. Date: 5/4/2018
INFORMATION ASSOCIATED WITH THE GOOGLE Description: Search & Seizure Warrant
ACCOUNT ,
)

See Attachment A.
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before May 18, 2018 (not to exceed 14 days)
';$ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
property was taken.
property, will be searched or seized (check the awropriate box)

Judge 's signature
AO 93 (Rev 11/13) Search and Seizure Warrant (Page 2)
Return
Inventory made in the presence of :
Certification
I declare under penalty of pe1jury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:


Cferk, U.S. District & Bankrupicy
FOR THE DISTRICT OF COLUMBIA Gourts for tirn District of Columbl&

THE GOOGLE ACCOUNT
ORDER
documents, including the application and affidavit in support thereof (collectively the "Warrant"),
and to require Google LLC, an electronic communication and/or remote computing services with
headquarters in Mountain View, California, not to disclose the existence or contents of the Warrant
pursuant to !8 U.S.C. § 2705(b).
interest exists to justify the requested sealing, and that there is reason to believe that notification
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
and
Page 1 of2
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its
employees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year unless
otherwise ordered by the Court.
THE HONORABLE BERYL A. HOWELL

Date
41/Y>lf
Page 2 of2
AO 106 (Rev. 04/10) Application for a Search Warrant

for the MA\t !,
•'II·\! • ·r 2018
,,t,c,rk, U.S. District & Bankruptcy
In the Matter of the Search of . ,,gurt~ lar 1hli-•D1strlctof Gollf/nh]•
) C ase.1:18-sc-01518 ·'
) Ass!gned To: Howell, Beryl A
) Assign. Date: 5;412018 ·
INFORMATION ASSOCIATED WITH THE GOOGLE )
ACCOUNT Description: Search & Seizure Warrant
)

property to be searched and give ifs location):
See Attachment A.
located in the Northern District of _____C,-_a-,.l"'if.=o,..rn~ia..__ _ _ , there is now concealed (identijj, the
See Attachment B.
ief contraband, fruits of crime, or other items illegally possessed;
r'lf property designed for use, intended for use, or used in committing a crime;
D a person to be arrested or a person who is unlawfully restrained.
18 U.S.C. § 2 aiding and abetting
· et al. see attached affidavit
r;/ Continued on the attached sheet.

D Delayed notice of _ _ days (give exact ending date if more than 30 days: ______ ) is requested
~44 Appbcant's signature
•Aaron Zelinsky (Special Counsel's Office) Andrew Mitchell, Supervisory Special Agent, FBI
Date:
UNITED STATES DISTRICT COURT MAY · · ti 1018

FOR THE DISTRICT OF COLUMBIA Clerk, LLS. District & Bar1i<ruptcy
Gourts !or tirn District of Co\urntHfl
Case: 1:18-sc-01518
THE GOOGLE ACCOUNT Assigned To : Howell, Beryl A
Assign. Date: 5/4/20 18
AFFIDAVIT IN SUPPORT OF AN
I, Andrew Mitchell, having been first duly sworn, hereby depose and state as follows:
information associated with the following Google Account: (hereafter
the "Target Account 1"), that is stored at premises owned, maintained, controlled or operated by
Google, Inc., a social networking company headquartered in Mountain View, California
("Google"). The information to be searched is described in the following paragraphs and in
Attachments A and B. This affidavit is made in support of an application for a search warrant
under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and 2703(c)(l)(A)to require Google to disclose to
the government copies of the information (including the content of communications) further
described in Attachment A. Upon receipt of the information described. in Attachment A,
government-authorized persons will review that information to locate the items described in
Attachment B.
2. I am a Special Agent with the Federal Bureau of Investigation (FBI), and have
been since 2011. As a Special Agent of the FBI, I have received training and experience in
investigating criminal and national security matters.
there is probable cause to believe that the Target Accounts contain communications relevant to
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision ofa felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a
false statement); 18 U.S.C. §1651 (perjury); 18 U.S.C. § 1030 (unauthorized access ofa
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to
commit wire fraud),, and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"). 1
5. As set forth below, in May 2016, Jerome CORSI provided contact information for
to Roger STONE. In July 2016, also told STONE that he
needed to meet with then-candidate Trump "alone." In August 2016, told STONE
that there was an "OCTOBER SURPRISE COMING" and that Trump, "[i]s going to be defeated
unless we intervene. We have critical intel." In that same time period, STONE communicated
directly via Twitter with WikiLeaks, Julian AS SANGE, and Guccifer 2.0. On July 25, 2016,
STONE emailed instructions to Jerome CORSI to "Get to Assange" in person at the Ecuadorian
Embassy and "get pending WikiLeaks emails[.]" On August 2, 2016, CORSI emailed STONE
back that,"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging." On August 20, 2016, CORSI told STONE that they
needed to meet with. to determine "what if anything Israel plans to do in Oct."
1
Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent
expenditure in connection with federal elections. 52 U.S.C. § 3012l(a)(l)(C); see also id § 30101(9) & (17)
(defining the terms "expenditure" and "independent expenditure").
2
(the Target Account) is Google Account, which
used to communicate with STONE and CORSI.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a comt of
competent jurisdiction" as defined by l8 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
such a court) ... that has jurisc\iction over the offense being investigated." 18 U.S.C.
§ 271 l(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
PROBABLE CAUSE
A. U.S. Intelligence Community (USIC) Assessment of Russian Government-

Backed Hacking Activity during the 2016 Presidential Election
7. On October 7, 2016, the U.S. Department of Homeland Security and the Office of
the Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 20 l 6 presidential election. In the report, the USIC
assessed the following, with emphasis added:
Government directed the recent compromises of e mails from US persons and institutions,
including from US poiitical organizations. The recent disclosures of alleged hacked e mails on
sites like DC Leaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
3
that only Russia's senior-most officials could have authorized these activities.
9. On January 6, 2017, the US[C released a declassified version of an intelligence
"Assessing Russian Activities and Intentions in Recent US Elections." In the repoti, the USIC
10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
11. The USIC also described, at a high level, some of the techniques that the Russian
government employed during its interference. The USIC summarized the efforts as a "Russian
messaging strategy that blends coveti intelligence operations-such as cyber activity-with
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries,
and paid social media users or 'trolls.'"
12. With respect to "cyber activity," the USIC assessed that "Russia's intelligence
election, including targets associated with both major US political parties." Further, "[i]n July
and maintained that access until at least June 2016." The USIC attributed these cyber activities to
the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in
the compromise of the personal e-mail accounts of Democratic Party officials and political
4
figures. By May, the GRU had exfiltrated large volumes of data from the DNC." The GRU is the
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia's largest
foreign intelligence agency.
confidence that the GRU used the Gucci fer 2.0 persona, DCLeaks.com, and WikiLeaks to
14. Gucci fer 2.0, who claimed to be an independent Romanian hacker, made multiple
contradictory statements and false claims about his identity throughout the election.
B. · Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks.
continued to make media appearances in support of Trump's presidential campaign. On August
7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account
@RogerJStoneJr.
the DNC.
5
.· October surprise, what would be your forecast on that given what Julian Assange has intimated
Committee (DCCC).
6
Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
Stone reiterated that because of the work ofa '"mutual acquaintance' of both his and [Assange],
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
7
26. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted,
"Wednesday@ HillaryC!inton is done. #WikiLeaks."
which was part of WikiLeaks' 10-year anniversary celebration - Stone told lnfowars that his
29. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading
10-21, 2016. On October 12, 2016, John Podesta- referring back to Stone'~ August 21, 2016 C-
SP AN and Twitter references - argued publicly that "[it is J a reasonable assumption to - or at
8
charges I knew about the hacking of Podesta's email·(speculation and conjecture) and the timing
C. · Roger Stone's Private Twitter Direct Messages with WikiLeaks and Jnlian
Assange.
32. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked
9
34. On October 16, 2016, @RogerJStoneJr sent a direct message to@wikileaks: "Ha!
communicate."
messaged @JulianAssange, an address associated with Julian Assange in.numerous public
issue an order restraining the paper from publishing additional articles. If the US government
JO
D. Emails with Stone and Corsi
issued a search warrant for STONE's address, On October
On March 14, 2018, Chief Judge Beryl A. Howell issued a search
warrant for STONE's iCloud account. On April 23, 2018, Chief Judge Beryl A. Howell signed
an order pursuant to 18 U.S.C. §2703(d) for the Target Accounts. Information recovered
pursuant to those search warrants and orders indicated the following:
40. On or about February 2 and February 3, 2016, using Target
Account 1, sent two emails to , an email address associated with
II
41. On or about February 5, 2016, received two emails on Target
Account l from an account associated with
42. On or about April 6, 2016, CORSI and (on Target Account 1)
exchanged seven emails. On or about April 7, CORSI email on Target Account
1. On or about April 8, 2016, mailed CORSI. On or about April 10,
and CORSI exchanged two emails. On or about April 18, 2016, CORSI sent
an email.
43. On or about May 1, 2016, CORSI emailed (on Target Account 1)
three times and sent him two responses. On or about May 2, 2017,
(on Target Account 1) emailed CORSI.
44. On or about May 17, 2016, STONE emailed Jerome CORSI, "send me e-
mail address." CORSI wrote back, "Roger[,] (Target
Account 1) also seems to work as "4
45. That same day, STONE emailed at Target Account 1. STONE
wrote that he would have to move "our meeting to Wednesday. I am uncomfortable meeting
without Jerry." As described further below, it appears that "Jerry" is Jerome CORSI. STONE
and exchanged additional emails about setting up dinner, and
emailed back, "RS[,] Confirming dinner Wednesday at 7PM at Club 21, JC included."
46. On or about that same day, May 17, 2016, n Target Account 1,
emailed CORSI.
47. On or about June 3, 2016, CORSI emailed on Target Account 1.
E. Stone, and Corsi's Text Messages about "October Surprise" and

"Critical Intel."
4
The period in a email account is not read as a character. Therefore, and
are the same account.
12
48. On or about May 17, 2016, messaged STONE, "Hi Roger, I hope
all is well. Our dinner tonight for 7PM is confirmed. I arrive at 4PM. Please suggest a good
restaurant that has privacy. Thank you. See you soon, " STONE responded,
'See e-mail."
49. On or about May 19, 2016, messaged STONE, "Hi Roger, It Was
Great Seeing You Again Last Night At Dinner. Did You Talk To Trump This Morning? Any
News? Thank You. Best, ." STONE responded, "Contact made - interrupted
- mood good." nd STONE continued to text about arranging a meeting with
then-candidate Trump.
50. On or about.June 21, 2016, messaged STONE, "RS: Secret I
CabinetMinister in NYC Sat. June 25. Available for DJT meeting. " According
to publicly-availabe information, during this time was a Minister without
portfolio in the cabinet dealing with issues concerning defense and foreign affairs.
51. On or about June 25, 2016, messaged Stone, "Roger, Minister left.
Sends greetings from PM. 5 When am I meeting DJT? Should I stay or leave Sunday as planned?
Hope you are well. "
52. On or about June 26, 2016, STONE messaged I am better but
turn out to have been poisoned. Completely out of action for 3 days-apologize to Minister for
me. I would not leave as we hope to schedule the meeting mon or tues."
53. On or about June 28, 2016, messaged STONE, "RETURNING TO
DC AFTER URGENT CONSULTATIONS WITH PM IN ROME.MUST MEET WITH YOU
WED. EVE AND WITH DJ TRUMP THURSDAY IN NYC.
5 Based on statements here and below, I belie-Ve "PM" refers to the" Prime Minister.
13
54. On or about Jun 29, 2016, STONE responded, "Monday meeting collapsed after
DJT cleared his schedule to deal with the money crisis. lam waiting the new schedule. Will try
for Thursday."
55. On or about June 30, 2016, STONE messaged "Revised - meeting
now I pm July 6."
56. On or about July l, 2016, wrote back, "Thank you my friend. I
will plan to be back in NYC on July 5th for the meeting with DJT on the 6'h at l pm.THAY YOU
ROGER." STONE responded, "Sorry this took so long. R."

"·
57. On July 5, 2016, messaged STONE, "Roger, I am here, ready for
the meeting with DJ Trump at 1PM tomorrow. Let's you and I meet at 10.30AM at the St. Regis
Lobby. Thank you. "
58. On July 6, 2016, messaged STONE, "At St Regis With Lt General.
Waiting For You Thank You. " STONE wrote back, " - I am down
with a nasty cold. and too ill to travel- I have a1rnnged for Jerri to take u in at I rather than lose
the appointment- please connect with Jerri - Let me know how the meeting goes .DJT
expecting u. R" Based on STONE's contacts and emails described above, investigators believe
that the "Jerri" referenced in the message refers to Jerome CORSI.
59. wrote back, "Thank U Very Much[.] I Have To Meet Trump Alone
After A Brief Introduction by Jerry Thanks Roger." STONE wrote back, "As long as u get the
meeting-lam very sorry I cannot !jtlend- have a high fever and no voice."
lt<:1
60. On July 8, 2oy
-z.o.1~
essaged STONE, "Hi Roger. Have you
rescheduled the meeting with DJT? The PM is putting pressure for a quick decision. Thank you
for all your help!
14
61. On or about July 8, 2016, STONE wrote back, "T not in NYC again before the
convention. I have pneumonia and may be hospitalized later today. I can get this back on track
post convention when I can attend. Sorry about the fiasco last week, however you can't just bring
the General without tell me - R."
62. On or about July 25, 2016, STONE sent an email from his Account to
Jerome CORSI with the subject line, "Get to Assange." The body of the message read: "Get to
Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with
63. On or about July 29, 2016, sent a messaged to STONE, "HI
ROGER, I HOPE YOU ARE WELL. HAVE YOU SET UP A NEW MEETING WITH
TRUMP? 1 PLAN TO BE BACK IN THE US NEXT WEEK. PLEASE ADVISE. THANK
YOU.
64. On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call
me MON." The body of the email read: " .should see Assange[.] should find
Bernie [S]anders brother who called Bill a Rapist- turn him for Trump[.] should find
or more proof of Bill getting kicked out."
65. On or about August 2, 2016 (approximatelyl9 days before STONE publicly
tweeted about "Podesta's time in the barrel"), CORSI emailed the STONE, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very
damaging ... Time to let more than Podesta to be exposed as in bed w enemy if they are not
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of
next dump focus, setting stage for Foundation debacle." Investigators believe that CORSI's
15
reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian ASSANGE, the
founder of WikiLeaks, who resided in Ecuador's London Embassy in 2016.
'66. On or about August 9, 2016, messaged STONE, "Roger-As per PM
we have one last shot before moving on. Can you deliver? History will not forgive us. TRUMP
IN FREE FALL. OCTOBER SURPRISE COMrNG !
67. On or about August 12, 2016, messaged STONE, "Roger, hello
from Jerusalem. Any progress? He is going to be defoated unless we intervene. We have critical
intell. The key is in your hands! Back in the US next week. How is your Pneumonia? Thank you.
STONE replied, "I am well. Matters complicated. Pondering. R." wrote
back, "Thank You." No additional messages appear in STONE's iCloud between STONE and
until October 30, 2016.
68. As described above, on October 7, 2016, WikiLeaks began releasing the emails
hacked from John Podesta's account.
69. On October 26, 2016, emailed on the Target
Account. On or about October 27, 2016, emailed three
times on the Target Account.
70. On October 30, 2016, messaged S~ONE: "Roger, you are doing a
great job !!! I am in NY-met with DJT and helping. Victory is in sight. HK says hello. Thanks,
71. On Thursday, November 3,'2016, messaged STONE: "Roger,
European country ready to release secret tapes to DESTROY objective. Can we meet ASAP? 4
star General will join. " STONE responded, "Yes let's talk
thurs." wrote back, "Must meet in NYC Thursday AM."
16
72. On or about November 7, 2016 messaged STONE,
"ROGER,JERRY- SORRY, BUT DUE TO AN UNEXPECTED EMERGENCY I HAVE TO
CANCEL TODAY'S MEETING AT 9. THANKS .. HAVING a TIA. Early Stroke."
STONE responded, "Take care of yourself." wrote back, "Tnaks Xou RGer. Blury
Virson." STONE replied, "You can't die until after we elect Donald."
F. Stone's HPSCI Testimony and Subsequent Conversations
73. According to publicly-available reporting, Stone testified before the House
Permanent Select Intelligence Committee (HPSCI) on September 26, 2017. STONE released his
prepared remarks to the media. In his remarks, Stone stated that he had learned Assange was in
possession of the DNC emails via Twitter, and that he asked a "journalist" to "independently
confirm this report." Stone stated his "intermediary" had "assured me that WikiLeaks would
release this information in October and continued to assure me of this throughout the balance of
August and all of September." Stone denied knowledge in advance of Podesta's emails being
hacked. Accordingly to publicly-available news reports, Stone subsequently informed HPSCI
that his .intermediary was Randy Credico, an American radio host.
74. On or about November 24, 2017, Credico .texted Stone, "I told you to watch his
Tweets in October not before that I knew nothing about the DNC stuff. I just followed his
Tweets." Stone responded, "U never said anything about the DNC but it was August." Credico
replied, "It was not August because I didn't interview him or meet him until August 261h."
75. Credico and Stone continued to exchange messages, and on December 1, 2017,
Credico wrote: "I don't know why you had to lie and say you had a back Channel now I had to
give all ofmy forensic evidence to the FBI today what a headache. You could have just told him
the truth that you didn't have a back channel they now know that I was not in London until
17
September of this year. You had no back-channel and you could have just told the truth. You
want me to cover you for perjury now." 6 Stone responded, "What the fuck is your problem?
Neither ofus has done anything wrong or illegal. You got the best press of your life and you can
get away with asserting for 5th amendment rights ifu don't want talk about[.] And if you turned
over anything to the FBI you're a fool." Credico replied, "You open yourself up to six counts of
perjury. But I'm sure that wasn't sworn testimony so you're probably clear ... You should go
back in a minute your testimony and tell them the truth ... You need to amend your testimony
before I testify on the 15 1h." Stone wrote, "If you testify you're a fool. Because of tromp [sic] I
could never get away with a certain [sic] my Fifth Amendment rights but you can. I guarantee
you you are the one who gets·indicted for perjury if you're stupid enough to testify." Stone and
Credico continued to correspond, and according to publicly available news reports, on December
13, 2017, Credi co asse1ted his Fifth Amendment right not to testify before the HPSCI.
76. On January 25, 2018, Credico texted Stone, "You lied to the house Intel
committee. But you'll get off because you're friends with Trump so don't worry. I have. all the
forensic evidence. I was not a ba[ck] Channel and I have all those emails from September of
2016 to prove it."
INFORMATION REGARDING GOOGLE
77. Google provides numerous free services to the users with a Google profile. Some
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging
service that provides both text and voice communication. Google Talk conversation logs are
saved to a "Chats" area in the user's Gmail account. Google+ is a social networking service.
Google Drive is a file storage and synchronization service which provides users with cloud
6 Contrary to his statement, Credico had not provided any information tot.he FBI.
18
storage, file sharing, and collaborative editing. Google+ Photos (fo1merly knowns as Picasa Web
Albums) is an image hosting and sharing web service that allows users with a Google account to
store and share images for free. YouTube is a free video sharing website that allows users
upload, view and share videos. Google also retains a record of searches conducted by the user, as
well as location data for the use of some of the services described above. All of these services
may record information uploaded, inputted, or gathered from the user.
CONCLUSION
19
REQUEST FOR SEALING
including the application, affidavit and search warrant, be sealed until further order of the Court.
These documents discuss an ongoing criminal investigation that is neither public nor known to
all of the targets of the investigation. Accordingly, there is good cause to seal these documents
because their premature disclosure may give targets an opportunity to flee/continue flight from
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates,
or otherwise seriously jeopardize the investigation.
ft!. rew T. Mitchell

Special Agent
. Federal Bureau of Investigation
Subscribed and sworn to before me on this ~ y of May, 2018.
~i~
The Honorak~~l A. Howell
20
ATTACHMENT A
This warrant applies to information associated with the Google account
hat is stored at premises owned, maintained, controlled, or operated
by Google, Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View,
CA 94043.
ATTACHMENT B
ATTACHMENT B
I. Files and Accounts to be produced by Google, Inc. betwceu January 1, 2016 and
the Present.
a. The contents of all e-mails, attachments and chat messages stored in the account,
including copies of e-mails sent to and from the account, draft e-mails, the source and destination
e-mails sent addresses associated with each e-mail, the date and time at which each e-mail was
sent, and the size and length of each e-mail; 1
b. All existing printouts from original storage of all of the electronic mail described
above in Section I.A. above;
d. All transactional information of all activity of the account described above in

Section I.A, .including log files, dates, times, methods of connecting, ports, dial ups, and/or
locations;


described above in Section I.A, to include application, full name, physical address, telephone
numbers and other identifiers, records of session times and durations, the date on which the
account was created, the length of service, the types of service utilized, the IP address used to
register the account, log-in IP addresses associated with session times and dates, account status,
alternative e-mail addresses provided during registration, all screen names associated with
subscribers and/or accounts, all account names associated with the subscriber, methods of
connecting, log files, means and source of payment (including any credit or bank account
number), and detailed billing records;
g. All records indicating the services available to subscribers of the electronic mail
address described above in Section I.A.;
h. Google+ subscriber information, circle information, including name of circle and
I This Search warrant applies on to email sent, received, or drafted on or after May 26, 20 I 7.
2
members, contents of posts, comments, and photos, to include date and timestamp;
J. YouTube subscriber information, private videos and files, private messages, and
comments;
le Google+ Photos contents to include all images, videos and other files, and
l. Google Talk and Google Hangouts conversation logs associated with the account.
3
a. Any and all records that relate in any way to the account described in Attachment
A which is evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a false statement); 18 U.S.C. §1651
(pe1jury); 18 U.S.C. § 1030 (unauthorized access ofa protected computer); 18 U.S.C. § 1343
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),, and 52 U.S.C.
§ 30121 (foreign contribution ban) from Jan l, 2015 to the present, including:
communications with foreign government officials or agents of a foreign power,
or discussions with others regarding those actions, or plans or attempts at
undertaking such actions:
b. All images, messages, communications, calendar entries, search terms, and

contacts, including any and all preparatory steps taken in furtherance of these crimes;
c. Communication, information, documentation and records relating to who created,

used, or communicated with the account or identifier, including records about their identities and
whereabouts;
e. All images, messages and comm_unications regarding wiping software, encryption

or other methods to avoid detection by law enforcement;
g. Credit card and other financial information, including but not limited to, bills and
payment records evidencing ownership of the subject account;
4


INFORMATION ASSOCIATED WITH Case: 1:18-sc-01518
THE GOOGLE ACCOUNT Assigned To : Howell, Beryl A.
MOTION TO SEAL WARRANT AND RELATED DOCUMENTS

AND TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 270S(B)
The United States ofAmerica, moving by and through its undersigned counsel, respectfully
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to non-disclosure,
the proposed Order would direct Google LLC, an electronic communication and/or remote
computing services provider with headquarters in Mountain View, California, not to notify any
other person (except attorneys for Google for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year unless otherwise ordered of the Court.
I. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Wanant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991 ).
2. In addition, this Court has jurisdiction to issue the requested order because it is "a
court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Court is a
Page 1 of6
"district court of the United States ... that- has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in fmtherance of the offense
under investigation occmTed within Washington, D.C. See 18 U.S.C. § 3237.
3. Further, the Court has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2705(b). Google provides an "electronic communications service," as defined in 18
U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
"non-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703.
notification. In relevant part, Section 2705(b) provides as follows:. 1
(b) Preclusion of notice to subject of governmental access. - A governmental

entity acting under section 2703 ... may apply to a court for an order commanding
1
Section 2705(b) contains additional requirements for legal process obtained pursuant to
18 U.S.C. § 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any
legal process under that provision.
Page 2 of6
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an ~rder if it determines that
or court order will result in -
(2) flight from prosecution:
(5) otherwise seriously jeopardizing an investigation or unduly delaying

a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
The explicit terms of section 2705(b) make clear that if a courts [sicJfinds that there
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
government makes the required showing under § 2705(b), the court is required to
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
receiving legal advice) of the existence of the Warrant for a period of one year unless othe1wise
ordered by the Court.
investigation into violations related to 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory
Page 3 of6
after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C.
§ 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C.
§ 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) arising out of the conduct of various unknown persons that operated and
controlled the subject accounts. It does not appear that these individuals are currently aware of the
nature and scope of the ongoing FBI investigation.
REQUEST FOR SEALING AND NON-DISCLOSURE
7. In this matter, the government requests that the Warrant be sealed until further order
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year unless otherwise ordered by the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, ap.d its disclosure may alert these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would
remote computing services, the potential target could quickly and easily destroy or encrypt digital
and also given that _the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should circumstances
Page 4 of6
change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed,
the Government will notify the Comt and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the Warrant
will seriously jeopardize the investigation, including by giving the targets an opportunity to flee
from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2}-(5). Because of such potential jeopardy to the investigation, there also exists a
See Robinson, 935 F.2d at 287-89.
10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
of the existence of the warrant prior to producing the material sought.
thereto and other related materials be placed under seal, and furthermore, that the Court command
Page 5 of6
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year
unless otherwise ordered by the Court.
ROBERTS. MUELLEf, III

Special Co)lnsel /
By:-~~~""'\,:.-_-t_-~~-···-·~/-_-_···--~-----
. Ktle Freeny ··
Specia:l Counsel's G
Office (202) 616-0800
Page 6 of6

FOR THE DISTRICT OF MASSACHUSETTS
IN THE MATTER OF THE SEARCH OF Case No. J 'if-/V()-ol l'1c). -A-t_B~

THE PERSON OF
Filed Under Seal
IN THE MATTER OF THE SEARCH OF Case No. I 1J - fVl:S"" _ ~ 11 '!> _ Mt3B,

THE BAGGAGE OF
Filed Under Seal
AN APPLICATION FOR SEARCH WARRANTS
1. I make this affidavit in support of an application for search and seizure warrants
under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of
(the Target Person) (described further in that warrant's
Attachment A), and any baggage associated with him (described further in that warrant's
Attachment A), and the seizure of the electronic devices and media described in Attachment B
(the Target Devices). I anticipate this search will be executed after lands at Logan
International Airport at approximately This warrant is for the
seizure of the devices only; the Government will seek a warrant to search any seized devices at a
later point in time.
2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of
investigation for 11 years. In the course of my duties, I have been responsible for investigating
federal crimes and national security matters involving both counterintelligence and issues related
to cybersecurity.
forth all of my lrnowledge about this matter.
there is probable cause to believe that ROGER STONE, JEROME CORSI and others have
committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the
fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C.
§ 1349 (attempt and conspiracy to commit wire fraud) (the "Subject Offenses").
JURISDICTION
5. This Court has jurisdiction to issue the requested warrant because, as described
further below, it is anticipated that and his baggage will be located in the District of
Massachusetts on
SUMMARY
6. As set forth below, (the Target Person) was in contact with Roger
STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have
obtained advance lrnowledge of the release by WikiLeaks of illegally hacked emails for the
benefit of the presidential campaign of Donald J. Trump (the "Campaign"). In July 2016,
STONE instructed CORSI to have talk with Julian AS SANGE, the founder of
WikiLeaks, and served as CORSI's conduit to ASSANGE to discuss hacked
information.
2
7. More specifically, on or about July 25, 2016, STONE emailed CORSI to "Get to
Assange" in person at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or
about July 31, 2016, STONE instructed CORSI to have "see ASSANGE." At the
time, lived in London, where Assange was located at the Ecuadorian Embassy. On
or about August 2, 2016, CORSI told STONE that the "word is friend in embassy [ASSANGE]
plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned to be very
damaging .... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop
HRC." Information disclosures subsequently occurred on or about the times CORSI predicted.
8. On or about August 10, 2016, began emailing CORSI multiple news
articles regarding AS SANGE and alleged Russian involvement in the election. On or about
November 13, 2016, emailed STONE to congratulate him on "tak[ing] the country
back," and stating, "You deserve a lot of credit and working with you and Jeri Corsi, who is with
me now in London has been a great joy." On or about January 7, 2017, emailed
STONE and CORSI to joke about John Podesta going "phishing." As stated below, I know from
my training and experience that the term "phishing" is used to refer to the practice of sending
emails purporting to be from a reputable party in order to trick individuals to reveal to the sender
personal information, including passwords.
PROBABLE CAUSE TO BELIEVE THAT A FEDERAL CRIME WAS COMMITTED
i. Roger STONE
actively involved in U.S. politics for decades. STONE worked on the Campaign until August
2015. Although STONE had no official relationship with the Campaign thereafter, STONE
3
maintained his support for Trump and continued to make media appearances in support of the
Campaign. As described further below, STONE also maintained contact with individuals
employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy
chairman Rick GATES.
ii. Jerome CORSI
10. Jerome CORSI is a political commentator who, according to publicly-available
information, serves as the "Washington Bureau Chief for Infowars.com." According to publicly-
available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for the
website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of books
regarding Democratic presidential candidates. As described further below, CORSI was in
hacked information by WikiLeaks, and appears to have obtained information regarding
4
B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed

12. On October 7, 2016, the U.S. Department of Homeland Security and Office of the
Director of National Intelligence released a joint statement of an intelligence assessment of
Russian activities and intentions during the 2016 presidential election. 1 In the report, the USIC
13. "The U.S. Intelligence Community (USIC) is confident that the Russian
Government directed the recent compromises of e-mails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked e-mails on
that only Russia's senior-most officials could have authorized these activities."
1
"Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on
Election Security," Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-department-
homeland-security-and-office-director-national.
5
"Assessing Russian Activities and Intentions in Recent US Elections."2 In the report, the USIC
15. "[] Russian President Vladimir Putin ordered an influence campaign in 2016
aimed at the US presidential election. Russia's goals were to undermine public faith in the US
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
2
"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_ 2017_ 0 l .pdf.
6
contradictory statements and false claims about his likely Russian identity throughout the
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted
with journalists.
C. Roger STONE's Disclosed Interactions with Guccifer 2.0 and WikiLeaks.
actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was
fired in August 2015. Although STONE had no official relationship with the Campaign
thereafter, STONE maintained his support for Trump and continued to make media appearances
in support of Trump's presidential campaign.
21. As discussed further below, STONE made a number of public references to
WikiLeaks and its release ofDNC-related emails. STONE has also stated that he was in contact
via Twitter with Guccifer 2.0.
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June
the DNC.
7
24. On August 5, 2016, Roger STONE published an article on Breitbart.com entitled,
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." STONE wrote: "It doesn't
Guccifer 2.0." STONE embedded publicly available Tweets from Guccifer 2.0 in the article and
he did the hack of the DNC." STONE also stated: "Guccifer 2.0 made a fateful and wise
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would
see for themselves how the Democrats had rigged the game."
25. On August 8, 2016, STONE addressed the Southwest Broward Republican
at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard to
the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be a number of things. I
actually have communicated with Assange. I believe the next tranche of his documents pertain
to the Clinton Foundation but there's no telling what the October surprise may be." A few days
later, STONE clarified that while he was not personally in touch with Assange, he had a close
friend who served as an intermediary.
26. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJSTONEJr thanks
that u believe in the real #Guccifer2." That same day, Guccifer 2.0 released the personal
cellphone numbers and email addresses from the files of the Democratic Congressional
Campaign Committee (DCCC).
8
27. On August 13, 2016, STONE posted a tweet using@RogerJSTONEJr calling
28. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJSTONEJr paying
you back." Guccifer also sent a private message to @RogerJSTONEJr stating "i'm pleased to say
u r great man. please tell me ifl can help u anyhow. it would be a great pleasure to me."
29. On August 18, 2016, Paul Manafort, STONE's longtime friend and associate,
Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S.
policy toward Ukraine.
30. On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John
STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form
of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
believe that he is in possession of all of those emails that Ruma Abedin and Cheryl Mills, the
31. On September 16, 2016, STONE said in a radio interview with Boston Herald
Radio that he expected WikiLeaks to "drop a payload of new documents on a weekly basis fairly
soon. And that of course will answer the question of exactly what was erased on that email
server."
9
32. On Saturday, October 1, 2016, using@RogerJSTONEJr, STONE Tweeted,
"Wednesday@HillaryClinton is done. #WikiLeaks."
which was part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his
intermediary described this release as the "mother load." On Tuesday, October 4, 2016, STONE
used @RogerJSTONEJr to tweet: "Payload coming. #Lockthemup."
10-21, 2016. On October 12, 2016, John Podesta-referring back to STONE's August 21, 2016
C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to - or at
least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails]
[STONE]." Commenting to the Miami Herald, STONE responded: "I have never met or spoken
with Assange, we have a mutual friend who's traveled to London several times, and everything I
10
37. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
communication during the Campaign between STONE and WikiLeaks. The same article quoted
STONE as stating: "Since I never communicated with WikiLeaks, I guess I must be innocent of
D. Roger STONE's Private Twitter Direct Messages with WikiLeaks and Julian
Assange.
Twitter account @RogerJSTONEJr.
Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account
@wikileaks. This account is the official Twitter account ofWikiLeaks and has been described as
11
impact of our publications. Don't go there if you don't want us to correct you/'
41. On October 16, 2016, @RogerJSTONEJr sent a direct message to @wikileaks:
"Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like
a sieve. You need to figure out who your friends are."
direct message to @RogerJSTONEJr containing a single word: "Happy?" @wikileaks
to communicate."
43. In addition, @RogerJSTONEJr also exchanged direct messages with Julian
Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJSTONEJr directly
12
44. On Saturday, June 10, 2017, @RogerJSTONEJr sent a direct message to
E. Roger STONE's Emails with Jerome CORSI and about Assange

and WikiLeaks
45. On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of
Columbia issued a search warrant for STONE's address On
or about October 17, 2017 Chief Judge Howell issued a warrant for STONE's address,
On or about December 12, 2017, Chief Judge Howell issued a warrant
for Gmail address, Emails recovered pursuant to that
search warrant indicated the following:
46. On or about May 23, 2016, emailed STONE with the subject,
"Trump Campaign," to offer his assistance to the Campaign. wrote that he was "on
to the notorious Oxford case already!" He also stated that he was "available, literally, as needed,
to contribute in ways the campaign sees fit. I'd like to go to Cleveland and pitch in, raise money
and work for you. Can you use me?" Cleveland, Ohio was the location of the 2016 Republican
National Convention, held July 18-21, 2016.
47. On or about June 4, 2016, STONE emailed telling him to "Plan on
going to Cleveland. Will need your help. Can handle credentials."
48. On or about June 20, 2016, emailed STONE and MANFORT, asking
to "know immediately how I can help" the Campaign. also wrote that his "research
on Rhodes House" was nearing completion. Rhodes House is the headquarters of the Rhodes
13
Trust, which provides scholarships to Oxford University, and the "Rhodes House" research
appears to be a reference to STONE' s previous tweet on or about October 13, 2015 that, "In
1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old ."
STONE mentioned Wellstone again to a month later, as discussed below. The
"Rhodes House" research seems to be the same as the "notorious Oxford case" referenced by
above.
49. On or about July 7, 2016, emailed STONE that he had "my tickets to
Cleveland[.] [D]o you have my credential pack?"
50. On or about July 25, 2016, (approximately three days after WikiLeaks began
releasing emails hacked from the DNC), , a commentator who had publicly accused
the Clinton Foundation of fraud, emailed STONE with the subject line, "You need to get to
Assange." The body of the message read: "At Ecuadorian Embassy in London and get the
pending wikileaks emails ... they deal with Foundation, allegedly."
51. According to approximately ninety
minutes later STONE called CORSI and they spoke for 26 minutes.
52. Less than two hours after the phone call to CORSI, STONE emailed CORSI with
the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get pending WikiLeaks emails ... they deal with Foundation,
allegedly." It appears that STONE cut and pasted the email from Ortel to CORSI.
53. On or abou~ July 27, 2016, then-candidate Donald Trump stated in a press
conference, "Russia, if you are listening, I hope you're able to find the 30,000 [Hillary Clinton]
emails that are missing. I think you will probably be rewarded mightily by our press. Let's see if
that happens. That will be next."
14
54. On or about July 28, 2016, Roger STONE called Richard GATES (then the
deputy-chair of the Campaign). They spoke for approximately twelve minutes.
55. On or about July 30, 2016, Paul MANAFORT (then the Chairman of the
Campaign) called STONE. They spoke for approximately one hour and seven minutes. The
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven
minutes is the longest call (by almost a half-hour) that took place between STONE and
MANAFORT in this time period.
56. On or about July 31, 2016, STONE emailed CORSI with the subject line, "Call
me MON." The body of the email read: " should see Assange[.] should find
Bernie sanders brother who called Bill a Rapist- turn him for Trump[.] should find
or more proof of Bill getting kicked out."
57. On or about August 2, 2016, CORSI emailed STONE: "With family, 25th
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more
dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging ... Time to
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old,
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting
stage for Foundation debacle." Based on my training, experience, and review of materials in this
case, it appears that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
refers to AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016. On or about August 12, 2016, Guccifer publicly released information hacked from the
DCCC (the date CORSI identified as when he would "return home.").
15
58. On or about August 10, 2016, emailed CORSI an article titled,
"Assange Warns of 'Triangle of Terror'- Clinton, Pentagon & Google."
59. On or about August 13, 2016, emailed CORSI a news article titled,
"Assange Implies Murdered DNC Staffer Was WikiLeaks' Source."
60. On or about August 16, 2016, emailed CORSI an email with the
subject line, "Vladimir Putin Has Already Won Our Election." The body of email
contained two words: the word "VENONA" and the word "Observer." According to publicly
available information, the "Venona Project" was a top-secret U.S. intelligence effort to gather
and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13,
2016, the Observer had published an article titled, "Vladimir Putin Has Already Won Our
Election" (the subject of the email). The subtitle of the article stated: "It's time to face facts:
Kremlin spies and hackers are undermining American politics." The article further discussed
how, "WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined
DNC emails that were stolen by Russian intelligence." The article also stated that the "Kremlin is
weaponizing stolen information for political effect."
61. On or about August 30, 2016, emailed Steve Bannon, who had
become chief executive of the Campaign when MANAFORT left the Campaign on or about
August 19, 2016, with STONE and CORSI cc'd. wrote offering his assistance and
stating he had been "labouring non stop for the Trump campaign- even tho[u]gh I am all the
way over here in Oxford.... I have been in constant touch with the campaign, Roger Stone and
Jeri Corsi."
16
63. On or about November 13, 2016, emailed STONE.
wrote, "Well, we did it and now have an opportunity of a lifetime to take the country back. God
is good and we are well placed to steer things well. You deserve a lot of credit and working with
you and Jeri Corsi, who is with me now in London has been a great joy."
64. On or about January 7, 2017, an individual named emailed
STONE, CORSI, and with the subject line, "in case you need his mail. ........ "
Attached to the message was a scan of a business card for John Podesta. Several hours later,
replied: "Ha ... maybe he wants to go phishing with us?"
to the practice of sending emails purporting to be from a reputable party in order to trick
individuals to reveal to the sender personal information, including passwords. Public reports
indicate that Podesta's emails were obtaining through a "phishing" scheme.
F. U.K.-Based Email Account
66. In addition to his Gmail account, also uses a U.K.-based email
address, Investigators found emails with this address in
Gmail account. The U.K. email address was also listed in messages sent as a means
of reaching him. A publicly-available database lists the U.K. email address as belonging to
The U.K. email address is housed outside the United States, and investigators
anticipate it may take substantial time to retrieve the messages on the account via a potential
treaty request. In addition, it is possible that emails may have been deleted or no longer
maintained. I know from my training and experienced that users often download and store emails
on their phones, tablets, and laptops, such as the Target Devices. Even if information has been
deleted by the user, the Government may be able to employ forensic tools to recover information
17
from his devices. In addition, as described further below, the Target Devices may include a
variety of other stored communications, including voicemail, text message, and other third party
messaging systems which may have used to communicate with CORSI, STONE,
and others regarding WikiLeaks.
THE PERSON AND BAGGAGE TO BE SEARCHED CONTAIN EVIDENCE, FRUITS,

AND INSTRUMENTALITIES
67. I also have probable cause to believe that the person and baggage to be searched
contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above,
as described in the warrants' respective Attachments A and B.
68. Records indicate that has purchased a ticket on
I know from my training and experience that individuals often carry electronic devices and
storage media of the type described in Attachment B with them when they travel both on their
persons and in their baggage. These devices and media include but are not limited to cellular
phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives.
69. From my training and experience, I am also aware that personal computer systems
are generally capable of creating, receiving, and otherwise processing computer files such as e-
mail, word-processing documents, photographs, and spreadsheets. As evidenced by the emails
above, uses computer systems to communicate with CORSI and STONE regarding
WikiLeaks.
70. Based on my training, experience, and information provided by other law
enforcement officers, I know that many smartphones (which are included in Attachment B) can
now function essentially as small computers. Smartphones have capabilities that include serving
18
as a wireless telephone, digital camera, portable media player, GPS navigation device, sending
and receiving text messages and e-mails, and storing a vast range and amount of electronic data.
Examining data stored on devices of this type can uncover, among other things, evidence that
reveals or suggests who possessed or used the device.
71. Based on my knowledge, training, experience, and information provided to me by
other agents, I know that computer files or remnants of such files can be recovered months or
years after they have been written, downloaded, saved, deleted, or viewed locally or over the
Internet. This is true because:
• Electronic files that have been downloaded to a storage medium can be stored for
years at little or no cost. Furthermore, when users replace their computers, they
can easily transfer the data from their old computer to their new computer.
• Even after files have been deleted, they can be recovered months or years later
using forensic tools. This is so because when a person "deletes" a file on a
computer, the data contained in the file does not actually disappear; rather, that
data remains on the storage medium until it is overwritten by new data, which
might not occur for long periods of time. In addition, a computer's operating
system may also keep a record of deleted data in a "swap" or "recovery" file.
• Wholly apart from user-generated files, computer storage media, in particular,
computers' internal hard drives, contain electronic evidence of how the computer
has been used, what it has been used for, and who has used it. This evidence can
take the form of operating system configurations, artifacts from operating system
or application operation, file system data structures, and virtual memory "swap"
19
or paging files. It is technically possible to delete this information, but computer
users typically do not erase or delete this evidence because special software is
typically required for that task.
• Similarly, files that have been viewed over the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache." The
browser often maintains a fixed amount of hard drive space devoted to these files,
and the files are overwritten only as they are replaced with more recently viewed
Internet pages or if a user takes steps to delete them.
CONCLUSION
72. Based on the forgoing, there is probable cause to believe that one or more people
have violated the statutes specified above and that electronic devices and media containing
evidence, fruits, and instrumentalities of those crimes, are contained on the person of
(described further in that warrant's Attachment A) and his baggage (described
further in that warrant's Attachment A), and for the seizure of the electronic devices and media
described in further in Attachment B.
REQUEST FOR AUTHORIZATION TO EXECUTE THEWARRANTS BEFORE

6 AM OR AFTER 10 PM
73. In addition, I request that the search warrants authorize searches and seizures
before 6 AM and after 10 PM. Although flight is scheduled to land at
I am aware that flight departure and arrival times can vary widely from those announced
because of adverse weather or other delays throughout the airline transportation system. If
because of a flight delay flight landed at 10:01 PM, a warrant without the
20
requested authorization could not be executed for another 8 hours, requiring me to either obtain a
new warrant or to detain and his baggage until 6 AM the next morning. The
requested authorization will allow the searches and seizures to progress as efficiently as possible,
with minimal delay to and any other person with whom he is travelling.
REQUEST FOR SEALING
Sworn to under the pains and penalties of perjury,
Curtis Heide
Special Agent
21

for the
In the Matter of the Search of

(Briefly describe the property lo be searched
Case: 1 :18-sc-02401
or identij)' the person by name and address) Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH Assign. Date: 7/12/2018

of the following person or prope1iy located in the Northern District of ·- California
--------~
See Attachment C.
described above, and that such search will reveal (identijj1 the person or describe the property to be seized):
See Attachment D.
YOU ARE COMMANDED to execute this warrant on or before July 26, 2018 ___ (,10110 exceed 14 days)
oif in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
propeiiy was taken.
as required by law and promptly return this warrant and inventory to ..... Hon. Beryl A. Howell
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriale box)
0 for days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued: 1j'l 2;/A?/i'ef f':{J-//J ~-~ 'Judge's signature
City and state: _W_a_sh_i_n~g_to_n_,_D_C_ _ _ _ _ _ __ Hon. Beryl A. Howell, Chief U.S. District Judge
/
AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2)
Return
Certification
designated judge.
Date:
E.x:ecuting officer's signature

ATTACHMENT C
This warrant applies to infonnation associated with the following Apple account:
1.
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
One Apple Park Way, Cupertino, California 95014.
37
ATACHMENTD
custody, or control of Apple, regardless of whether such infmmation is located within or outside
of the United States, including any messages, records, files, logs, or information that have been
deleted but are still available to Apple, or have been preserved pursuant to a request made under
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government,
in unencrypted form whenever available, for each account or identifier listed in Attachment A:

alternate, rescue, and notification email addresses, and verification info1mation for each email
register the account, account status, associated devices, methods of connecting, and means and
source of payment (including any credit or bank account numbers);
Device Identifiers ("UDID"), Advertising Identifiers ("IDFA"), Global Unique Identifiers
all attachments;
38
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries,
images, videos, voicemails, device settings, and bookmarks;
addresses including source port numbers), including FaceTime call invitation logs, messaging
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs,
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple
services (including all associated identifiers), and logs associated with iOS device purchase,
activation, and upgrades;
g. All records and information regarding locations where the account or devices
associated with the account were accessed, including all data stored in connection with Location
Services, Find My iPhone, Find My Friends, and Apple Maps;
i. All records pertaining to communications between Apple and any person

j. All files, keys, or other information necessary to decrypt any data produced in an
39
Any and all records that relate in any way to the accounts described in Attachment A
which consists of evidence, fiuits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit
an offense against the United States) for the period from June 15, 2016 to November 10, 2016.
including:
a. All records, information, documents or tangible materials that relate in any way to
Julian Assange, or communications regarding disinformation, denial, dissembling
or other obfuscation about knowledge of, or access to hacked material;
b. All records, information, documents or tangible materials that relate in any way to
communications or meetings involving Roger Stone, Julian
Assange, or any individual associated with the Trump Campaign;
c. All images, messages, communications, calendar entries, search terms, and

contacts, including any and all preparatory steps taken in furtherance of the
above-listed offenses;
d. Communication, information, documentation and records relating to who created,

used, or communicated with the account or identifier, including records about
e. Evidence of the times the account was used;
f. All images, messages and communications regarding wiping software, encryption

g. Passwords and encryption keys, and other access information that may be
h. Credit card and other financial information, including but not limited to, bills and
1. All existing printouts from original storage which concern the categories
J. All "address books" or other lists of contacts.
40
FILED
JUL 12 2018
IN THE UNITED STATES DISTRICT COURT Clerk, us Dis .
Courts ta'r ihe 0\~ct t & Bankruptcy
FOR THE DISTRICT OF COLUMBIA net ot Columbia
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02401

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A.
ORDER
and to require Apple, Inc. ("Apple") an electronic communication and/or remote computing
service headquartered at a company headquartered at I Infinite Loop, Cupertino, CA not to
disclose the existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
targets an opp01tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
further order of the Comi.
THE HONORABLE BERYL A. HOWELL

2

FltED
JUL f 2 2018
for the
Clerk, U.S. District & Barikruptc

or identijj, the person by name and address)
l
)
INFORMATION ASSOCIATED WITH )
l
I, a federal Jaw enforcement officer or an attorney for the government, request a search wan-ant and state under
penalty of perjury that I have reason. to believe that on the following person or properly (identify the person or describe the
See Attachment C.
Northern , there is now concealed (identify the
located in the ===--- District of ---------'===~--
California
person or describe the property Lo be seized):
See Attachment D.
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1){A), and 2703(c)(1)(A).
ref evidence of a crime;
ref property designed for use, intended for use, or used in committing a crime;

18 U.S.C. § 371 Conspiracy
18 U.S.C. § 1030 Unauthorized Access of a Protected Computer

0 Delayed notice of days (give exact ending date if more than 30 days: ___ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth o n ~
Reviewed by AUSA/SAUSA: Applicant's signature
haron Zelinsky(ASC) Andrew Mitchell, Special Agent, FBI

Date: 7/12/2018 ~/~~ Judge's signature
City and state: Washingto'n, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge
FILED
IN THE UNITED STATES DISTRICT COURT JUL 12 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy
Courts tor the District of Columbia
INFORMATION ASSOCIATED WITH Case No. J 'i- SC - c.. '-Id(
Filed Under Seal
AMENDED AFFIDAVIT IN SUPPORT OF

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows:
information associated with the following:
a. The email account maintained by CSC Holdings ("Target
Account 1 "), described further in Attachment A.
b. The Apple Account (including email) associated with , maintained
by Apple, Inc. (Target Account 2), described further in Attachment C.
c. The email accoun maintained by Windstream Communications
('Target Account 3"), described further in Attachment E.
The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau oflnvestigation
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and
experience in investigating criminal and national security matters.

4. .Before the submission of this warrant application, the Special Counsel's Office
complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
members of the news media, 28 C.F.R. 50.10.
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a
protected computer).
JURISDICTION
SUMMARY
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to
Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
31, 2016, STONE.also instructed CORSI to have contact Julian
2
ASSANGE. On or about August2, 2016, CORSI responded to STONE that the "word is friend !
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in
the barrel. #CrookedHillary."
8. Information disclosures subsequently occurred on or about the times CORSI
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day
the Washington Post published a breaking story about an Access Hollywood videotape ofthen-
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked
from the account of John Podesta.
9. Furthermore, on the day of the Access Hollywood video disclosure, there were
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to
publication. At approximately 11 :OOAM, the Washington Post received a tip regarding the
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the
two spoke again at length. At approximately 4:00PM, the Washington Post published its story
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its
first release of emails hacked from John Podesta.
3
PROBABLE CAUSE.
i. Roger STONE
GATES.
ii. Jerome CORSI
4
12. Jerome CORSI is a political commentator who, according to publicly available
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staffreporter"
for the website "World Net Daily" a/k/a "WND.com." CORSI has also written a number of
books regarding Democratic presidential candidates. As described further below, CORSI was in
contact with STONE during the summer and fall of20I6 regarding forthcoming disclosures of

5
Russian activities and intentions during the 2016 presidential election. In the report, the USIC
Government directed the recent compromises of emails from US persons and institutions,
including from US political organizations. The recent disclosures of alleged hacked emails on
"Assessing Russian Activities and Intentions in Recent US Elections." In the report, the USIC
17. "Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
6
messaging strategy that blends covert intelligence operations-such as cyber activity-with
and paid social media users or 'trolls.'"
release US .victim data obtained in cyber operations publicly and in exclusives to media outlets."
C. Additional Hacking Activity by Individuals Associated with the GRU
22. The Special Counsel's Office has determined that individuals associated with the
GRU continued to engage in hacking activity related to the 2016 campaign through at least
November 1, 2016.
7
23. For example, in or around September 2016, these individuals successfully gained ·
. access to DNC computers housed on a third-party cloud-computing service. In or around late
September, these individuals stole data from these cloud-based computers by creating backups of
the DNC's cloud-based systems using the cloud provider's own technology. The individuals
used three new accounts with the same cloud computing service to move the "snapshots" to
those accounts.
24. On or about September 4, 2016, individuals associated with the GRU stole the
· emails from a former White House advisor who was then advising the Clinton Campaign. These
emails were later post on DCLeaks.
25. On or about November 1, 2016, individuals associated with the GRU
spearphished over 100 accounts used by organizations and personnel involved in administering
elections in numerous Florida counties.
D. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks
26. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to
Russian government actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
In that post, Guccifer 2.0 also began releasing hacked DNC documents.
theDNC.
8
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
Committee (DCCC).
31. On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer
9
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34. On August 21, 2016, using @RogerJStoneJR, Stone tweeted stating: "Trust me, it
will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a '"mutual acquaintance' of both his and
that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fair!y soon. And that of course will answer the question as to what exactly what was erased on
that email server."
"Wednesday @ HillaryClinton is done. #WikiLeaks."
10
which was part of WikiLeaks' I 0-year anniversary celebration - Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
@RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
40. WikiLeaks continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, John Podesta- referring back to Stone's August
21, 2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [StoneJ had advanced warning [of the release of his
emailsJ and the Trump campaign had advanced warning about what Assange was going to do. I
think there's at least a reasonable belief that [AssangeJ may have passed this information on to
[Stone]." Connnenting to the NBC News, Stone responded: "I have never met or spoken with
11
41. On March 27, 2017; CNN reported that a representative ofWikiLeaks, writing
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
Twitter account@RogerJStoneJr.
45. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your
operation leaks like a sieve. You need to figure out who your friends are."
12
46. On or about November 9, 2016, one day after the presidential election,
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
@wikileaks immediately followed up with another message less than a minute later: "We are
now more free to communicate."
Assange, the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly
F. CORSl's Communications with STONE, and Others Regarding

Forthcoming Leaks.
13
Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 23 of 58 I
I
II
On or about December 19, 2017 Chief Judge Beryl A. Howell issued a
search warrant for mail account. On or about March 14, 2018, Chief Judge Beryl
A. Howell issued a search warrant for STONE's iCloud account. Information recovered pursuant
to those search warrants indicated the following:
50. On or about May 15, 2016, emailed CORSI at Target Account 3:
"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
meet Manafort -guarantee nothing."
51. On or about May 16, 2016, emailed CORSI on Target Account 3:
"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSI responded, "I will work on
other meetings today." replied, "Do you [want] me to bring you anything from the
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE
with the Title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and
was very cordial. He would look for this memo from you this afternoon."
14
53. On July 25, 2016, STONE sent an erriail to CORSI at Target Account 1 with the
subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the
subject line, "Call me MON." The body of the email read: " should see Assange[.]
should find Bernie [S]anders brother who called Bill a Rapist - turn him for Trump[.]
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre-
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
reference to a "friend in embassy [who] plans 2 more dumps" refers to Julian AS SANGE, the
founder of WikiLeaks, who resided in Ecuador's London Embassy in 2016.
56. On or about August 5, 2016, an associate ofSTONE's, emailed
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
15
stated to investigators that, around the same time; STONE told him he had gone to London to
meet ASSANGE. also stated that in 2018, told STONE.he would be
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
57. On or about August 15, 2016, CORSI messaged STONE using Target Account
3: "Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not
over yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm
in NYC this week. Jerry."
58. On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:
"Did you get the PODESTA writeup." STONE replied "yes."
59. On or about August 31, 2016, CORSI, using Target Account 2, messaged
STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Yanukovych - Panama papers
reveals Podesta hired by S[b]erbauk, Russia's largest financial institution-Podesta$$$ ties to
Russia undermine Clinton false narrative attempting to tie Trump to Putin."
60. On or about September 6, 2016, CORSI emailed STONE using Target Account
3: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
61. On or about September 24, 2016, emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday
and spoke to him about it again today." wrote back, "Awaiting secret file.
Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
responded, "Keep me posted about file[.]" In a subsequent meeting with investigators,
16
indicated this conversation concerned possible derogatory information he was trying ·
to obtain from Turkey.
62. On or about October 3, 2016, an associate of STONE emailed STONE and asked:
"Assange-what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
AS SANGE would release information damaging to then-candidate Clinton, but WikiLeaks did
not make any new releases. Instead, AS SANGE promised more documents, including
information previously referred to about the U.S. election process." ASSANGE also stated that
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and
64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2,
"Assange made a fool of himself. Has nothing or he would have released it. Total BS hype."
65. That same day, BANNON emailed STONE, "What was that this morning???"
17
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails·
Are Released.
67. According to a publicly available news article, 1 at approximately 11AM on
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from
a source regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a
2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling
Trump's campaign, 'Access Hollywood' and NBC for reaction."
68. According to phone records , at approximately
11 :27 AM, CORSI placed a call to STONE which STONE did not answer.
69. At approximately 11 :53AM, STONE received a phone call from the Washington
Post. The call lasted approximately twenty minutes.
70. At approximately 1:42PM, STONE called CORSI and the two spoke for
approximately seventeen minutes.
71. At approximately 2:18PM, CORSI called STONE and the two spoke for
approximately twenty minutes.
1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/3 ld74714-8ce5-l le6-875e-2c 1bfe943b66_story.html

72. At approximately 4:00PM, the Washington Post published a story regarding the
Access Hollywood tape.
73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation.
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
74. At approximately 6:27PM, sent STONE an email titled,
"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE forwarded message to CORSI at Target
Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
H. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After

STONE Is Accused of Advance Knowledge of the Leak
75. On or about October 8, 2016, STONE messaged CORSI at Target Account 2,
"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
comments, attacking bad job numbers."
76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE
emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need your BEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19
complicated. Two articles in length. I can give you in raw form ihe stuff I got in Russiau
trauslated but to write it up so it's easy to understand will take weekend. Your choice?"
77. On or about that same day October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
"talking points" included the statement that "Podesta is at the heart of a Russian-govermnent
money laundering operation that benefits financially Podesta personally aud the Clintons through
the Clinton Foundation."
78. CORSI followed up several minutes later with another email titled, "Podesta
talking points," with the text "sent a second time just to be sure you got it." STONE emailed
CORSI back via the Hotmail Account, "Got them aud used them."
79. On or about Thursday, October 13, 2016, CORSI, using Target Account 3,
emailed STONE: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
skimmed maybe billions off Skolkovo - Skolkovo kept their money with
Metcombank[.] The Russiaus launched a criminal investigation[.] [web link] Once
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's
Clinton Fund account, there's no telling how much money he laundered, or where it ended up.
Nothing in Clinton Foundation audited financials or IRS Form 990s about$$$ received via
20
Russia & Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]"
80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI
sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA." The text
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or data from Wikileaks." The post then asked, "Just how much
money did , a controversial Russian billionaire investor with ties to the
Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99 .978 percent by with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank
account in the Bank of America that is operated by the Clinton Foundation?"
81. On or about October 14, 2016, CORSI sent a message using Target Account 2 to
STONE, "i'm in NYC. Thinking about writing piece attacking Leer and other women. It's
basically a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
82. On or about October 17, 2016, CORSI messaged STONE using Target Account
2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
landed JFK- on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
21
I
I
I
83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE I
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
!
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
called Podesta' s bluff and raised him the election."
2, "Pis call. Important."
85. On or about October 19, 2016, STONE published an article on Breitbart.com in
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta' s business dealings would be exposed. I didn't hear
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
my website." STONE linked to the story he had asked CORSI to write for him on October 13,
2016 discussed above.
86. On or about November 8, 2016, the United States presidential election took place.
87. On or about November 9, 2016, CORSI, using Target Account 2, messaged
STONE, "Congratulations, Roger. He could not have done it without you."
88. On or about November 10, 2016, CORSI messaged STONE using Target
Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm
in London. Have some interesting news for you."
22
23
24
· BACKGROUND CONCERNING EMAIL
96. In my training and experience, I have learned the Providers provide a variety of
on-line services, including electronic mail ("email") to the public. The Providers allow
subscribers to obtain email accounts at the domain names identified in the email address
contained in Attachment A and C. Subscribers obtain an account by registering with the
Providers. During the registration process, the Providers ask subscribers to provide basic
personal information. Therefore, the computers of the Providers are likely to contain stored
electronic communications (including retrieved and unretrieved email) for their subscribers and
information concerning subscribers and their use of services, such as account access information,
email transaction information, and account application information. In my training and
experience, such information may constitute evidence of the crimes under investigation because
the information can be used to identify the account's user or users.
97. Inmy training and experience, email Providers generally ask their subscribers to
98. In my training and experience, email Providers typically retain certain
25
oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
(such as logging into the account via the Providers' website), and other log files that reflect
usage of the account. In addition, email Providers often have records of the Internet Protocol
address ("IP address") used to register the account and the IP addresses associated with particular
logins to the account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were used to access
the email account.
communicate directly with an email service Providers about issues relating to the account, such
as technical problems, billing inquiries, or complaints from other users. Email Providers
typically retain records about such communications, including records of contacts between the
user and the Providers' support services, as well as records of any actions taken by the Providers
or user as a result. of the communications. In my training and experience, such information may
constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users.
information stored in connection with an email account can indicate who has used or controlled
26
communications, contacts lists, and images sent ( and the data associated with the foregoing, such
information maintained by the email Providers can show how and when the account was
accessed or used. For example, as described below, email Providers typically log the Internet
Protocol (IP) addresses from which users access the email account, along with the time and date
of that access. By determining the physical location associated with the logged IP addresses,
show the state of mind of an individual at the time the search was made, as well as the
has occurred.
27
INFORMATION REGARDING APPLE ID AND iCLOUD2
described in further detail below, the services include email, instant messaging, and file storage:
• Apple provides email service to its users through email addresses at the
• iMessage and FaceTime allow users of Apple devices to communicate in
• iCloud is a file hosting, storage, and sharing service provided by Apple.
2 The information in this section is based on information published by Apple on its website, including, but
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/i0S Security Guide.pd[, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.
28
·• iCloud-connected services allow users to create, store, access, share, and
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers
on all of the user's Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers,
Keynote, and Notes), enables iCloud to be used to create, store, and share documents,
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
passwords, credit card information, and Wi-Fi network information synchronized across multiple
Apple devices.
• Game Center, Apple's social gaming network, allows users of Apple
• Find My iPhone allows owners of Apple devices to remotely identify and
track the location of, display a message on, and wipe the contents of those devices. Find My
Friends allows owners of Apple devices to share locations.
• Location Services allows apps and websites to use information from
cellular, Wi-Fi, Global Positioning System ("OPS") networks, and Bluetooth, to determine a
• App Store and iTunes Store are used to purchase and download digital
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or
29
purchased through iTunes Store on iOS devices and on desktop and laptop computers running
syncing mechanism.
create the account; it can later be changed. Users can submit an Applesprovided email address
(often ending [email protected], @me.com,or @mac.com)or an email address associated with a
access most Apple services (including iC!oud, iMessage, and FaceTime) only after the user
length of service, records oflog-in times and durations, the types of service utilized, the status of
30
the account (including whether the account is inactive or closed), the methods used to· connect to
lI
1
invitation logs" for FaceTime calls, "query logs" for iMessage, and "mail logs" for activity over
an Apple-provided email account. Records relating to the use of the Find My iPhone service,
including connection logs and requests to remotely lock or erase a device, are also maintained by
Apple.·
content associated with an Apple ID, and information about a user's web browser may be
31
device.
I 09. Apple provides users with five gigabytes of free electronic space on iC!oud, and
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and
notes, app data and settings, Apple Watch backups, and other data. Records and data associated
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an
instant messaging service, can be configured to regularly back up a user's instant messages on
iC!oud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
nonetheless be decrypted by Apple.
susp1c10n.
32
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A) and 2703(c)(I )(A), by using the warrant
(including the content of communications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the
information described in Section I of Attachments B, D, and F, government-authorized persons
will review that information to locate the items described in Section II of Attachment B, D, and
F. The items identified in Attachments A-F will also be screened by reviewers not on the
prosecution team to identify and filter out privileged material.
CONCLUSION
113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officeris not
33
REQUEST FOR SEALING
Andrew Mitchell
Special Agent
Subscribed and sworn to before me on this/)/;}ay of July, 2018.
~~~
34
I
ATTACHMENT A
I
I
I
This warrant applies to information associated with the following email account:
I
1.
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC,
1111 Stewart Avenue, Bethpage, NY 11714.
35
ATTACHMENT B
preserved pursuant to a preservation request under 18 U.S.C. § 2703(:f), the Provider is required
Attachment A:
including copies of e-mails sent to and from the account, draft e-mails, the source and
destination e-mails sent addresses associated with each e-mail, the date and time at which
each e-mail was sent, and the size and length of each e-mail;
b. All existing printouts from original storage of all of the electronic mail described above
in Section I.A. above;
d. All transactional information of all activity of the account described above in Section I.A,
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations;
e. All records or other information stored by an individual using the account, including
address books, contact and buddy lists, calendar data, pictures, and files;
f. Records or other information regarding the identification of the account described above
in Section I.A, to include application, full name, physical address, telephone numbers and
other identifiers, records of session times and durations, log-in IP addresses associated
with session times and dates, account status, alternative e-mail addresses provided during
registration, all screen names associated with subscribers and/or accounts, all account
names associated with the subscriber,
g. All records indicating the services available to subscribers of the electronic mail address
described above in Section I.A.;
36
II
I
l
i
Any and all records that relate in any way to the accounts described in Attaclnnent A
which consists of evidence, fruits, ~r instrumentalities of violations of 18 U.S.C. § 1030 (fraud
including:
communications regarding hacking, release of hacked material, communications with
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or
communications regarding disinformation, denial, dissembling or other obfuscation about
knowledge of, or access to hacked material;
communications or meetings involving Roger Stone, Julian Assange, or
any individual associated with the Trump Campaign;
All images, messages, communications, calendar entries, search terms, "address book"
entries and contacts, including any and all preparatory steps taken in furtherance of the
c. Communication, information, documentation and records relating to who created, used, or

communicated with the account or identifier concerning the messages identified above,
·including records about their identities and whereabouts;
e. All images, messages and communications regarding wiping software, encryption or

other methods to avoid detection by law enforcement;
f. Passwords and encryption keys, and other access information that may be necessary to
access the account and other associated accounts;
h. All existing printouts from original storage which concern the categories identified in
subsection II.A;
37
'
I
,,I
ATTACHMENT C
I
This warrant applies to information associated with the following Apple account:
1.
1hat is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
38
ATACHMENTD
custody, or control of Apple, regardless of whether such information is located within or outside
of the United States, including any messages, records, files, logs, o~ information that have been
18 U.S.C. § 2703(1), Apple is required to disclose the following information to the govermnent,

Station Equipment Identities ("IMEI"); .
all attachments;
39
e. The contents of all files and other records stored on iCloud, including ail iOS

fileinfolist. txt files).
40
II. · Information to be Seized by Law Enforcement Personnel
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud
including:
communications or meetings involving Roger Stone, , Julian

d. Communication, information, documentation and records relating to who created,

used, or communicated with the account or identifier, including records about
f. All images, messages and communications regarding wiping software, encryption

i. All existing printouts from original storage which concern the categories
j. All "address books" or other lists of contacts.
41
ATTACHMENTE
that is stored at premises owned, maintained, controlled, or operated by Windstream
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.
42
ATTACHMENT F
preserved pursuant to a preservation request under 18 U.S.C. § 2703(±), the Provider is required
Attachment E:
described above in Attachment E;
43
including:
c. All images, messages, communications, calendar entries, search terms, "address book"
d. Communication, information, documentation and records relating

.
to who created, used, or.
including records about their identities and whereabouts;
f. All images, messages and communications regarding wiping software, encryption or

g. Passwords and encryption keys, and other access information that may be necessary to
1. All existing printouts from original storage which concern the categories identified
above;
44
IN THE UNITED STATES DISTRICT COURT.


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND

TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
moves the Court for an Order placing the above-captioned waITant and the application and affidavit
notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Apple Inc. ("Apple") an electronic communication
and/or remote computing services provider headquartered in Cupertino, California not to notify
m1y other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the W aITant for a period of one year or until further order of the Court.
1. The Court has the inherent power to seal court filings when appropriate,
including the Wm-rant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589,598 (1978)). The Court may also seal the
WaITant to prevent serious jeopm·dy to an ongoing criminal investigation when, as in the present
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
"district court of the United States ... that - has jurisdiction over the offense being investigated."
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237.
3. Further, the Corui has authority to require non-disclosure of the Warrant under 18
U.S.C. § 2705(b). Apple provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain cetiain basic
Government to obtain contents of conmmnications using a search warrant. See 18 U.S.C. § 2703.
notification. In relevant part, Section 2705(b) provides as follows: 1

subpoena, or corui order. The court shall enter such an order if it determines that
or court order will result .in-
(!) endangering the life or physical safety of an individual;
1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b )(1 )(B), but the Government does not seek to use the proposed Order for any legal process
2

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
customer for a period of time that the court determines is appropriate. Once .the
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705{b) for Grand Jury
command Apple not to notify any other person (except attorneys for Apple for the purpose of
order of the Court.
investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this waITant to Corsi could lead him to
destroy evidence or notify others who may delete information relevant to the investigation.
3
of the Court and that Apple and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
because the Wanant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may alert these targets to
the ongoing investigation and its scope. Once ale1ied to this investigation, potential targets would
remote computing services, the potential target could quickly and easily destroy or encrypt digital
longer needed, the Government will notify the Comi and seek appropriate relief;
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
4
compelling· governmental interest in· confidentiality to justify the government's sealini request.
10. Based on prior dealings with Apple the United States is aware that, absent a court
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, it is
Apple's policy and practice, upon receipt of a wanant seeking the contents of electronically stored
wire or electronic communications for a certain account, to notify the subscriber or customer of
the existence of the warrant prior to producing the material sought.
above-captioned wanant, the application and affidavit in suppmi thereof, and all attachments
thereto and other related materials be placed under seal, and furthe1more, that the Court command
Apple not to notify any other person of the existence or contents of the above-captioned wanant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or
ROBERTS. MUELLER, III

Special Counsel
Dated: J/tl/2,D/'3 By: ~-~-~

kamnS.f Zeliy
The Special Counsel's Office
(202)-514-0637
5
AO 93 (Rev. ! l/l3) Search and Seizure Warrant

for the

or identijj1 the person by name and address) )
) Assign. Date: 7/12/2018
) Description: Search & Seizure Warrant
)

of the following person or prope1ty located in the Eastern District of New York
(identijj1 the person or describe the property to be searched and give its location):
See Attachment A
described above, and that such search will reveal (identify the person or describe the properly to be seized):
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before July 26, 2018 (not to exceed 14 days)
<;;fin the daytime 6:00 a.m. to 10:00 p.m.
prope1ty was taken.
as required by law and promptly return this warrant and inventory to Hon. _B_e_iyl A. H~o~w~e~l~I_ _ __
(UniJed States Magistrate Judge)
§ 2705 ( except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate bmj
0 for __ days (,101 to exceed 30) 0 until, the facts justifying, the later specific date of .. · - - -
Date and time issued: ~~A d-'.,,y0

Judge's signature
----
Return
Certification
designated judge.
Date: ..
-
ATTACHMENT A
1.
1111 Stewart Avenue, Bethpage, NY 11714.
34
ATTACHMENT B
Particular Thiugs to be Seized
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required
Attachment A:
registration, aU screen names associated with subscribers and/or accounts, all account
35
including:
communications regarding disinfo1mation, denial, dissembling or other obfuscation about


g. Credit card and other financial info1mation, including but not limited to, bills and
subsection II.A;
36
FILED
IN THE UNITED STATES DISTRICT COURT JUL 1 2 2018
ORDER
and to require CSC Holdings, an electronic communication and/or remote computing service s
headquartered at 1111 Stewart Avenue, Bethpage, NY 11714, not to disclose the existence or
contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
of the existence of the Wmrnnt will seriously jeopardize the investigation, including by giving the
targets an oppo1tunity to flee from prosecution, destroy or tamper with evidence, and intimidate
materials, the instant motion to seal, and this Order be SEALED until further order of the Comi;
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), CSC Holdings and
its employees shall not disclose the existence or content of the Warrant to any other person ( except
attorneys for CSC Holdings for the purpose of receiving legal advice) for a period of one year
unless otherwise ordered by the Comi.
THE HONORABLEERYL A.HOWELL

~/</
Date
2
AO I06 (Rev. 04/10) Application for a Search Warrant
fit!D
UNITED STATES DISTRICT COURT JUL 1 2 2018
for the Clerk, U.S. District & Bankruptcy
In the Matter of the Search of Case: 1 :18-sc-02403

l Assigned To : Howell, Beryl A.
l
)
Assign. Date : 7/12/2018

I, a federal law enforcement officer or an attorney for the govermnent, request a search warrant and state under
penalty of pe1jury that I have reason to believe that on the following person or property (identify the person or describe the
properly to be searched and give its location):
See Attachment A.
New York , there is now concealed (identify the
located in the Eastern
--~=~~~--
District of
--~="-'=~--~
See Attachment B.
,!I evidence of a crime;
,!I contraband, fruits of crime, or other items illegally possessed;
r,/ property designed for use, intended for use, or used in committing a crime;

18 U.S.C. § 371 Conspiracy
18 u.s.c. § 1030 Unauthorized Access of a Protected Computer
',;/ Continued on the attached sheet.

O Delayed notice of days (give exact ending date if more than 30 days: __ ___ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached eet.
IAaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI
Date: 7/12/2018
,. Judge's signature
FILED
JUL 12 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District &Bankruptcy
Courts for tile District of Columbia

INFORMATION ASSOCIATED WITH Case No. (1,- 5C - c. Yo3
Filed Under Seal
AMENDED AFFIDAVIT IN SUPPORT OF

a. The email account maintained by CSC Holdings ("Target
Account 1"), described further in Attachment A.
b. The Apple Account (including email) associated with maintained
by Apple, Inc. (Target Account 2), described further in Attachment C.
c. The email accoun maintained by Windstream Communications
("Target Account 3"), described further in Attachment E.
The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream
Communications ("the Providers") and searched by the government is described in the following
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A), and 2703(c)(l)(A).
2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation

to show merely that there is sufficient probable cause for tbe requested warrant and does not set
4. Before the submission of this warrant application, the Special Counsel's Office
complied with all relevant Department of Justice policies, including the requirement for
Departmental approval under the Department's policy regarding obtaining information from
members of the news media, 28 C.F.R. 50.10.
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a
protected computer).
JURISDICTION
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &(c)(l)(A).
Specifically, tbe Court is "a district court of the United States (including a magistrate judge of
such a court) ... that has jurisdiction over tbe offense being investigated." 18 U.S.C.
SUMMARY
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get to
Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July
31, 2016, STONE also instructed CORSI to have contact Julian
2
ASSANGE. · On or about August 2, 2016, CORSI responded to STONE that the "word is friend
in embassy [ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October.
Impact planned to be very damaging .... Time to let more than Podesta to be exposed as in bed w
enemy if they are not ready to drop HRC." After receipt of that message, on or about August 21,
2016, using @RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta' s time in
the barrel. #CrookedHillary."
predicted: On or aboutAugust 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
3
PROBABLE CAUSE.
i. Roger STONE
GATES.
ii. Jerome CORSI
4
to publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"

5
14. On October 7, 2016, the U.S. Department of Homeland Security an:d the Office of
that only Russia's senior~most officials could have authorized these activities.
assessment of Russian activities a:nd intentions during the 2016 presidential election entitled,
"Assessing Russian Activities and Intentions in Recent US ·Elections." In the report, the USIC
17. "Russian President Vladimir Putin ordered an influence campaign in 2016 aimed
6
messaging strategy that blends covert intelligence operations-such as cyber activity-with
and paid social media users or 'trolls."'
19. With respect to "cyber activity," the USIC-assessed that "Russia's intelligence
22. TheSpecial Counsel's Office has determined that individuals associated with the
November 1, 2016.
7
23. For example, in or around September 2016, these individuals successfully gained
access to DNC computers housed on a third-party cloud-computing service. In or around late
those accounts.
emails from a former White House advisor who was then advising the Clinton Campaign. These
D. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks
theDNC.
8
"Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't
Guccifer 2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in
the article and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains
who he is and why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now
the world would see for themselves how the Democrats had rigged the game."
he's going to do?" Stone responded: "Well, it could be any number of things. I actually have
Committee (DCCC).
31. On August 13, 2016, Stone posted a tweet using@RogerJStoneJr calling Guccifer
9
back." Guccifer also sent a private message to @RogerJStoneJr stating "i 'm pleased to say u r
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy
toward Ukraine.
34. On August 21, 2016, using@RogerJStoneJR, Stone tweeted stating: "Trust me, it
will soon the [sic] Podesta' s time in the barrel. #CrookedHillary ." In a C-SPAN interview that
same day, Stone reiterated that because of the work of a "'mutual acquaintance' of both his and
that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly basis
fairly soon. And that of course will answer the question as to what exactly what was erased on
that email server."
10
balcony of the Ecuadoran Embassy in London. On the day of the Assange armouncement -
which was part ofWikiLeaks' 10-year armiversary celebration- Stone told Infowars that his
intermediary described this release as the "mother load." On October 5, 2016, Stone used
@RogerJStoneJr to tweet: "Payload coming. #Lockthemup."
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to Stone's August
21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his
think there's at least a reasonable belief that [Assange] may have passed this information on to
[Stone]." Commenting to the NBC News, Stone responded: "I have never met or spoken with
11
41. · On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing
charges I knew a.bout the hacking ofPodesta's email (speculation and conjecture) and the timing
E. Roger Stone's Private Twitter Direct Messages with WikiLeaks and Julian Assange.
12
@wiki!eaks sent a direct message to @RogerJStoneJr containing a single word: "Happy?"
4 7. In addition, @RogerJStoneJr also exchanged direct messages with Julian

Forthcoming Leaks.
13
On or about December 19, 2017 Chief Judge Beryl A. Howell issued a
search warrant for email account. On or about March 14, 2018, Chief Judge Beryl
A. Howell issued a search watTant for STONE's iCloud account. Information recovered pursuant
to those search warrants indicated the following:
50. On or about May 15, 2016, emailed CORSI at Target Account 3:
"Here is my flight schedule. Need to get something confirmed now .... " CORSI responded, "I
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week."
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, "May
meet Manafort -guarantee nothing."
51. On or about May 16, 2016, emailed CORSI on Target Account 3:
"Outside of Wednesday 2-4 ... I am open. Do you have times for meeting on other things?
Flexible re DJT. How about the head of finance for them?" CORSiresponded, "I will work on
other meetings today." replied, "Do you [want] me to bring you anything from the
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!"
52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE
with the Title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
14
53. On July 25, 2016, STONE sent an email to CORSI at Target Account 1 with the
subj~ct line, "Get to Assange." The body of the message read: "Get to Assange [a]t Ecuadorian
Embassy in London and get the pending WikiLeaks emails ... they deal with Foundation,
allegedly."
54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the
subject line, "Call me MON." The body of the email read: " should see Assange[.]
should find Bernie [S]anders brother who called Bill a Rapist-turn him for Trump[.]
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE using Target Account 1,
"Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre-
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not
reference to a "friend in embassy [who] plans 2 more. dumps" refers to Julian ASSANGE, the
founder ofWikiLeaks, who resided in Ecuador's London Embassy in 2016.
56. On or about August 5, 2016 an associate ofSTONE's, emailed
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded "enjoy it
15
stated to investigators that, around the same time, STONE told him he had gone to London to
meet ASSANGE. also stated that in 2018, told STONE he would be
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE.
57. On or about August 15, 2016, CORSI messaged STONE using Target Account
58. On or about August 31, 2016, CORSI using Target Account 1 emailed STONE:
59. On or about August 31, 2016, CORSI, using Target Account 2, messaged
STONE, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
reveals Podesta hired by S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to
60. On or about September 6, 2016, CORSI emailed STONE using Target Account
3: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
61. On or about September 24, 2016 emailed CORSI, "I will have much
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded using Target
Account 3, "We have secure back channel through Roger. I saw him again in NYC last Friday
and spoke to him about it again today." wrote back, "Awaiting secret file.
Explosive ... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI
responded, "Keep me posted about file[.]" In a subsequent meeting with investigators,
16
indicated this conversation concerned possible derogatory information he was trying
to obtain from Turkey.
62. On or about October 3, 2016, an associate of STONE emailed STONE and asked:
"Assange - what's he got? Hope it's good." Stone wrote back, "It is. I'd tell Bannon but he
doesn't call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be
settled." The associate forwarded the email to Steve BANNON and wrote: "You should call
Roger. See below. You didn't get from me." BANNON wrote back, "I've got important stuff to
worry about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
63. .On or about October 4, 2016, ASSANGE gave a press conference at the
64. On or about October 4, 2016, CORSI messaged STONE using Target Account 2,
65. That same day, BANNON emailed STONE, "What was that this morning???"
17
66. When BANNON spoke with investigators during a volunt~y proffer on February
G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
Trump's campaign, 'Access Hollywood' and NBC for reaction."
68. According to phone records , at approximately
1 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/31 d747 l 4-8ce5- l l e6-875e-2c 1bfe943b66_story.html
18
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote "I
expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks - The Podesta Emails" with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE forwarded message to CORSI at Target
Account 1 without comment. STONE does not appear to have forwarded the email to any other
individual.
H. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After

75. On or about October 8, 2016, STONE messaged CORSI at Target Account 2,
"Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I understand."
Approximately twenty minutes later, CORSI texted, "Clintons know they will lose a week of
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech
comments, attacking bad job numbers."
76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE
emailed CORSI at Target Account 1, asking him to "send me your best podesta links." STONE
emailed CORSI at approximately 8:$$ EDT, "need yourBEST podesta pieces." CORSI wrote
back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta is
19
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
translated but to write it up so it's easy to understand will take weekend. Your choice?"
77. On or about that same day October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI,
using Target Account 1, emailed STONE with a subject line "Podesta talking points." Attached
"talking points" included the statement that "Podesta is at the heart of a Russian-government
money laundering operation that benefits financially Podesta personally and the Clintons through
the Clinton Foundation."
79. On or about Thursday, October 13, 2016, CORSI, using Target Account 3,
emailed STONE: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote
back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
'
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once
20
sent STONE an email with the Subject, "ROGER STONE article RUSSIAN MAFIA STYLE
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA." The text
stated: "Roger[,] You are free to publish this under your own name." That same day, STONE
posted a blog post with the title, "Russian Mafia money laundering, the Clinton Foundation and
John Podesta." In that post, STONE wrote, "although I have had some back-channel
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I
have I ever received documents or.data from Wikileaks." The post then asked, "Just
;
how much
money did , a controversial Russian billionaire investor with ties to the
Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by , with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank
account in the Bank of America that is operated by the Clinton Foundation?"
81. On or about October 14, 2016, CORSI sent a message using Target Account 2 to
STONE, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
2, "On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
intel to share."
21
83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source,"
and forwarded an email with the header information stripped out, showing only the body text.
The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man
files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only hope is that if
Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped what he has. If
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He's
called Podesta' s bluff and raised him the election."
2, "Pls call. Important."
85. . On or about October 19, 2016, STONE published an article on Breitbart.com in
87. On or about November 9, 2016, CORSI, using Target Account 2, messaged
STONE, "Congratulations, Roger. He could not have done it without you."
88. On or about November 10, 2016, CORSI messaged STONE using Target
Account 2, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm
in London. Have some interesting news for you."
22
23
I
1'
I
I
11
!I
24
97. In my training and experience, email Providers generally ask their subscribers to
payment (including any credit or bank account number). ·In my training and experience, such
25
I
II
f
I
information can include the date on which the account was created, the length of service, records I
'
oflog-in (i.e., session) times and durations, the types of service utilized, the status of the account
the email account.
or user as a result of the communications. In my training and experience, such information may
26
occupancy" while executing a search warrant at a·residence. For example, email
has occurred.
27
INFORMATION REGARDiNG APPLE ID AND iCLOUD 2
• Apple provides email service to its users through email addresses at the
• iMessage and FaceTime allow users of Apple devices to communicate in
containing text, photos, videos, locations, and contacts, while Face Time enables those users to
• iCloud is a file hosting, storage, and sharing service provided by Apple.
2 The information in this section is based on information published by Apple on its website, including, but
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.apple.com/kb/PH12519; "iOS Security," available at
https://www.apple.com/business/docs/iOS Security Guide.pdf, and "iCloud: How Can I Use iCloud?," available at
https://support.apple.com/kb/PH26502.
28
• iCloud-connected services allow users to create, store, access, share, and
devices and on icloud.cotn.. iCloud Photo Library and My Photo Stream can be used to store and
spreadsheets, and presentations. iCloud Keychain enables a user to keep website usemame and
Apple devices.
• Game Center, Apple's social gaming network, allows users of Apple
• Find My iPhone allows owners of Apple devices to remotely identify and
• Location Services allows apps and websites to use information from
• App Store and iTunes Store are used to purchase and download digital
29
104. Apple services are accessed through the use of an "Apple ID," an account created·
syncing mechanism.
105. An Apple ID takes the form ofthe full email address submitted by the user to
(often ending [email protected], @me.com, [email protected]) or an email address associated with a
accesses and responds to a "verification email'.' sent by Apple to that "primary" email address.
Apple's website. In addition; Apple captures the date on which the account was created, the
length of service, records oflog-in times and durations, the types of service utilized, the status of
30
Apple.
31
I
I
device.
I
I 09. Apple provides users with five gigabytes of free electronic space on iC!oud, and
Apple, may contain data associated with the use of iC!oud-connected services, including: email
(iC!oud Mail); images and videos (iC!oud Photo Library, My Photo Stream, and iC!oud Photo
Sharing); documents, spreadsheets, presentations, and other files (iWork and iC!oud Drive); and
web browser settings and Wi-Fi network information (iC!oud Tabs and iC!oud Keychain).
with third-party apps may also be stored on iC!oud; for example, the iOS app for WbatsApp, an
iCloud Drive. Some of this data is stored on Apple's servers in an encrypted form but can
110. Inmy training and experience, evidence of who was using an Apple ID and from
suspicion.
32
I
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED I
'I
111. I anticipate executing this warrant under the Electronic Communications Privacy !
1,
I
(including the content of commuuications) associated with the accounts in Attachment A, C, and
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the
will rev1ew that information to locate the items described in Section II of Attachment B, D, and
CONCLUSION
33
REQUEST FOR SEALING
114. I further request thatthe Court order that all papers in support of this application,
~~
Andrew Mitchell
Special Agent
Federal Bureau ofinvestigation
~
Subscribed and sworn to before me on thisB day of July, 2018.
~&~~
34
I
ATTACHMENT A
I
I!
11
II
I
1.
I
1111 StewartAvenue, Bethpage, NY 11714.
35
ATTACHMENT B
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provideris required
Attachment A:
36
I
I
I
l
Ii
!
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit I!
including:
I
'


subsection II.A;
37
ATTACHMENT C
This warrant applies to information associated with the following Apple account:
1.
that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at
38
l
ATACHMENTD l
l
Particular Things to be Seized I
a All records or other information regarding the identification of the account, to

all attachments;
39
device backups, all Apple and third-party app data, all files and other recordi related to iCloud
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes ·

40
Any and all records that relate in any way to the accounts described in Attaclunent A
and related a9tivities in connection with computers and 18 U.S.C. § 371 (conspiracy to conunit
including:
conununications regarding hacking, release of hacked material, conununications
Julian Assange, or conununications regarding disinformation, denial, dissembling
conununications or meetings involving Roger Stone, Julian

d. Conununication, information, documentation and records relating to who created,

used, or conununicated with the account or identifier, including records about
f. All images, messages and conununications regarding wiping software, encryption

i. All existing printouts from original storage which concern the categories
J. All "address books" or other lists of contacts.
41
ATTACHMENTE
that is stored at premises owned, maintained, controlled, or operated by Windstream
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock,
Arkansas, 72211.
42
ATTACHMENTF
Attachment E:
in Section I.A, to include application, full riame, physical address, telephone numbers and
described above in Attachment E;
43
Any and all records that relate in any way to the accounts described in Attaclnnent A
including:
d. Communication, information, documentation and records relating to who created, used, or


i. All existing printouts from original storage which concern the categories identified
above;
44


INFORMATION ASSOCIATED WITH Assigned To: Howell, Beryl A.

notifying any person of the WmTant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct CSC Holdings, an electronic communication and/or
remote computing services provider headquartered in Bethpage, NY not to notify any other person
(except attorneys for CSC Holdings for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until further order of the Court.
Wa!1"ant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
the Warrant. See WashingtonPostv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Cami has jurisdiction to issue the requested order because it is "a
18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the
offense under investigation occu1Ted within Washington, D.C. See 18 U.S.C. § 3237.
U.S.C. § 2705(b). CSC Holdings provides an "electronic communications service," as defined in
18 U.S.C. § 2510(15), and/or "remote computing service," as defined in 18 U.S.C. § 2711(2). The
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how CSC Holdings may
be compelled to supply communications and other records using a subpoena, court order, or search
"non-content" information using a comi order, and Section 2703(a)-(b)(l)(A) allows the
Section 2705(b) of the SCA enables the Government to obtain a cou1i order to preclude such

a provider ·of electronic communications service or remote computing service to
deems appropriate, not to notify any other person of the existence of the wa1Tant,
subpoena, or court order. The court shall enter such an order if it determines that
or court order will result in-
1 Section2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
2

18 U.S:C. § 2705(b ). The United States District Court for the District of Columbia has made clear
requisite showing about potential consequences of notification:.
customer for a period of time that the court dete1mines is appropriate. Once the
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Gran_d Jury
command CSC Holdings not to notify any other person (except attorneys for CSC Holdings for
the purpose of receiving legal advice) of the existence ofthe Subpoena for a period of one year or
until further order of the Comi.
investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to
destroy evidence or notify others who may delete info1mation relevant to the investigation.
3
of the Court and that CSC Holdings and its employees be directed not to notify any other person
of the existence or cof\tent of the Warrant (except attorneys for CSC Holdings for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order ·
is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of
which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the ongoing investigation and its scope. Once ale1ied to this investigation, potential
targets would be immediately prompted to destroy or conceal incriminating evidence, alter their
operational tactics to avoid future detection, and otherwise take steps to undermine the
investigation and avoid future prosecution. In patiicular, given that they are known to use
electronic communication and remote computing services, the potential target could quickly and
easily destroy or encrypt digital evidence relating to their criminal activity.
longer needed, the Government will notify the Court and seek appropriate relief.
WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
4
10. Based on prior dealings with CSC Holdings the United States is aware that, absent
a court order under Section 2705(b) commanding CSC Holdings not to notify anyone about a legal
request, it is CSC Holdings's policy and practice, upon receipt of a warrant seeking the contents
of electronically stored wire or electronic communications for a certain account, to notify the
subscriber or customer of the existence of the warrant prior to producing the material sought.
CSC Holdings not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for CSC Holdings for the purpose of receiving legal advice) for a period
of one year or until further order of the Court.

Special Counsel
Dated: 1/fZ/?_of'<j By:

Aaron S.J. ZeJi
The Special G, nsel' s Office
(202)-514-0637
5

for the

case: 1:18-sc-02524
)
) Assign . Date: 7/27/2018
INFORMATION ASSOCIATED WITH THREE Description: Search & Seizure Warrant
ACCOUNT STORED AT PREMISES )
CONTROLLED BY GOOGLE )

See Attachment A
See Attachment B
(;t in the daytime 6:00 a.m. to 10:00 p.m.
property was taken.
as required by law and promptly retum this warrant and inventory to Hon. Beryl A Howell, Chief U.S. District Judge
Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge

City and state:
Return
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to search history information associated with the following accounts
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain
View, California:
ATTACHMENT B
Particular Things to he Seized
Attachment A:
a. All search history information associated with each account.
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
2
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
d. Information, documentation and records relating to who created, used, or communicated

with the account or identifier concerning the messages identified above, including records
about their identities and whereabouts;
f. All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;
g. Evidence of passwords and encryption keys, and other access information that may be
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;
I. Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
3

for the JUL 2 7 2018
District of Columbia Clerk, U.S. District & Bankruptcy
(Briefly describe lltc property I Q be search d Case: 1 :18-sc-02524
or ide11tify th person by name and a ldres:;) )
INFORMATION ASSOCIATED WITH THREE ACCOUNTS )
STORED AT PREMISES CONTROLLED BY GOOGLE ) Assign. Date: 7/27/2018

See Attachment A
located in the
- - --- District of - - - --California
Northern
- --
- - -- - - - , there is now concealed (identify the
See Attachment B
The basis for the search under Fed. R. Crim. P. 4l(c) is (check one or more):
fi evidence of a crime;
fi contraband, fruits of crime, or other items illegally possessed;

18 u.s.c. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy
18 u.s.c. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy
52 u.s.c. § 30121 Foreign Contribution Ban
t;/ Continued on the attached sheet.

under 18 U.S.C. § 3103a, the basis of which is set forth o~
jKyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI

Date:
rl i1
fr i
JUL 21 20!U
Clork, U,s, Ui»trlut l"'4 Dunkruptcy
IN THE UNITED STATES DISTRICT COURT Courts for iha District of Columbia

Case: 1: 18-sc-02524
THREE ACCOUNTS STORED AT Ass!gned To: Howell, Beryl A
Assign. Date: 7/27/2018 .
PREMISES CONTROLLED BY GOOGLE
Description : Search & Seizure Warrant
1. I make this affidavit in support of an application for a search warrant for search
history information associated with the following Google accounts
("Target Accounts"), stored at
premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a business
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The
information to be disclosed by Google and searched by the government is described in the
following paragraphs and in Attachments A and B.
experience, and information obtained from other FBI personnel and witnesses. This affidavit is
intended to show merely that there is sufficient probable cause for the requested warrant and
does not set forth all of my knowledge about this matter.
there is probable cause to believe that the Target Accounts contain information relevant to
violations of 18 U.S.C. § 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18
U.S .C. § 4 (misprision of a felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S .C. § l 349
(attempt and conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban)
(the "Subject Offenses").
JURISDICTION
competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), & (c)(l)(A).
SUMMARY
6. The Special Counsel's Office, with FBI's assistance, is investigating the Russian
government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump. This includes investigating Roger Stone (STONE) and others known
and unknown, in connection with the hacking of email accounts associated with the Democratic
National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and
individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent
dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks,
among others.
2
7. On or about July 25, 2016, STONE emailed Jerome CORSI to "Get to Assange"
at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" On or about July 31, 2016,
STONE also instructed CORSI to have contact Julian ASSANGE. On or
. about August 2, 2016, CORSI responded to STONE that the "word is friend in embassy
[ASSANGE] plans 2 more dumps. One shortly after I'm back. 2nd in October. Impact planned
to be very damaging .... Time to let more than Podesta to be exposed as in bed w enemy if they
are not ready to drop HRC." After receipt of that message, on or about August 21, 2016, using
@RogerJStoneJR, Stone tweeted: "Trust me, it will soon the [sic] Podesta's time in the barrel.
#CrookedHillary."
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United
States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the DCCC.
On or about October 7, 2016, the day the Washington Post published a breaking story about an
Access Hollywood videotape of then-candidate Trump making disparaging remarks about
women, WikiLeaks released emails hacked from the account of John Podesta.
3
PROBABLE CAUSE
i. Roger STONE
4
Campaign, including then-campaign chairman Paul MAN AF ORT and deputy chairman Rick
GATES.
ii. Jerome CORSI
5
B. Russian Government-Backed Hacking Activity During the 2016 Presidential

Election
The U.S. Intelligence Community (USIC) is confident that the Russian Government
directed the recent compromises of emails from US persons and institutions, including
from US political organizations. The recent disclosures of alleged hacked emails on sites
like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent
with the methods and motivations of Russian-directed efforts. These thefts and
disclosures are intended to interfere with the US election process. Such activity is not
new to Moscow-the Russians have used similar tactics and techniques across Europe
and Eurasia, for example, to influence public opinion there. We believe, based on the
scope and sensitivity of these efforts, that only Russia's senior-most officials could have
authorized these activities.
[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the
US presidential election. Russia's goals were to undermine public faith in the US
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, arid harm her
electability and potential presidency. We further assess Putin and the Russian
Government developed a clear preference for President-elect Trump.

6
intermediaries, and paid social media users or 'trolls.'"
and maintained that access until at least June 2016." The USIC attributed these cyber activities
to the Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted
in the compromise of the personal e-mail accounts of Democratic Party officials and political
figures. By May, the GRU had exfiltrated large volumes of data from the DNC."
GRU continued to engage in hacking activity related to the 2016 presidential election through at
least November 1, 2016.
7
those accounts.
24. On July 13, 2018, a grand jury in the District of Columbia returned an indictment
against twelve Russia military officers for criminal offenses related to efforts to influence the
2016 presidential election, including conspiracy to commit authorized access to protected
computers. (Case No . l:18-cr-00125).
C. Roger Stone's Public Interactions with Guccifer 2.0 and WikiLeaks
on its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main paii
the DNC.
27. On August 5, 2016, STONE published an article on Breitbart.com entitled, "Dear
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem ·
8
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer
2.0." The article contained embedded publicly available Tweets from Guccifer 2.0 in the article
and stated: "Here's Guccifer 2.0's website. Have a look and you'll see he explains who he is and
why he did the hack of the DNC." The article also stated: "Gucci fer 2.0 made a fateful and wise
ASSANGE to Russia Today (RT) several days earlier about an upcoming "October Surprise"
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
to the October surprise, what would be your forecast on that given what Julian Assange has
intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
actually have communicated with AS SANGE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
had a close friend who served as an intermediary.
numbers and email addresses from the files of the DCCC.
30. On August 13, 2016, STONE posted a tweet using@RogerJStoneJr calling
9
32. On August 18, 2016, Paul MANAFORT, STONE's longtime friend and associate,
resigned as Chainnan of the Trump Campaign. Contemporary press reports at the time indicated
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S.
33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: "Trust me,
it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a '"mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a weekly
basis fairly soon. And that of course will answer the question as to what exactly what was erased
on that email server."
35. On Saturday, October 1, 2016, using@RogerJStoneJr, STONE tweeted,
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
10
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJr
to tweet: "Payload coming. #Lockthemup."
37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post
38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE responded: "I have never
met or spoken with Assange, we have a mutual friend who's traveled to London several times,
and everything I know is through that channel of communications. I'm not implying I have any
influence with him or that I have advanced knowledge of the specifics of what he is going to do.
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides,
thought were deleted. I hear that through my emissary."
11
D. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter
account @wikileaks. 1 The latter account is the official Twitter account of WikiLeaks and has
been described as such by numerous news reports. The message read: "Since I was all over
national TV, cable and print defending WikiLeaks and assange against the claim that you are
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want
to rexamine the strategy of attacking me- cordially R."
that. However, the false ciaims of association are being used by the democrats to undermine the
1
On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account @RogerJStoneJr.
12
45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE,
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
E. CORSl's Communications with STONE and Others Regarding

Forthcoming Leaks
4 7. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
issued a search warrant for STONE's address On October
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE'
13
addresses, On or about December 19, 2017, Chief Judge Beryl A.
Howell issued a search warrant for email account. On or about March 14, 2018,
Chief Judge Beryl A. Howell issued a search warrant for STONE's iC!oud account. Information
recovered pursuant to those search warrants indicated the following:
48. On or about May 15, 2016, emailed CORSI: "Here is my flight
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
have forwarded the message to STONE at who replied to CORSI that,
"May meet Manafort -guarantee nothing."
49. On or about May 18, 2016, CORSI emailed STONE at
with the title, "Roger -- why don't you look this over before I send it I believe that
CORSI wrote,
and I did manage to see Mr. Trump for a few minutes today as we were·
50. On July 25, 2016, STONE, using sent an email to
CORSI with the subject line, "Get to Assange." The body of the message read: "Get to Assange
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
51. On or about July 31, 2016, STONE, using , emailed
CORSI with the subject line, "Call me MON." The body of the email read: should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- turn him for
Trump[.] should find or more proof of Bill getting kicked out."
14
tweeted about "Podesta's time in the barrel"), CORSI emailed STONE at
"Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact ofrigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w
' .
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SANGE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
53. On or about August 5, 2016, an associate of STONE's, emailed
STONE at The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded "enjoy it while u can[.] I dined with my new pal
Julian Assange last night." subsequently stated to investigators that, around the same
time, STONE told him he had gone to London to meet AS SAN GE. also stated that
in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SANGE. STONE told he was joking and
had not actually met AS SANGE.
54. On or about August 15, 2016, CORSI emailed STONE at
"Give me a call today if you can. Despite MSM drumroll that HRC is
15
already elected, it's not over yet. More to come than anyone realizes. Won't really get started
until after Labor Day. I'm in NYC this week. Jerry."
56. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
invest in Uranium One - was hired by Rosatom in Giustra scandal. Podesta now under FBI
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
false narrative attempting to tie Trump to Putin."
57. On or about September 6, 2016, CORSI emailed STONE at
: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
about file[.]" In a subsequent meeting with investigators, indicated this conversation
concerned possible derogatory information he was trying to obtain from Turkey.
59. On or about October 3, 2016, an associate of STONE emailed STONE at
and asked: "Assange-what's he got? Hope it's good." STONE wrote
back, "It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
16
wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
knows what Assange has. I'd say that's important."
60. On or about October 4, 2016, AS SAN GE gave a press conference at the
vowed that the U.S. election-related documents would all come out.before Election Day.
61. On or about October 4, 2016, CORSI messaged STONE at his iCloud account:
62. That same day, BANNON emailed STONE at "What was
that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are going
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer is a big
democrat."
14, 201'8, he initially denied knowing whether the October 4, 2016 email to STONE was about
17
F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails
Are Released.
64. According to a publicly available news article,2 at approximately 11AM on
Trump's campaign, 'Access Hollywood,' and NBC for reaction."
65. According to phone records at approximately
11 :27 AM, CORSI placed a call to STONE, which STONE did not answer.
68. At approximately 2: 18PM, CORSI called STONE and the two spoke for
2
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d747 l 4-8ce5-l l e6-875e-2cl bfe943b66 _ story.html
18
On or about August 2, 2016, when CORSI emailed STONE on he
wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
"WikiLeaks - The Podesta Emails," with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE, using forwarded
message to CORSI without comment. STONE does not appear to have forwarded the email to
any other individual.
G. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After

72. On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-
have to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty
minutes later, CORSI texted, "Clintons know they will Jose a week of Paula Jones media with T
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job
numbers."
73. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE,
using emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM EDT, "need your BEST podesta pieces."
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?"
74. On or about that same day, October 12, 2016, Podesta accused STONE of having
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI
emailed STONE at both , with a subject line
19
"Podesta talking points." Attached to the email was a file labeled, "ROGER STONE podesta
talking points Oct 12 2016.docx." The "talking points" included the statement that "Podesta is at
the heart of a Russian-government money laundering operation that benefits financially Podesta
personally and the Clintons through the Clinton Foundation."
CORSI back via the Hotmail Account, "Got them and used them."
76. On or about Thursday, October 13, 2016, CORSI emailed STONE at
"PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
post under my by-line since I am the one under attack by Podesta and now Mook." CORSI
wrote back to STONE, "I' 11 give you one more - NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo - Skolkovo kept their money with
sent STONE an email at with the subject, "ROGER STONE article
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
20
name." That same day, STONE posted a blog post with the title, "Russian Mafia money
laundering, the Clinton Foundation and John Podesta." In that post, STONE wrote, "although I
have had some back-channel communications with Wikileaks I had no advance notice about the
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks." The post
then asked, "Just how much money did a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian government, launder through
Metcombank, a Russian regional bank owned 99.978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money
ending up in a private bank account in the Bank of America that is operated by the Clinton
Foundation?"
78. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
79. On or about October 17, 2016, CORSI messaged STONE at his iCloud account,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."
80. On or about October 17, 2016, CORSI emailed STONE at
with the subject, "Fwd:
ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
21
It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
"Pis call. Important."
82. On or about October 19, 2016, STONE published an article on Breitbart.corn in
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear
84. On or about November 9, 2016, CORSI messaged STONE at his iCloud account,
"Congratulations, Roger. He could not have done it without you."
85. On or about November 10, 2016, CORSI messaged STONE at his iCloud
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
London. Have some interesting news for you."
22
23
I. Evidence of Google Searches Relating to the Conduct Under Investigation
92. The search history associated with the account which was
obtained pursuant to search warrant, shows that STONE searched for terms that appear to be
related to the DNC hack and the stolen emails, including his nexus thereto, while logged into the
For example, on or about October 13, 2016, STONE searched for the
words "Roger Stone john Podesta." The search history for appears to
have been deleted between January 18, 2016, and July 23, 2016.
93. During the course of its investigation, the FBI has also identified a series of
searches that appear to relate to the personas Guccifer 2.0 and DCLeaks, which predate the
public unveiling of those two personas. In particular, between May 17, 2016, and June 15, 2016
24
(prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that
searches were conducted for the terms "dcleaks," "guccifer," and ''guccifer june," from IP
addresses within one of two ranges: 172.56.26.0/24, 107.77.216.0/24. 3 These IP ranges are
assigned to T-Mobile USA, Inc., and AT&T Mobility LLC, respectively, and, according to
Google, the searches were all conducted from Florida. On or about June 13, 2018, this Court
issued a search warrant for information associated with these searches and, in particular, for the
full search histories associated with the CookieIDs that conducted the search. 4 As set forth in the
affidavit submitted in support of that search warrant, IP logs obtained from Twitter showed that
STONE used multiple IP addresses within the ranges 172.56.26.0/24 and 107.77.216.0/24 to log
into his Twitter account @RogerJStoneJr. A Facebook account controlled by STONE also used
an IP address within the range 172.56.26.0/24 on or about June 13, 2016, to purchase a Facebook
advertisement.
J. The Target Accounts
94. Subscriber records show that, in addition to STONE
maintains at least two additional Google accounts registered in his name:
a. ("Target Account 1") was created on July 28, 2016,
and uses the recovery email address . According to subscriber records,
Target Account 1 was last accessed on July 5, 2017. Search warrant returns for
how that on or about August 3, 2016, STONE sent an email from
3
Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range .of up to 256 IP addresses.
4
Google assigns unique CookieIDs to searches conducted while a user is not logged into a
Google account. All searches conducted from the same device and browser during a 24-hour
window are associated with the same CookieID.
25
to Target Account 1, with no subject, attaching what appears to be an
advertisement for his book tour, entitled, "Clinton's War on Women."
b. "Target Account 2") was created on or about
October 26, 2016, and uses Target Account 1 as the recovery email. Target Account 2 was last
accessed on or about August 8, 2017.
95. The search of STONE's Hotmail account indicates that STONE uses the address
"Target Account 3"). For example, on or about June 27, 2016, Stone
received an email in his account from the "Gmail Team" with the subject,
"Your Gmail address, , has been created." Subscriber records show that
Target Account 3 was created on June 27, 2016, and is registered in the name of"Swash
Buckler." On or about April 16, 2018, this Court issued an order pursuant to 18 U .S.C.
§ 2703(d) for non-content information associated with Target Account 3. Based on a review of
the header information obtained from Google pursuant to that Order, it appears that STONE
frequently used Target Account 3 to communicate with others via the classified advertisement
website Craigslist.org ("Craigslist").
96. This warrant application seeks only search history for the Target Accounts; it
does not seek the content of email communications to and from the Target Accounts. 5 Google
maintains records of the Google searches that a user conducts while signed into a particular
Google email account (provided the user has not disabled the retention of this information). In
my training and experience, I know that users are often not aware of whether or not they are
5
The government is also contemporaneously seeking an order pursuant to 18 U.S.C. § 2703(d)
for non-content information associated with Target Accounts 1 and 2, including header
information.
26
information stored in connection with a Google account can indicate who has used or controlled
occupancy" while executing a search warrant at a residence. For example, an account's search
history may indicate who used or controlled the account at a relevant time. Further, information
maintained by the email Providers can show how and when the account was accessed or used.
Additionally, information stored in an account's search history may indicate the geographic
location of the account user at a particular time (e.g., location information integrated into an
image or video sent via email). Lastly, stored electronic data, including search history
information, may provide relevant insight into the email account owner's state of mind as it
relates to the offense under investigation. For example, information in the email account may
indicate the owner's motive and intent to commit a crime (e.g., searches relating to the crime), or
consciousness of guilt (e.g., deleting search history in an effort to conceal information from law
enforcement).
FILTER REVIEW PROCEDURES
100. Review of the items described in Attachment A and Attachment B will be
conducted pursuant to established procedures designed to collect evidence in a manner consistent
with professional responsibility requirements concerning the maintenance of attorney-client and
28
other operative privileges. The procedures include use, if necessary, of a designated "filter
The government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team .
CONCLUSION
REQUEST FOR SEALING
29
Respectfully sHbmitted,
~
Andrew Mitchell
Special Agent
. 1 It',
Subscribed and sworn to before me on thisll_ day of July, 2018.
/1;t4 &irLt/
30
ATTACHMENT A
This warrant applies to search history information associated with the following accounts
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain
View; California:
ATTACHMENT B
custody, or control of the Provider including any messages, records, tiles, logs, images, videos,
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
Attachment A:
a. All search history information associated with each account.
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present,
including:
2
e. Evidence indicating the account owner's state of mind as it relates to the crimes under
investigation;
d. Information, documentation and records relating to who created, used, or communicated

with the account or identifier concerning the messages identified above, including records
about their identities and whereabouts;
f. All evidence of wiping software, encryption or other methods to avoid detection by law
enforcement;
g. Evidence of passwords and encryption keys, and other access information that may be
h. Evidence of credit card and other financial information, including but not limited to, bills
and payment records evidencing ownership of the subject account;
I. Review Protocols
3

for the
In the Matter of the Search of ) Case: 1:18-sc-02570

(Rriejly describe the property to be searched )
Assigned To: Howell, Beryl A.
)
INFORMATION ASSOCIATED WITH THREE )
ACCOUNTS STORED AT PREMISES
CONTROLLED BY FACEBOOK )

See Attachment A
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (nottoexceed /4 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. CJ at any time in the day or night because good cause has been established.
property was taken.
as required by Jaw and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
property, wiJJ be searched or seized (check the appropriate box)
0 for _ _ days (not to exceed 30) l'.:J until, the facts justifying, the later specific date of
City and state : Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
AO 93 (Rev. I 1/13) Search and Seizure Warrant (Page 2)
Return
11
Certification
designated judge.
Date:
Executing officer 's signature
PrinJed name and title

ATTACHMENT A
This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, lnc.
("Facebook"), a company headquartered at 1 Hacker Way, Menlo Park, California 94025:
- 1-
ATTACHMENT B
I. Information to be disclosed by Facebook
To the extent that the infonnation described in Attachment A is within the possession,
custody, or control of Facebook Inc. ("Face book"), including any messages, records, files, logs, or
information that have been deleted but are still available to Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the
following infonnation to the government for each user ID listed in Attachment A:
(a) All contact and personal identifying infonnation, including full name, user
identification number, birth date, gender, contact e-mail addresses, physical address
(including city, state, and zip code), telephone numbers, screen names, websites,
and other personal identifiers.
(b) All activity logs for the account and all other documents showing the user's posts
and other Facebook activities;
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded
by any user that have that user tagged in them, including Exchangeable Image File
("EXIF") data and any other metadata associated with those photos and videos;
(d) All profile information; News Feed information; status updates; videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including
the friends' Facebook user identification numbers; groups and networks of which
the user is a member, including the groups' Facebook group identification numbers;
future and past event postings; rejected "Friend" requests; comments; gifts; pokes;
tags; and information about the user's access and use of Facebook applications;
-2-
(e) All other records of communications and messages made or received by the user,
including all private messages, chat history, video calling history, and pending
"Friend" requests;
(f) All records relating to machine cookies;
(g) All "check ins" and other location information, including records of the user's
latitude and longitude;
(h) All IP logs, including all records of the IP addresses that logged into the account;
(i) All records of the account's usage of the "Like" feature, including all Facebook
posts and all non-Facebook webpages and content that the user has "liked";
(j) All information about the Facebook pages that the account is or was a "fan" of;
(k) All past and present lists of friends created by the account;
(l) All records of Facebook searches performed by the account;
(m) All information about the user's access and use ofFacebook Marketplace;
(n) The types of service utilized by the user;
(o) The length of service (including start date) and the means and source of any
payments associated with the service (including any credit card or bank account
number);
(p) Group identification numbers; a list of users currently registered to the group; a list
of users who like the page; group or page contact information, including all contact
information for the creator and/or administrator of the group and a PDF of the
current status of the group profile page;
(q) All past and present Admins for the group;
(r) The "Creator" of the group;
-3-
(s) All privacy settings and other account settings, including privacy settings for
individual Facebook posts and activities, and all records showing which Facebook
users have been blocked by the account;
(t) All records pertaining to communications between Facebook and any person
regarding the user or the user's Facebook account, including contacts with support
services and records of actions taken;
(u) All records related to advertisements and advertising conducted through the
accounts, including advertisements purchased, advertising parameters (search
terms, groups, geographic areas) selected and queried.
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S .C. § 2 (aiding and
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
or other obfuscation about knowledge of, or access to, hacked material;
-4-
communications or meetings involving Roger Stone, Jerome
Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
c. Communications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering communication;
d. Records of any funds or benefits disbursed by or offered on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;
e. Communications, records, documents, and other files that reveal efforts by any
person to conduct activities on behalf of, for the benefit of, or at the direction of
any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;
f. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;
g. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
h. The source of all funds used to purchase advertisements or make other expenditures
or disbursements in these accounts;
1. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s);
-5-
J. The identity of any non-U.S. person(s)- including records that help reveal the
whereabouts of the person(s)-who made any expenditure, independent
expenditure, or disbursement for an electioneering communication; and
k. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by on behalf of, for the benefit of, or at the direction of any
foreign government, foreign officials, foreign entities, foreign persons, or foreign
principals.
-6-
Case
AO 106 (Rev . 04/10) 1:19-mc-00029-CRC
Application for a Search Warrant Document 29-12 Filed 04/28/20 Page 9 of 47

for the
AUG - 2 2018
/lark, U.S. District & Bankruptcy
ourts for the District of Cil/!!mb/a
(Br iefly describe the p roperty to be Searched ) Case: 1: 18-sc-02570
or ;aentify 1he person by name and address) ) Ass!gned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH THREE ACCOUNTS )
STORED AT PREMISES CONTROLLED BY FACEBOOK ,

See Attachment A
located in the Northern
- - - -- - - -
District of - - -- --
California
------
, there is now concealed (identify the
See Attachment B
The basis for the search under Fed. R. Crim. P. 41 ( c) is (check one or more):
rif property designed for use, intended for use, or used in committing a crime;

18 U.S.C. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy
18 u.s.c. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy

0 Delayed notice of days (give exact ending date if more than 30 days: ) is requested ·
~___-/
!Kyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI

Date:
I
IN THE UNITED STATES DISTRICT COURT AUG - 2 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptc
Courts for the District of Co/umbra
INFORMATION ASSOCIATED WITH Case: 1:18-sc- 02570
THREE FACEBOOK ACCOUNTS Ass!gned To: Howell, Beryl A
STORED AT PREMISES CONTROLLED Assign. Date: 8/2/2o 18
BY FACEBOOK, INC. Description : Search & Seizure Warrant
information associated with the Facebook accounts associated with the following user IDs:
which are stored at premises owned, maintained, controlled or operated by Facebook Inc., a social
networking company headquartered in Menlo Park, California ("Facebook"). The information to
be disclosed by Facebook and searched by the government is described in the following paragraphs
and in Attachments A and B.
-1 -
there is probable cause to believe that the Target Accounts contain evidence, fruits, or
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and
U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), and
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 30121(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the
information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities
of the Subject Offenses, further described in Attachment B.
JURISDICTION
competentjurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) . .. that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
-2-
GATES.
ii. Jerome CORSI
for the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of
-3-

Election
2015, Russian intelligence gained access to _Democratic National Committee (DNC) networks
-4-
, the DNC's cloud-based systems using the cloud provider's own technology. The individuals
those accounts.
-5-
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016
presidential election, including conspiracy to comrriit authorized access to protected computers.
(Case No. 1: 18-cr-OO 125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an
theDNC.
Hillary: DNC Hack Solved, So Now Stop Blaming Russia." The article stated: "It doesn't seem
why he did the hack of the DNC." The article also stated: "Guccifer 2.0 made a fateful and wise
-6-
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: "With regard
actually have communicated with AS SAN GE. I believe the next tranche of his documents
pertain to the Clinton Foundation but there's no telling what the October surprise may be." A
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he
had a close friend who served as an intermediary.
24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling
that MANAFORT had worked with a Washi1;1gton D.C.-based lobbying firms to influence U.S.
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted stating: "Trust me,
-7-
it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview
that same day, STONE reiterated that because of the work of a "'mutual acquaintance' of both
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in
the form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think
Julian Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat.
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the
29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted,
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement-which was
-8-
Day, November 8, 2016. On October 12, 2016, John Podesta-referring back to STONE's
August 21, 2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the
going to do. I think there's at least a reasonable belief that [Assange] may have passed this
information on to [STONE]." Commenting to the NBC News, STONE indicated that he had
never met or spoken with Assange, saying that "we have a mutual friend who's traveled to
London several times, and everything I know is through that channel of communications. I'm not
implying I have any influence with him or that I have advanced knowledge of the specifics of
what he is going to do. I do believe he has all of the e-mails that Hu'ma Abedin and Cheryl Mills,
the Clinton aides, thought were deleted. I hear that through my emissary."
-9-
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen
1
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
-10-
don't know of any crime you need to be pardoned for - best regards. R." That same day,
@JulianAssange responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us
into a deal."
E. CORSl's Communications with STONE, and Others Regarding

Forthcoming Leaks
17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE's
addresses, . On or about December 19, 2017, Chief Judge Beryl A.
Howell issued a search warrant for email account. On or about March 14, 2018,
Chief Judge Beryl A. Howell issued a search warrant for STONE's iCloud account. Information
recovered pursuant to those search warrants indicated the following:
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger
Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
-11-
appears to have forwarded the message to STONE at who replied to
CORSI that, "May meet Manafort -guarantee nothing."
CORSI wrote,
CORSI with the subject line, "Call me MON." The body of the email read: " should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist-tum him for
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug.
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w
-12-
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about.
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I
· expect that much of next dump focus, setting stage for Foundation debacle." Investigators
believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps" refers to
Julian AS SAN GE, the founder of WikiLeaks, who resided in Ecuador's London Embassy in
2016.
Julian Assange last night." subsequently stated to investigators that, around the
same time, STONE told him he had gone to London to meet AS SAN GE. also stated
that in 2018, told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE told he was joking and
had not actually met ASSANGE.
: "Give me a call today if you can. Despite MSM drumroll that HRC is
: "Did you get the PODESTA writeup." STONE replied "yes."
-13-
S [b ]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
about file[.]" In a subsequent meeting with investigators, indicated this
conversation concerned possible derogatory information he was trying to obtain from Turkey.
and asked: "Assange-what's he got? Hope it's good." STONE wrote
BANNON and wrote: "You should call Roger. See below. You didn't get from me." BANNON
wrote back, "I've got important stuff to worry about." The associate responded, "Well clearly he
knows what Assange has. I'd say that's important."
-14-
55. On or about October 4, 2016, CORSI messaged STONE at his iClciud account:
"Assange made a fool of himself. Has nothing or he would have released it. Tota! BS hype."
56. That same day, BANNON emailed STONE a "What was
cut deal w/ clintons???" Stone replied, "Don't think so BUT his lawyer is a big
democrat."
Are Released.
a source regarding a previously unaired video of candidate Trump. According to the same
article, "Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage
2
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-1 le6-875e-2cl bfe943b66_story.html
-15-
from a 2005 segment on 'Access Hollywood,' the Washington Post reporter was on the phone,
calling Trump's campaign, 'Access Hollywood,' and NBC for reaction."
On or about August 2, 2016, when CORSI emailed STONE on , he
wrote, "I expect that much of next dump focus, setting stage for Foundation debacle."
65. At approximately 6:27PM sent STONE an email titled,
"WikiLeaks -The Podesta Emails," with a link to the newly-released Podesta emails.
Approximately ten minutes later, STONE, using , forwarded
message to CORSI without comment. STONE does not appear to have forwarded the email to
any other individual.
-16-
G. STONE Requests to CORSI for "SOMETHING" to Post About Podesta After

66. On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed -
minutes later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T
numbers."
67. On or about Wednesday, October 12, 2016, at approximately 8: 17 AM, STONE,
emailed STONE at both , with a subject line
-17-
: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me
-18-
Foundation?"
a..:..:uuul, 'Tm iu NYC. Thinking about writing piece attacking Leer and other women. It's
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
intel to share."
AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
him[.] Otherwise he's dead anyway, once he's dropped what he has. IfHRC wins, Assange can
-19-
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
account, "Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'1? in
-20-
-21-
I. Statements Regarding STONE's Use of Facebook
86. On or about Friday, May 18, 2016, was voluntarily interviewed
by investigators from the Special Counsel's Office. told investigators that he became
STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE's
right-hand man.
87. According to STONE utilized the services of several individuals to
post social media content to Facebook and Twitter, and that he and STONE both
instructed these individuals about what to post. stated that he purchased a couple
hundred fake Facebook accounts as part of this work (including both new and existing accounts),
and that bloggers working for STONE would try to build what looked like real Facebook
accounts. 3 According to one of the individuals who did work for STONE on
Facebook in 2016 was Everett WILKINSON, a social media marketer and IT expert.
88. further stated that STONE wanted to push out WikiLeaks content
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails
was pushed out through STONE's Facebook and Twitter accounts.
3
Facebook requires that all users of Facebook accounts use their actual name while registering
and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
-22-
J. The Target Accounts
89. According to subscriber records obtained from Facebook, Target Account 1,
with Facebook user ID , is registered with the vanity name "rogerstone" and
the email address Target Account 1 is associated with
. Based on search warrant returns for STONE's account
, between on or about October 31, 2016 and November 3, 2016,
received receipts from Facebook for the purchase of a number of
advertisements associated with the Target Account, including advertisements with the following
excerpted titles (as set forth in the receipts):
• "BREAKING: New #Wikileaks emails prove that Team ... "
• "Roger Stone talked about WikiLeaks, Donald Trump, ... "
90. Additionally, on or about March 31, 2017, STONE received a Facebook receipt at
his Hotmail account for advertisements associated with Target Account 1, with the following
excerpted titles (as set forth in the receipt):
• "Stone Rebuts Charge of Russian Collusion"
• "I am not in touch with any Russians, don't have ... ,"
• "The charge that I am working for Russian ... ,"
• "In fullest statement yet on DNC hacking ... "
• "ROGER STONE - NO consensus that Guccifer 2.0 is a ... "
91. Target Account 2, with Facebook user ID , is registered
with the vanity name "rogerstone," using the email account . On or
about August 13, 2017, STONE received a receipt from Facebook for several advertisements
-23-
associated with Target Account 2, including an advertisement with the excerpted title, "I am not
in touch with any Russians ... "
92. Target Account 3 has the Facebook user ID and was created
on or about October 27, 2015. The account is registered in the name of using
the email address and the verified telephone number
According to a public records database, the telephone number is linked to
Search warrant returns for STONE's account contain a notification from
Google indicating that is listed as the recovery email for
Search warrant returns for STONE's account also
contain a number of emails from Facebook to relating to Target
Account 3, which may have bee.n auto-forwarded to STONE's Hotmail account. These emails
include a notification of a password change to Target Account 3 and at least one receipt for a
Facebook advertisement associated with Target Account 3, sent on or about June 30, 2016. At
least one of these emails was then forwarded to account .4
93. As explained further below, in my training and experience, I know that, in
addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
communicate with WikiLeaks and ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING FACEBOOK
94. Facebook owns and operates a free-access social networking website of the same
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish
4
told investigators that he would sometimes send emails from STONE's account.
-24-
accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.
95. Facebook asks users to provide basic contact and personal identifying information
to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
also assigns a user identification number to each account.
96. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
user's "Friends," such as profile changes, upcoming events, and birthdays.
97. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
-25-
98. Facebook users can create profiles that include photographs, lists of personal
interests, and other information. Facebook users can also post "status" updates about their
whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
who can view the user's profile.
99. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
100. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a Chat feature that allows users to send and receive instant messages
-26-
through Facebook. These chat communications are stored in the chat history for the account.
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call.
101. If a Facebook user does not want to interact with another user on Facebook, the
first user can "block" the second user from seeing his or her account.
102. Facebook has a "like" feature that allows users to give positive feedback or connect
to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
particular Facebook pages.
103. Facebook has a search function that enables its users to search Facebook for
keywords, usemames, or pages, among other things.
104. Each Facebook account has an activity log, which is a list of the user's posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
105. Facebook Notes is a blogging feature available to Facebook users, and it enables
users to write and post notes or personal web logs ("blogs"), or to import their blogs from other
services, such as Xanga, LiveJoumal, and Blogger.
106. The Facebook Gifts feature allows users to send virtual "gifts" to their friends that
appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are
-27-
free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.
107. Face book also has a Marketplace feature, which allows users to post free classified
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
108. In addition to the applications described above, Facebook also provides its users
with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
use of that application may appear on the user's profile page.
109. Some Facebook pages are affiliated with groups of users, rather than one individual
user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
the current status of the group profile page.
110. Facebook uses the term "Neoprint" to describe an expanded view of a given user
profile. The "Neoprint" for a given user can include the following information from the user' s
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
and use of Facebook applications.
-28-
111. Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
from what IP address the user did so.
112. Social networking providers like Facebook typically retain additional information
about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). In some cases, Facebook users may
communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
the provider or user as a result of the communications.
113. As explained herein, information stored in connection with a Facebook account
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
-29-
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accuunls along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understand the chronological and geographic context of the
account access and use relating to the crime under investigation. Such .information allows
investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
114. Therefore, the computers of Facebook are likely to contain all the material
described above, including stored electronic communications and information concerning
subscribers and their use of Facebook, such as account access information, transaction information,
and other account information.
-30-
kaa1," separate aml apart from the investigative team, in order to address potential privileges.
CONCLUSION
REQUEST FOR SEALING
-31-
~
Andrew Mitchell
Special Agent
8uhscrihecl flnd sworn to before me on this

·?!of August, 2018.
_Ld-ay
The Honorable eryl A. Howell

-32-
ATTACHME NT A
This warrant applies to information associated with the following Facebook accounts,
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc.
("Facebook"), a company headquartered at 1 Hacker Way, Menlo Park, California 94025:
-1-
ATTACHMENT B
custody, or control of Facebook Inc. ("Facebook"), including any messages, records, files, logs, or
information that have been deleted but are slill available lo Facebook, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(:t), Facebook is required to disclose the
following information to the government for each user ID listed in Attachment A:
(a) All contact and personal identifying information, including full name, user
tags; and information about the user's access and use of Facebook applications;
-2-
"Friend" requests;
lalitude and longitude;
G) All information about the Facebook pages that the account is or was a "fan" of;
(1) All records of Facebook searches performed by the account;
(m) All information about the user's access and use of Facebook Marketplace;
number);
-3-
(s) All pnvacy settings and other account settings, including privacy settings for
and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present,
including:
-4-
communications or meetings involving Roger Stone, Jerome
Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the
Trump Campaign;
principals;
e. Communications, records, documents, and other files that reveal efforts by any
foreign principals;
f. Evidence indicating how and when the account was accessed or used, to determine
g. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
h. The source of all funds used to purchase advertisements or make other expenditures
or disbursements in these accounts;
i. The identity of the person(s) who created or used the account, including records
-5-
J. The identity of any non-U.S. person(s)-including records that help reveal the
k. The identity of any person(s)-including records that help reveal the whereabouts
principals.
-6-

for the

(Briefly describe the property to be searched ) Case: 1: 18-sc-02581
or identify the person by name and address) ) Assigned To: Howell, Beryl A.
INFORMATION ASSOCIATED WITH THREE ) Assign. Date : 8/3/2018
ACCOUNTS STORED AT PREMISES CONTROLLED ) Description: Search & Seizure Warrant
BY MICROSOFT, GOOGLE, AND APPLE )

See Attachment E
See Attachment F
~ in the daytime 6:00 a.m. to 10:00 p.m. l'J at any time in the day or night because good cause has been established.
property was taken.
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge
l'J Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
['J for _ _ days (not to exceed 30) ['J until, the facts justifying, the later specific date of
Date and time issued: <7/;1/~/ r ~ z :s:r/A_ ____~~

.--~
- "_A_~- - - ' . ! u d ge 's signature
Return
Certification
designated judge.
Date:

ATTACHMENT E
This warrant applies to information associated with the following Apple DSID:
created or maintained between March 14, 2018 and the present, that is stored at premises owned,
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino,
California 95014.
53
ATACHMENTF
To the extent that the information described in Attachment E is within the possession,
deleted but are stilJ available to Apple, or have been preserved pursuant to a request made under
in unencrypted form whenever available, for each account or identifier listed in Attachment E:

Station Equipment Identities ("IMEi");
all attachments;
54

55
Any and all records that relate in any way to the accounts described in Attachment A which
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June
1, 2015 to present, including:
communications or meetings involving Jerome Corsi, Julian Assange,
Randy Credico, or any individual
associated with the Trump Campaign;


1. All existing printouts from original storage which concern the categories identified in
subsection II.a
56

for the AUG -· 3 2018
Clerk, U.S. D1strict & BankruptcJr
Courts for t~e District of Golumliia
(Brie.fly describe 1/,e property lu be searched ) Case: 1:18-sc-02581
or identify lh.e person by nam ond addres~) )
INFORMATION ASSOCIATED WITH THREE ACCOUNTS Assigned To : Howell, Beryl A.
STORED AT PREMISES CONTROLLED BY MICROSOFT, j Assign. Date: 8/3/2018
GOOGLE, AND APPLE ) Description: Search & Seizure Warrant

penalty of pe1jllly that I have reason to believe that on the following person or property (identifjl the person or describe the
properly to be searched and give its location):
See Attachment E
located in the --------
Northern District of California
- - - - - - - - -- - -
See Attachment F
The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more):
~ contraband, fruits of crime, or other i~ems illegally possessed;
0 a person to be an-ested or a person who is unlawfully restrained.

18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering
18 u.s.c. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy
See Affidavit for add'I
r/ Continued on the attached sheet.

0 Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the arta ed sheet.
!Aaron Zelinsky {ASC) Andrew Mitchell, Special Agent, FBI

Date:
AUG - 3 2018
Cferk, U.S. Dlstrlci & Bankruptcy

THREE ACCOUNTS STORED AT Assigned Tu : Howell, Beryl A.
PREMISES CONTROLLED BY Assign. Date : 8/3/2018
MICROSOFT, GOOGLE, AND APPLE Description: Search & Seizure Warrant
a. The email account (hereafter "Target Account 1), that is
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be
disclosed by Microsoft and searched by the government is described in the following paragraphs
b. The email account (hereafter "Target Account 2"), that is
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The
following paragraphs and in Attachments C and D.
c. The iCloud account associated with the Apple ~mail account
(hereafter "Target Account 3"), that is stored at premises owned,

maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupe1iino, California 95014. The information to be disclosed by Apple and searched by
the government is described in the following paragraphs and in Attachment E and F.
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses").
issued a search warrant for Roger STONE's Hotmail address, (Target
Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE's
Gmail address, (Target Account 2). On or about March 14, 2018, Chief
Judge Howell issued a search warrant for STONE's iCloud account (Target Account 3). This
2
warrant seeks to search those accounts from the date each respective warrant was issued to the
present.
JURISDICTION
competentjurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
including in paragraphs 14, 19, and 61.
SUMMARY
7. This application seeks authority to search, from the date of search warrants
previously issued by the Court to the present, three accounts believed to be used by Roger
STONE: Target Account 1, which is STONE's account; Target Account 2, which is
STONE's account; and Target Account 3, which is STONE's iCloud account. As set
forth herein, there is probable cause to believe that each of the Subject Accounts contains
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with
witnesses, and make false statements.
8. For example, as set forth in more detail below, in recent months STONE has
reached out to communicate with multiple witnesses he knew or had reason to believe were
scheduled to testify before Congress about interactions with STONE during the 2016 presidential
campaign or were scheduled to meet with the Special Counsel's Office
. After STONE learned that one witness, Randy
CREDICO, was prepared to contradict STONE's congressional testimony, STONE repeatedly
3
urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so
through multiple text messages. In June 2018, STONE instructed his private investigator to
provide him with a full background investigation on another witness, who had
done information technology work for STONE during the campaign
9. In September 2017, STONE released a statement he said he provided to Congress
in which he denied having advance knowledge of "the source or actual content of the Wikileaks
disclosures regarding Hillary Clinton." He also stated publicly that when he tweeted during the
campaign, on August 21, 2016, "it will soon the Podesta's time in the barrel," he was not
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
dealings with Russia." Evidence obtained in the investigation, however, shows the following:
a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to "Get
to Assange" at the Ecuadorian Embassy and "get pending WikiLeaks emails[.]" Julian
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
CORSI to have contact ASSANGE. On or about August 2, 2016, CORSI
responded to STONE that the "[w]ord is friend in embassy plans 2 more dumps. One shortly
after I'm back. 2nd in Oct. Impact planned to be very damaging .... Time to let more than
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC." After receipt of
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me,
it will soon the Podesta's time in the barrel. #CrookedHillary."
b. Information disclosures subsequently occurred on or about the times
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the
United States ("shortly after I'm back"), Guccifer 2.0 released hacked information related to the
4
the Washington Post published a breaking story about an Access Hollywood videotape of then-
c. Furthermore, on the day of the Access Hollywood video disclosure, there
were phone calls between STONE and CORSI after the Washington Post contacted STONE
prior to publication. At approximately 11 :OOAM, the Washington Post received a tip regarding
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM,
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post
published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks
tweeted out its first release of emails hacked from John Podesta.
5
PROBABLE CAUSE.
i. Roger STONE
continued to make media appearances in support of the Campaign. As described further below,
STONE also maintained contact with individuals employed by the Campaign, including then-
campaign chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
contact with STONE during the summer and fall of2016 regarding forthcoming disclosures of
6
B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking

Activity during the 2016 Presidential Election
a. The U.S. Intelligence Community ("USIC") is confident that the Russian
with the methods and motivations of Russian-directed efforts. These thefts and disclosures were
7
intended to interfere with the U.S. election process. Such activity is not new to Moscow-the
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to .
a. "Russian President Vladimir Putin ordered an influence campaign in 2016
b. · The USIC also described, at a high level, some of the techniques that the
Russian government employed during its interference. The USIC summarized the efforts as a
"Russian messaging strategy that blends covert intelligence operations-such as cyber activity-
with overt efforts by Russian Government agencies, state-funded media, third-party
c. With respect to "cyber activity," the USIC assessed that "Russia's
intelligence services conducted cyber operations against targets associated with the 2016 US
presidential election, including targets associated with both major US political parties." Further,
"[i]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC)
networks and maintained that access until at least June 2016." The USIC attributed these cyber
8
activities to the Russian GRU, also known as the Main Intelligence Directorate: "GRU
operations resulted in the compromise of the personal e-mail accounts of Democratic Party
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the
DNC." The GRU is the foreign military intelligence agency of the Russian Ministry of Defense,
and is Russia's largest foreign intelligence agency.
d. With respect to the release of stolen materials, the USIC assessed "with
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to
e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made
multiple contradictory statements and false claims about his identity throughout the election.
November 1, 2016.
those accounts.
emails were later posted on DCLeaks.
9
19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons
and entities involved in the 2016 U.S. presidential election, steal documents from those
computers, and stage releases of stolen documents in order to interfere with the election. The
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign
Committee ("DCCC"), and the chairman of the Clinton campaign (John Podesta). See United
States v. Viktor Borisovich Netyksho, et al. (I: 18-cr-215) (D.D.C.). 1
D. Roger STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
Russian government actors. The media reported on the announcement. On June 15, 2016, the
the DNC.
1A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
administering elections, including state boards of election, secretaries of state, and companies that supply software
and other technology used to administer elections.
10
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world
would see for themselves how the Democrats had rigged the game."
Organization. During his speech, he was asked about a statement by ASSANGE to Russia
Today (RT) several days earlier about an upcoming "October Surprise" aimed at the Hillary
Clinton presidential campaign. Specifically, STONE was asked: "With regard to the October
surprise, what would be your forecast on that given what Julian Assange has intimated he's
going to do?" STONE responded: "Well, it could be any number of things. I actually have
Foundation but there's no telling what the October surprise may be." A few days later, STONE
clarified that while he was not personally in touch with ASSANGE, he had a close friend who
24. On August 12, 2016, Gucci fer 2.0 publicly tweeted: "@RogerJStoneJr thanks that
11
resigned as Chairman of the Trump Campaign.
28. As noted above, on August 21, 2016, using@RogerJStoneJR, STONE tweeted:
"Trust me, it will soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN
interview that same day, STONE reiterated that because of the work of a "'mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
whistleblower in the form of strategically-dumped Clinton email batches." He added: "Well,
first of all, I think Julian Assange is a hero ... I think he's taking on the deep state, both
Republican and Democrat. I believe that he is in possession of all of those emails that Huma
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are
like the Watergate tapes."
Radio that he expected WikiLeaks to "drop a payload of new documents on Hillary on a wee~ly
tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
12
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement- which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr
Day, November 8, 2016. On October 12, 2016, Podesta- referring back to STONE's August 21,
2016 C-SPAN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his
[STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
with Assange, saying that "we have a mutual friend who's traveled to London several times, and
everything I know is through that channel of communications. I'm not implying I have any
13
E. STONE's Private Twitter Direct Messages with WikiLeaks and ASSANGE
Twitter account @RogerJStoneJr. Information recovered from the search of that account
includes the following:
a. On October 13, 2016, while WikiLeaks was in the midst of releasing the
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account
@wikileaks. Thi~ account is the official Twitter account of WikiLeaks and has been described as
b. Less than an hour later, @wikileaks responded by direct message: "We
c. On or about October 15, 2016, @RogerJStoneJr sent a direct message to
@wikileaks: "Ha! The more you \"c01Tect\" me the more people think you're lying. Your
14
d. On or about November 9, 2016, one day after the presidential election,
e. In addition, @RogerJStoneJr also exchanged direct messages with
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating:
"Still nonsense. As a journalist it doesn't matter where you get information only that it is
accurate and authentic. The New York Times printed the Pentagon Papers which were
f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in
this forum as experience demonstrates it is monitored. Best regards R."
15
F. STONE's Communications with STONE, and Others Regarding

Forthcoming Leaks
37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search
warrant for STONE's address, (Target Account 1); on
October 17, 2017, Chief Judge Howell issued a search warrant for STONE's address,
(Target Account 2); and on or about March 14, 2018, Chief Judge
Howell issued a search warrant for STONE's iCloud account (Target Account 3). In addition,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
email account. Information recovered pursuant to those search warrants includes the following:
a. On or about May 15, 2016, emailed CORSI: "Here is my
flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
Roger Stone so he knows your availability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI
that, "May meet Manafort -guarantee nothing."
b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1
CORSI wrote,
c. On July 25, 2016, STONE, using Target Account 1, sent an email to
16
d. On or about July 31, 2016, STONE, using Target Account 1, emailed
CORSI with the subject line, "Call me MON." The body of the email read: ,should see
Assange[.] should find Bernie [SJ anders brother who called Bill a Rapist - turn him for
e. As noted above, on or about August 2, 2016 (approximately 19 days
before STONE publicly tweeted about "Podesta's time in the barrel"), CORSI emailed STONE
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shottly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued: "Signs are Fox
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor,
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage
for Foundation debacle." Investigators believe that CORSI's reference to a "friend in embassy
[who] plans 2 more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in
2016.
f. On or about August 5, 2016, , an associate of STONE's,
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton
led Trump by 15 points. STONE responded, "enjoy it while u can[.] I dined with my new pal
17
same time, STONE told him he had gone to London to meet ASSANGE. also stated
that in 2018 told STONE he would be interviewed by the FBI and would have to
divulge the conversation about meeting AS SAN GE. STONE tol he was joking and
had not actually met ASSANGE. 2
g. On or about August 15, 2016, CORSI emailed STONE at Target Account
h. On or about August 31, 2016, CORSI emailed STONE at Target Account
1: "Did you get the PODESTA writeup." STONE replied "[y]es."
1. On or about August 31, 2016, CORSI messaged STONE at Target
Account 3, "Podesta paid $I 80k to invest in Uranium One - was hired by Rosatom in Giustra
reveals Podesta hired by S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to
J. On or about September 6, 2016, CORSI emailed STONE at Target
Account 1: "Roger[,] Is NY Post going to ~se the Pedesta [sic] stuff?"
k. On or about September 24, 2016, emailed CORSI, "I will
have much more on Turkey. Need a back channel highly sensitive stuff." CORSI responded,
18
"We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to
him about it again today." wrote back, "Awaiting secret file. Explosive ... Hope you
are well. Can't wait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me
posted about file[.]" In a subsequent meeting with investigators, indicated this
I. On or about October 3, 2016, an associate of STONE emailed STONE at
Target Account 2 and asked: "Assange - what's he got? Hope it's good." STONE wrote back,
"It is. I'd tell Bannon but he doesn't call me back. My book on the TRUMP campaign will be
out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
who was CEO of the Campaign at the time, and wrote: "You should call Roger. See below. You
didn't get from me." BANNON wrote back, "I've got important stuff to worry about." The
m. On or about October 4, 2016, ASSANGE gave a press conference at the
n. On or about October 4, 2016, CORSI messaged STONE at Target
Account 3, "Assange made a fool of himself. Has nothing or he would have released it. Total
BS hype."
19
o. That same day, BANNON emailed STONE at Target Account 2, "What
was that this morning???" STONE replied, "Fear. Serious security concern. He thinks they are
going to kill him and the London police are standing done [sic]." BANNON wrote back, "He
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a
big democrat."
p. When BANNON spoke with investigators during a voluntary interview on
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and
Are Released
Friday, October 7, 2016, Washington Pos.t reporter David Fahrenthold received a phone call from
calling Trump's campaign, 'Access Hollywood' and NBC for reaction."
3
https://www.washingtonpost.com/lifestyle/style/the-cal\er-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/31 d74714-8ce5-l le6-875e-2c 1bfe943b66_story.html
20
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, "I expect that much
of next dump focus, setting stage for Foundation debacle."
45. At approximately 6:27PM, an author who has written about the
Clinton Foundation, and who, according to emails and phone records, regularly communicates
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the .
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target
Account 2, forwarded message to CORSI without comment. STONE does not appear
to have forwarded the email to any other individual.
H. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
Accused of Advance Knowledge of the Leak
46. On or about October 8, 2016, STONE, using Target Account 3, messaged
CORSI, "Lunch postponed-have to go see T." CORSI responded to STONE, "Ok. I
understand." Approximately twenty minutes later, CORSI texted, "Clintons know they will lose
21
a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs
speech comments, attacking badjob numbers."
using Target Account 2, emailed Corsi asking him to "send me your best podesta links."
STONE emailed CORSI at approximately 8:44AM, "need your BEST podesta pieces." CORSI
wrote back at approximately 8:54AM, "Ok. Monday. The remaining stuff on Podesta is
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM,
CORSI emailed STONE at both Target Account 1 and 2 with the subject line "Podesta talking
points." Attached to the email was a file labeled, "ROGER STONE podesta talking points Oct
122016.docx." The "talking points" included the statement that "Podesta is at the heart of a
Russian-government money laundering operation that benefits financially Podesta personally and
the Clintons through the Clinton Foundation."
CORSI back via Target Account 1: "Got them and used them."
50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target
Account 2: "PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON
FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post under my
by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back to
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22
Metcombank[.] The Russians launched a criminal investigation(.] [web link] Once
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent
STONE an email at Target Account 2, with the subject, "ROGER STONE article RUSSIAN
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN
PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
That same day, STONE posted a blog post with the title, "Russian Mafia money laundering, the
Clinton Foundation and John Podesta." In that post, STONE wrote, "although I have had some
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr.
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked,
"Just how mucl:i money did , a controversial Russian billionaire investor with
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian
regional bank owned 99.978 percent by , with the money transferred via Deutsche
Bank and Trust Company Americas in New York City, with the money ending up in a private
bank account in the Bank of America that is operated by the Clinton Foundation?"
52. On or about October 14, 2016, CORSI sent a message to STONE at Target
Account 3, "I'm in.NYC. Thinking about writing piece attacking Leer and other women. It's
23
53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3,
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u - just
landed JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important
intel to share."
54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1
and 2 with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote, "From a very trusted
source," and forwarded an email with the header information stripped out, showing only the
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offl.]' Only
hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's dropped
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to
play out. He's called Podesta's bluff and raised him the election."
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
STONE stated, "I predicted that Podesta's business dealings would be exposed. I didn't hear it
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on
24
58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3,
"Are you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in London.
Have some interesting news for you."
25
J. STONE's Congressional Testimony and Public Statements About His Relationship

with Wikileaks
61. On September 26, 2017, STONE testified before the House Permanent Select
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the
public what he said were his opening remarks to the committee. In them, STONE stated:
Members of this Committee have made three basic assertions against me which must be
rebutted here today. The charge that I knew in advance about, and predicted, the hacking
of Clinton campaign chairman John Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or
that, my now public exchange with a persona that our intelligence agencies claim, but
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again,
such assertions are conjecture, supposition, projection, and allegations but none of them
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta' s
time in the barrel. #CrookedHillary" must be examined in context. I posted this at a time
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump
campaign over allegations regarding his business activities in Ukraine. I thought it
manifestly unfair that John Podesta not be held to the same standard. Note, that my
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta's email, but
does accurately predict that the Podesta brothers' business activities in Russia with the
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal,
would come under public scrutiny ....
[L]et me address the charge that I had advance knowledge of the timing, content and
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks'
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails.
27
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed
Assange to independently confirm this repot1, and he subsequently did. This journalist
assured me that WikiLeaks would release this information in October and continued to
assure me of this throughout the balance of August and all of September. This
info11nation proved to be correct. I have referred publicly to this journalist as an,
"intermediary" , "go-between" and "mutual friend." All of these monikers are equally
true.
62. Tn a document dated March 26, 2018 titled "Minority Views," Democratic
members of HPSCI published excerpts from Stone's September 2017 testimony before HPSCI.
Those excerpts include the following:
Q: Have any of your employees, associates, or individuals acting on your behest or

encouragement been in any type of contact with Julian Assange?
MR. STONE: No.
Q: So throughout the many months in which you represented you were either in
communication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intermediary -
MR. STONE: That-
Q: -- was the length and the breadth of what you were referring to?
MR. STONE: That is correct, even though it was repeated to me on numerous separate
occasions.
63. In the month that followed his testimony before HPSCI, on or about October 24,
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the barrel' referred to and not, as some
have quite falsely claimed, to the hacking and publication almost two months later of John
Podesta's emails .... [M]y tweet referred to Podesta's business dealings with Russia, and the
expectation that it would become a news story."
K. STONE's Use of Target Account 3 to Message Randy CREDICO about STONE's

"Back channel"
28
64. On November 19,2017, Randy CREDICO (who, as described further below,
STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE on Target
Account 3, "My lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
65. On or about November 21, 2017, CREDICO messaged STONE on Target
Account 3, "I was told that the house committee lawyer told my lawyer that I will be getting a
subpoena[.]" STONE wrote back, "That was the point at which your lawyers should have told
them you would assert your 5th Amendment rights if compelled to appear." They continued to
message, and CREDICO wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To
do what ? Nothing happening in DC the day before Thanksgiving - why are u busting my
chops?"
66. On or about November 24, 2017, STONE, using Target Account 3, texted
CREDICO, "Assange is a journalist and a damn good one- meeting with him is perfectly legal
and all you ever told me was he had the goods [o]n Hillary and would publish them - which he
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "I told
you to watch his tweets. That's what I was basing it on. I told you to watch his Tweets in
October not before that I knew nothing about the DNC stuffT,] I just followed his tweets[.]"
STONE responded, "U never said anything about the DNC but it was August." CREDICO
wrote back, "It was not August because I didn't interview him or meet him until August 26th[.]
That was my first communication with his secretary in London, August 26th." STONE wrote
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"
29
67. STONE and CREDICO continued to exchange messages via Target Account 3,
and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
no back Channel. So now you can relax."
68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he
received from HPSCI that was dated November 27, 2017. Toll records show that on November
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen
times.
69. On November 29, 2017, STONE publicly stated that CREDICO was his
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June 12, 2016 with the
British ITV network, where Assange said he had 'e-mails related to Hillary Clinton which are
pending publication,' ... Credico never said he knew or had any information as to source or
content of the material."
70. On or about December 1, 2017, CREDICO messaged STONE on Target
Account 3, stating, "I don't know why you had to lie and say you had a back Channel now I had
to give all of my forensic evidence to the FBI today what a headache[.] 4 You could have just told
him the truth that you didn't have a back Channel they now know that I was not in London until
September of this year[.] You had no back-channel and you could have just told the truth ...
You want me to cover you for perjury now[.]" STONE responded, "What the fuck is your
problem? Neither of us has done anything wrong or illegal. You got the best press of your life
and you can get away with asserting for 5th Amendment rights if u don't want talk about AND if
4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
30
you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
up to six counts of perjury[.] But I'm sure that wasn't sworn testimony so you're probably
clear[.] Council for the committee knows you never had a back Channel and if you had just told
the truth wouldn't have put me in this bad spot ... you should go back ... and amend your
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a ce1iain [sic] my Fifth Amendment rights but you can. I
guarantee you you [sic] are the one who gets indicted for perjury if you're stupid enough to
testify[.]"
71. STONE and CREDICO continued to message each other on or about December 1,
2017. In response to STONE's message about being "stupid enough to testify," CREDICO told
STONE: "Whatever you want to say I have solid forensic evidence." STONE responded: "Get
yourself a real lawyer instead of some liberal wimp who doesn't know how to tell his guys to
fuck off good night." CREDI CO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th[.]" STONE responded: "You got nothing."
72. On or about December 13, 2017, according to public reporting, CREDICO
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights.
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with
a reporter. STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]"
CREDICO messaged STONE, "I have the email from his chief of staff August 25th 2016
responding to an email I sent to WikiLeaks website email address asking you would do my
show[.] That was my initial contact."
31
74. On or about January 8, 2018, CREDTCO messaged STONE on Target Account 3
stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
conversations with Assange until September of last year."
75. CREDICO and STONE continued to message each other, and on or about January
25, 2018, CREDICO wrote to STONE on Target Account 3: "You lied to the house Intel
committee ... But you'll get off because you're friends with Trump so don't wo1Ty. I have all
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September
of 2016 to prove it[.]"
76. On or about April 13, 2018, news reports stated that CREDICO had shown
reporters copies of email messages he had received from STONE in the prior few days that
stated, "You are a rat. You are a stoolie. You backstab your friends - run your mouth my
lawyers are dying Rip you to shreds." Another message stated, "I'm going to take that dog away
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "certainly scary .
. . When you start bringing up my dog, you're crossing the line[.]" 5
77. On or about May 25, 2018, CREDICO provided additional messages he stated
were from STONE to another news agency. 6 In these messages, STONE, on April 9, 2018,
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the article, CREDICO stated that he
considered this email from STONE a threat. STONE stated in the article that CREDICO "told
me he had terminal prostate cancer ... It was sent in response to that. We talked about it too.
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog-
135911370.html
6
https ://www.motherjones.com/ po Iitics/2018/0 5/ro ger-stone-to-associate-prepare-to-die/
32
He was depressed about it. Or was he lying." The article noted that CREDICO stated he did not
have prostate cancer and did not have any such discussion with STONE.
L. STONE's Use of the Target Accounts to Communicate with Individuals Related to

the Investigation
78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap
devices on Target Account 1 and Target Account 2. The information obtained from that order,
along with information obtained from toll records, revealed that STONE has continued to use
Target Account 1 and Target Account 2, and that he has used them to communicate with
individuals related to the investigation.
79. For example, STONE and communicated twice on May 28 and May
29, 2018 using Target Account 1. , a former associate of STONE's, was
interviewed by the Special Counsel's Office on or aboi1t May 2, 2018. Toll records _show that
and STONE communicated multiple times on May 5, 2018, and STONE
communicated with using Target Account 1 on June 1, 2018 and June 6, 2018.
, a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and
July 12, 2018.
80. STONE has also used Target Account 2 to communicate with individuals
associated with this investigation.
a. For example, between May 23, 2018 and the present, STONE and CORSI
exchanged at least five messages using Target Account 2. In the same time period, STONE
exchanged at least 75 emails with CREDICO using Target Account 2.
33
•
b. Also in this same time period, STONE emailed at least
ten times using Target Account 2. is a former employee of STONE. On May 9,
2018, FBI agents approached and That day,
and again on May 10, 2018, communicated by phone with
STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails
wit , using Target Account 2. In addition, between on or about June 14, 2018 and
June 17, 2018, and STONE exchanged five emails using Target Account 2.
81. STONE has also used a phone number associated with Target Account 3 to
communicate with a private investigator hired by STONE. was
interviewed by investigators on June 7, 2018, and subsequently info1med investigators that in
June 2018, STONE instructed him to conduct a full background investigation on
who had been employed by STONE during the Campaign as an info1mation technology
specialist.
also told investigators that in June 2018, STONE instructed him to find
an address for CREDICO that could be used to serve CREDICO with legal process.
told investigators that his primary form of communication with STONE is by text
message on Target Account 3.
34
35
IP address infonnation can help to identify which computers or other devices were used to access
the email account.
36
infonnation maintained by the email Providers can show how and when the account was
has occurred.
at htip://images.apple.com/ privacy/docs/.l cgal-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.apple.com/en-us/HT203993; "iCioud," available at htlj ://www.apple.com/ icloud/; "What
does iCloud back up?," available at https://suppo1i .app le.corn/kb/PHJ 25 19; "iOS Security," available at
37
domain names mac.com, me.corn, and icloud.com.
b. iMessage and FaceTirne allow users of Apple devices to communicate in
https://www.appl e.com/business/docs/iOS Security Guide.pdt: and "iCloud: How Can I Use iCloud?," available at
https://suppo1t.apple.com/kb/PH26502.
38
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and
Apple devices.
purchased through iTunes Store on iOS devices and .on desktop and laptop computers running
39
syncing mechanism.
(often ending in @icloud.com, @me.com, [email protected]) or an email address associated with a
40
Store, iC!oud, Game Center, and the My Apple ID and iForgot pages on Apple's website. Apple
Apple.
device.
41
susp1c10n.
42
97. l anticipate executing this warrant under the Electronic Communications Privacy
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the
CONCLUSION
REQUEST FOR SEALING
k~___/
Andrew Mitchel l
Special Agent
43
Subscribed and sworn to before me on this .P'{ y of August, 2018.
/ )/ ~_./ ,
- ~-~ /;Arr-Cz,1/
44
ATTACHMENT A
This warrant applies to information associated with the email address:
created or maintained between September 11, 2017 and present, that is stored at premises owned,
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered
at One Microsoft Way, Redmond, WA 98052.
45
ATTACHMENT B
to disclose the following infor1!1ation to the government for each account or identifier listed in
Attachment A:
c. AJI internet search data including all queries and location data;
46
abetting), 18 U.S.C . § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1,
2015 to present, including:
communications or meetings involving Jerome Corsi, , Julian Assange,


47
subsection II.a
48
ATTACHMENT C
created or maintained between October 17, 2017 and the present, that is stored at premises
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at
1600 Amphitheatre Parkway, Mountain View, CA 94043.
49
ATTACHMENT D
I. Files and Accounts to be produced by Google, Inc.
To the extent that the information described in Attachment C is within the possession,
pursuant to a preservation request under 18 U.S .C. § 2703(f), Google is required to disclose the
following information to the government for each account or identifier listed in Attachment C:

and/or locations;




timestamp;
50
j. YouTube subscriber information, private videos and files, private

l. Google Talk and Google Hangouts conversation logs associated with the
account.
51
Any and all records that relate in any way to the accounts described in Attachment C which


subsection II.a
52
ATTACHMENTE
California 95014.
53
ATACHMENTF
of the United States, including any messages, records, tiles, logs, or information that have been
18 U.S.C. § 2703(£), Apple is required to disclose the following infonnation to the government,

all attachments;
54

55
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction.of justice), 18 U.S.C.


subsection II.a
56

for the

or identify the person by name and address) ) Ass!gned To: Howell, Beryl A.
INFORMATION ASSOCIATED WITH THREE ) Assign. Date : 8/3/2018
ACCOUNTS STORED AT PREMISES CONTROLLED )
BY MICROSOFT, GOOGLE, AND APPLE ) Description: Search & Seizure Warrant

(identify the person or describe the property lo be searched and give its location):
See Attachment C
See Attachment D
~ in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
property was taken.
(United States Magistrale Judge)
Return
Certification
designated judge.
Date:

ATTACHMENT C
created or maintained between October 17, 2017 and the present, that is stored at premises
49
ATTACHMENTD

and/or locations;




timestamp;
50
j. YouTube subscriber infonnation, private videos and files, private

I. Google Talk and Google Hangouts conversation logs associated with the
account.
51


subsection II.a
52
UNITED STATES DISTRICT COURT f

for the AUG ._ 3 201H
District of Columbia Clerk, U. S, lllstrlct & Bankrupic}
Courts for t~e District of Columola
(Briefly describe rhe property to be searched )
or ide11tifj1 l11e person by name a11d,addrcss) ) Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH THREE ACCOUNTS ) Assign. Date : 8/3/2018
STORED AT PREMISES CONTROLLED BY MICROSOFT, )
GOOGLE, AND APPLE )

property to be searched and give its localion):
See Attachment C
located in the - - - - - District of
- - -Northern California
- -- - - - - - - - - -
See Attachment D
The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more):

18 u.s.c. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy

under 18 U.S.C. § 3103a, the basis of which is set forth on ~
Reviewed by AUSA/SAUSA: Applicam's signature
!Aaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI

Date:
.Judge 's signature
Printed name and litle
]: i,'
AUG - 3 2018
Clerk, U.S. ()istrlc:t & Bunkruptc}'
lN THE MATTER OF THE SEARCH OF Case: 1: 18-sc-02583

INFORMATION AS SOCIATED WITH Assigned To : Howell, Beryl A.
THREE ACCOUNTS STORED AT Assign . Date : 8/3/2018 .
PREMISES CONTROLLED BY Descript ion: Search & Seizure Warrant
MICROSOFT, GOOGLE, AND APPLE
a. The email accoun (hereafter "Target Account 1), that is
b. The email accoun (hereafter "Target Account 2"), that is
c. The iCloud account associated with the Apple email account

maintained, controlled, or operated by Apple, Inc., a business with offices located at I Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
U.S.C. § J 030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
issued a search warrant for Roger STONE' address, (Target
address, (Target Account 2). On or about March 14, 2018, Chief
2
present.
JURISDICTION
competentjurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
§ 27I 1(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below,
SUMMARY
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set
"
3
provide him with a full background investigation on another witness who had
done information technology work for STONE during the campaign and
referring to the hacking or publication of John Podesta's emails, but rather. to "Podesta's business
ASSANGE is the founder ofWikiLeaks. On or about July 31, 2016, STONE also instructed
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
4
5
PROBABLE CAUSE.
i. Roger STONE
ii. Jerome CORSI
6

7
electability and.potential presidency. We further assess Putin and the Russian Government
b. The USIC also described, at a high level, some of the techniques that the
"Russian messaging strategy that blends covert intelligence operations-such as cyber activity-
presidential election, including targets associated with both major US political parties." Further,
8
November 1, 2016.
used three new accounts with the same cloud computing service to move the."snapshots" to
those accounts.
9
18. On or about November I, 2016, individuals associated with the GRU
States v. Viktor Borisovich Netyksho, et al. (1: 18-cr-215) (D.D.C.). 1
theDNC.
1
A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
10
Organization. During his speech, he was asked about a statement by AS SAN GE to Russia
11
26. On August 17, 2016, Guccifer 2.0 publicly tweeted, "@RogerJStoneJ r paying you
28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted:
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE], the public [could] expect to see much more from the exiled
12
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Info wars that his intennediary
13
STONE as stating: "S\nce I never communicated with WikiLeaks, I guess I must be innocent of
a. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the
14
f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to
15
F. STONE's Communications with STONE , and Others Regarding

Forthcoming Leaks
warrant for STONE's address, (Target Account 1); on
October 17, 2017, Chief Judge Howell issued a search warrant for STONE' address,
on or about December 19, 2017, Chief Judge Howell issued a search warrant for
flight schedule. Need to get something confirmed now .... " CORSI responded, ."! copied
CORSI wrote,
16
d. On or about July 31, 2016, STONE, using Target Account 1, emailed
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist- tum him for
Trump[.] should fin e or more proof of Bill getting kicked out."
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
for now. Post-DNC bump for HR.Can artifact ofrigged polling. Won't last. I expect
2016.
f. On or about August 5, 2016, an associate of STONE's,
17
same time, STONE told him he had gone to London to meet ASSANGE also stated
1. On or about August 31, 2016, CORSI messaged STONE at Target
Account 3, "Podesta paid $ l 80k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
Account 1: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
18
posted about file[.]" In a subsequent meeting with investigators, indicated this
Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,
m. On or about October 4, 2016, ASS ANGE gave a press conference at the
AS SAN GE would release information damaging to then-candidate Clinton, but WikiLeaks did
BS hype."
19
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a
big democrat."
BANNON had b~en hoping for releases of damaging information that morning.
Are Released
Friday, October 7, 2016, Washington Post reporter David Fahrenthold rece_ived a phone call from
39. According to phone record , at approximately
11 :27 AM, CORSI placed a ca.JI to STONE which STONE did not answer.
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/3 ld74 7l 4-8ce5- l l e6-875e-2cl bfe943b66_story.html
20
41. At approximately 1 :42PM, STONE called CORSI and the two spoke for
with STONE, sent STONE an email titled, "WikiLeaks -The Podesta Emails," with a link to the
CORSI, "Lunch postponed- have to go see T." CORSI responded to STONE, "Ok. I
21
speech comments, attacking bad job numbers."
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me like
22
Metcombank[.] The Russians launched a criminal investigation(.] [web link] Once
SOMETHING to post on Podesta since I have no.w promised it to a dozen MSM reporters[.]"
"Just how much money did , a controversial Russian billionaire investor with
regional bank owned 99.978 percent by , with the money transferred via Deutsche
Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
23
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just
intel to share."
body text. The email read, "Yes[.J I figured this. Assange is threatening Kerry, Ecuador and
of dead man files that include Hillary. It's what they used to call a 'Mexican stand off[.]' Only
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta's e-mails."
24
25
26

with Wikileaks
are facts ....
does accurately predict that the Pode_sta brothers' business activities in Russia with the
would come under public scrutiny....
27
Assange to independently confirm this rep011, and he subsequently did. This journalist
infotmation proved to be correct. I have referred publicly to this journalist as an,
"intermediary", "go-between" and "mutual friend." All of these monikers are equally
true.
62. In a document dated March 26, 2018 titled "Minority Views," Democratic
members of HP SCI published excerpts from Stone's September 2017 testimony before HPSCI.

MR. STONE: No.
Q: So throughout the many months in which you represented you were either in_
MR. STONE: That-
MR. STONE: That is c01Tect, even though it was repeated to me on numerous separate
occasions.
K. STONE's Use of Target Account 3 to Message Randy CREDI CO about STONE's

"Back channel"
28
64. On November 19, 2017, Randy CREDI CO (who, as described further below,
STONE publicly identified as his "intermediary'' to ASSANGE), messaged STONE on Target
Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
65. On or about November 21, 2017, CREDICO messaged STONE on Target
chops?'.'
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDI CO replied, "I told
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]"
back, "Not the way I remember it- oh well I guess Schiff will try to get one ofus indicted for
perjury[.]"
29
and on November 24, 2017, CREDICO wrote to STONE, "Forensic evidence proves that there is
times.
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely[]
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
4
Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI.
30
you ·turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
testimony and tell them the truth." CREDI CO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
testify(.]"
STONE: "Whatever you want to say 1 have solid forensic evidence." STONE responded: "Get
fuck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
never had a back Channel particularly on June 12th(.]" STONE responded: "You got nothing."
31
74. On or about January 8, 2018, CREDICO messaged STONE on Target Account 3
stating: "Embassy logs ... + 17 other pieces of information prove that I did not have any
committee ... But you'll get off because you're friends with Trump so don't worry. I have all
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
5
135911370.html
6
https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
32
He was depressed about it. Or was he lying." The article noted that CREDTCO stated he did not

the Investigation
78. On May I 7, 2018, Chief Judge Howell issued an order for the use of pen-trap
interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that '
communicated wit using Target Account 1 on June 1, 2018 and June 6, 2018.
a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described further below),
July 12,2018.
33
2018, FBI agents approached and That day,
and again on May 10, 2018, communicated by phone with
with using Target Account 2. In addition, between on or about June 14, 2018 and
June 17, 2018, and STONE exchanged five emails using Target Account 2.
communicate with , a private investigator hired by STONE. was
interviewed by investigators on June 7, 2018, and subsequently informed investigators that in
who had been employed by STONE during the Campaign as an information technology
specialist.
told investigators that his primary fmm of communication with STONE is by text
34
contained in Attachment A and C. Subscribers obtain an account by r~gistering with the
35
the email account.
occupancy" while executing a search warrant at a residence. For ~xample, email
36

~
has occurred.
at htip:/limages.apple.com/orivacy/docs/ legal-process-guiclelines-us.pd_f; "Create and start using an Apple ID,"
available at https://suppoct.app.Je.com/en-us/HT203993; "iCloud," available at http://www.apple.com/icloud/; "What
does iCloud back up?," available at https://support.aople.com/ kb/PH12519; "iOS Security," available at
37
https://www.apple.com/business/docs/iOS Security Guid.e. pdf, and "iCloud: How Can I Use iCloud?," available at
https: //support.apple.com/kb/PH26502.
38
Apple devices.
39
syncing mechanism.
(often ending [email protected], @me.com, [email protected]) or an email address associated with a
40
Apple.
device.
41
users can purchase additional storage space. That storage space, located oµ servers controlled by
(iCloud Mail) ; images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo
suspicion.
42
CONCLUSION
REQUEST FOR SEALING
Respe~
Andrew Mitchell
Special Agent
43
Subscribed and sworn lo before me on this 1f { of Augus~ 2018.
/ $
/711 !l l(,t1Lt
44
ATTACHMENT A
45
ATTACHMENT B
Attachment A:
in Section LA, to include application, full name, physical address, telephone numbers and
described above in Section LA.;
46


47
i. All existing printouts from original storage which concern the categories identified in
subsection II.a
48
ATTACHMENT C
created or maintained between October 17, 2017 and the present, that is stored.at premises
49
ATTACHMENT D
pursuant to a preservation request under 18 U.S.C. § 2703(£), Google is required to disclose the
described above in Section LA. above;

in Section LA, including log files, dates, times, methods of connecting, ports, dial ups,
and/or locations;



electronic mail address described above in Section LA.;

timestamp;
50

account.
51


subsection II.a
52
ATTACHMENT E
California 95014.
53
ATACHMENTF
To the extent that the information described in Attachment Eis within the possession,
ofthe United States, including any messages, records, files, logs, or infonnation that have been
a. All records or other information regarding th~ identification of the account, to

all attachments;
54
Find My iPhone and Find My Friends logs, Jogs associated with web-based access of Apple

55
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
I, 2015 to present, including:


subsection II.a
56

for the

(Briefly describe the properly lo be searched ) Case: 1: 18-sc-02582
INFORMATION ASSOCIATED WITH THREE ) Assign . Date: 8/3/2018
ACCOUNTS STORED AT PREMISES CONTROLLED ) Description: Search & Seizure Warrant
BY MICROSOFT, GOOGLE, AND APPLE )

of the following person or property located in the Western District of Washington
(identify the person or describe the properly to be searched and give its location):
See Attachment A
See Attachment B
property was taken.
Return
Case No. : Date and time warrant executed: Copy of warrant and inventory left with:
Certification
designated judge.
Date:

ATTACHMENT A
45
ATTACHMENTB
Attachment A:
46
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. §4(misprisionofafelony), 18


47
subsection II.a
48
UNITED STATES DISTRICT COURT f

for the AUG ._ 3 201H
District of Columbia Clerk, U. S, lllstrlct & Bankrupic}
Courts for t~e District of Columola
(Briefly describe rhe property to be searched )
or ide11tifj1 l11e person by name a11d,addrcss) ) Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH THREE ACCOUNTS ) Assign. Date : 8/3/2018
STORED AT PREMISES CONTROLLED BY MICROSOFT, )
GOOGLE, AND APPLE )

property to be searched and give its localion):
See Attachment C
located in the - - - - - District of
- - -Northern California
- -- - - - - - - - - -
See Attachment D

18 u.s.c. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering

under 18 U.S.C. § 3103a, the basis of which is set forth on ~
Reviewed by AUSA/SAUSA: Applicam's signature
!Aaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI

Date:
.Judge 's signature
Printed name and litle
]: i,'
AUG - 3 2018
Clerk, U.S. ()istrlc:t & Bunkruptc}'
lN THE MATTER OF THE SEARCH OF Case: 1: 18-sc-02583

INFORMATION AS SOCIATED WITH Assigned To : Howell, Beryl A.
THREE ACCOUNTS STORED AT Assign . Date : 8/3/2018 .
PREMISES CONTROLLED BY Descript ion: Search & Seizure Warrant
MICROSOFT, GOOGLE, AND APPLE
a. The email accoun (hereafter "Target Account 1), that is
b. The email account (hereafter "Target Account 2"), that is
c. The iCloud account associated with the Apple email account

maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512
issued a search warrant for Roger STONE' address, (Target
address, (Target Account 2). On or about March 14, 2018, Chief
2
present.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a comt of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id.§§ 2703(a), (b)(l)(A), & (c)(l)(A).
SUMMARY
STONE: Target Account 1, which is STONE's Hotmail account; Target Account 2, which is
STONE's Gmail account; and Target Account 3, which is STONE's iCloud account. As set
3
provide him with a full background investigation on another witness who had
done information technology work for STONE during the campaig
referring to the hacking or publication of John Podesta's emails, but rather to "Podesta's business
AS SAN GE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed
that message, on or about August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me,
4
the Washington Post published a breaking story about an Access Hollywood videotape of then-
5
PROBABLE CAUSE.
i. Roger STONE
ii. Jerome CORSI
6

Government directed the recent compromises of emails from .US persons and institutions,
7
b. The USIC also described, at a high level, some of the techniques that the
"Russian messaging strategy that blends covert intelligence operations-·such as cyber activity-
presidential election, including targets associated with both major US political parties." Further1
8
November 1, 2016.
September,"these individuals stole data from these cloud-based computers by creating backups of
those accounts.
9
I 8. On or about November I, 20 I 6, individuals associated with the GRU
spearphished over I 00 accounts used by organizations and personnel involved in administering
States v. Viktor Borisovich Netyksho, et al. (l: I 8-cr-215) (D.D.C.). 1
I
-In that post, Guccifer 2.0 also began releasing hacked DNC documents.
the DNC.
1
A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for
10
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
Organization. During his speech, he was asked about a statement by ASSANGE to Russia
11
28. As noted above, on August 21, 2016, using@RogerJStoneJR, STONE tweeted:
interview that same day, STONE reiterated that because of the work of a '"mutual acquaintance'
of both his and [ASSANGE] , the public [could] expect to see much more from the exiled
tweeted regarding an announcement ASSANGE had schec;luled for the next day from the balcony
12
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
described this release as the "mother load." On October 5, 2016, STONE used @RogerJStoneJ r
13
a. On October 13, 2016, while WikiLeaks was in the midst ofreleasing the
operation leaks like a sieve. You need to figure out who your friends ar·e."
14
f. On Saturday, June I 0, 2017, @RogerJStoneJr sent a direct message to
15
F. STONE's Communications with STONE and Others Regarding

Forthcoming Leaks
warrant for STONE' address (Target Account 1); on
October 17, 2017, Chief Judge Howell issued a search warrant for STONE' address,
on or about December I 9, 2017, Chief Judge Howell issued a search warrant fo
flight schedule. Need to get something confirmed now .... " CORSI responded, "I copied
with the title, "Roger -- why don't you look this over before I send i I believe that
CORSI wrote,
16
d. On or about July 3I,2016, STONE, using Target Account 1, emailed
at Target Account 1: "Word is friend in embassy plans 2 more dumps. One shortly after I'm
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect
2016.
f. On or about August 5, 2016, an associate of STONE's,
17
divulge the conversation about meeting ASSANGE. STONE tol he was joking and
i. On or about August 31, 2016, CORSI messaged STONE at Target
Account 3, "Podesta paid $180k to invest in Uranium One - was hired by Rosatom in Giustra
scandal. Podesta now under FBI investigation - tied to Ukraine Y anukovych - Panama papers
Account 1: "Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
18
posted about file[.]" ln a subsequent meeting with investigators indicated this
Target Account 2 and asked: "Assange -what's he got? Hope it's good." STONE wrote back,
m. On or about October 4, 2016, ASSANGE gave a press conference at the
BS hype."
19
didn't cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a
big democrat."
Are Released
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was-
on/2016/10/07/3 ld74714-8ce5-1 Ie6-875e-2cl bfe943b66_story.html
20
40. At approximately I I :53AM, STONE received a phone call from the Washington
41. At approximately I :42PM, STONE called CORSI and the two spoke for
with STONE, sent STONE an email titled, "WikiLeaks - The Podesta Emails," with a link to the
CORSI, "Lunch postponed-have to go see T." CORSI responded to STONE, "Ok. I
21
speech comments, attacking bad job numbers."
12 2016.docx." The "talking points" included the statement that "Podesta is at the heart of a
STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me like
22
Metcombank[.J The Russians launched a criminal investigation[.] [web link] Once
"Just how much money did a controversial Russian billionaire investor with
regional bank owned 99.978 percent by with the money transferred via Deutsche
Account 3, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's
23
intel to share."
body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry, Ecuador and
of dead man files that include Hillary. It's what they used to call a 'Mexican stand offT.]' Only
"Pls call. Important."
which he claimed he had "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
24
59. On or about November I 0, 2016, CORSI messaged STONE at Target Account 3,
25
26

with Wikileaks
Members of this Committee have made three basic asse1tions against me which must be
are facts ....
My Tweet of August 21, 2016, in which I said, "Trust me, it will soon be the Podesta's
time in the ban-el. #CrookedHillary" must be examined in context. I posted this at a time
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta' s email, but
27
. Assange to independently confirm this report, and he subsequently did. This journalist
information proved to be correct. I have referred publicly to this journalist as an,
true.

MR. STONE: No.
you were only refe1Ting to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
occasions.
2017, STONE published an miicle on his website, stonecoldtruth.com, titled "Is it the Podesta's
K. STONE's Use of Target Account 3 to Message Randy CREDI CO about STONE's

"Back channel"
28
64. On November 19, 2017, Randy CREDICO (who, as described further below,
STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE on Target
Account 3, "My lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the
fifth. Anything to save the plan' ........ Richard Nixon[.]" CREDlCO responded, "Ha ha."
65. On or about November 21, 2017, CRED ICO messaged STONE on Target
chops?"
himself said in public b4 u told me. It's a fucking witchunt [sic]." CREDICO replied, "Itold
October not before that I knew nothing about the DNC stuffl.] I just followed his tweets[.]"
back, "Not the way I remember it- oh well I guess Schiff will try to get one of us indicted for
perjury[.]"
29
and on November 24, 2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is
68. On or about November 28, 2017, CREDI CO tweeted a copy of a subpoena he
received from HPSCT that was dated November 27, 2017. Toll records show that on November
times.
"intermediary." In a public Facebook post, STONE further stated that, "Credico merely []
You want me to cover you for pe1jury now[.]" STONE responded, "What the fuck is your
4
30
you turned over anything to the FBI you're a fool." CREDICO responded, "You open yourself
testimony and tell them the truth." CREDICO repeated: "you need to amend your testimony
before I testify on the 15th." STONE replied, "If you testify you 're a fool. Because of tromp
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I
testify[.]"
71. STONE and CREDICO continued to message each other on or about December I,
31
74. On or about January 8, 2018, CREDI CO messaged STONE on Target Account 3
stating: "Embassy logs ... + 17 other pieces of information prove that r did not have any
committee . .. But you' 11 get off because you' re friends with Trump so don't worry. I have all
. from you," referring to CREDICO's therapy dog. CREDICO stated that it was "ce1iainly scary .
. . When you start bringing up my dog, you're crossing the Jine[.]" 5
5
l 359 l l370.html
6
https ://www.motherjones.com/politics/20 18/05/ro ger-stone-to-associate-prepare-to-d ie/
32

the Investigation
78. On May 17, 2018 , Ghief Judge Howell issued an order for the use of pen-trap
interviewed by the Special Counsel's Office on or about May 2, 2018. Toll records show that
communicated wit using Target Account 1 on June 1, 2018 and June 6, 2018
a private investigator who had previously worked with STONE and who was hired
by STONE to research individuals associated with this case (as described fmther below),
July 12, 2018.
33
2018, FBI agents approache and That day,
and again on May 10, 2018 communicated by phone with
wit using Target Account 2. In addition, between on or about June 14,2018 and
June 17, 2018 and STONE exchanged five emails using Target Account 2.
communicate with a private investigator hired by STONE. was
interviewed by investigators on June 7, 2018, and subsequently informed investigators that in
who had been employed by STONE during the Campaign as an information technology
specialist.
told investigators that his primary form of communication with STONE is by text
34
info1mation can include the date on which the account was created, the length of service, records
35
(such as logging into the account via the Providers ' website), and other log files that reflect
the email account.
36
info1mation maintained by the email Providers can show how and when the account was
has occurred.
at http://images.apple.com/ privacy/docs/lee.al-process-guidelines-us.pdf; "Create and start using an Apple ID,"
available at https://support.app le.oom/en-us/HT203993; "iCloud," available at http://www.appl e.com/icloud/; "What
does iCloud back up?," available at https://supporl.apple.com/kb/PH125 l9; "iOS Security," available at
37
domain names mac.corn, me.com, and icloud.com.
https://"1ww.apple.com/business/docs/iOS Security Guide.pd£, and "iCloud: How Can I Use iCloud?," available at
l1t1ps://supporl.npple.com/kb/PH26502.
38
iCloud to be used to synchronize boolanarks and webpages opened in the Safari web browsers
Apple devices.
39
syncing mechanism.
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a
40
Apple.
device.
41
95. Apple provides users with five gigabytes of free electronic space on iC[oud, and
suspicion.
42
will review that information to locate the items clescribed in Section II of Attachment B, D, and
CONCLUSION
REQUEST FOR SEALING
Res~ ~
Andrew M i t c h e l l ~
Special Agent
43
Subscribed and sworn to before me on this i!~

lf August, 2018.
k//~fdttt7~
fe 1
The Honora Ber; l A. Howell
44
ATTACHMENT A
created or maintained between September 11, 2017 and pr~sent, that is stored at premises owned,
45
ATTACHMENT B
preserved pursuant to a preservation request under 18 U.S.C. § 2703(£), the Provider is required
Attachment A:
in Section LA. above;
c; All internet search data including all queries and location data;
d. All transactional information of all activity of the account described above in Section LA,
in Section LA, to include application, full name, physical address, telephone numbers and
46
abetting), 18 U.S .C. § 3 (accessory after the fact) , 18 U.S.C. § 4 (misprision of a felony), 18
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June I,


47
ATTACHMENT D

and/or locations;




timestamp;
50

account.
51
access of a protected computer); ·1s U.S.C. §§ 1505 and 1512 (obstruction ofjustice), 18 U.S.C.
, Randy Credico, or any individual


1.. All existing printouts from original storage which concern the categories identified in
subsection II.a
52
ATTACHMENT E
California 95014.
53
ATACHMENTF
18 U.S.C. § 2703(£), Apple is required to disclose the following information to the government,

Station Equipment Identities ("IMEi");
all attachments;
54
device backups, all Apple and third-party app data, all files and other records related to iCJoud
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and book.marks, and iCloud
images, videos, voicemails, device settings, and book.marks;
f. . All activity, connection, and transactional logs for the account (with associated IP

j. . All files, keys, or other information necessary to decrypt any data produced in an
55
consists of evidence, fruits, or instrumentalities of violations of 18 U .S.C. § 2 (aiding and
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of_justice), 18 U.S.C.


subsection II.a
56
AO 93 (Rev l l/13) Search and Seizure Warrant

for the

(Briefly describe the property to be searched ) Case: 1 :18-sc-02595
Ass!gned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH ONE ACCOUNT )
STORED AT PREMISES )
CONTROLLED BY GOOGLE ) Description: Search & Seizure Warrant

See Attachment A
See Attachment B
r/ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
property was taken.
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell , Chief U.S. District Judge
D Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C.
property, will be searched or seized (check the appropriale box)
D for _ _ days (not to exceed 30) D until, the facts justifying, the later specific date of
Date and time issued ~/ ~/ j cl-} ~Df"1 :Judge 's signature
- - - - - - - - - - -- - - Printed name and title
AO 93 (Rev, l l/13) Search and Seizure Warrant (Page 2)
Return
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the following Google accounts, which
are stored at premises owned, maintained, controlled, or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California:
-1-
ATTACHMENT B
I. Information to be disclosed by Google
custody, or control of Google, LLC ("Google"), including any messages, records, files, logs, or
information that have been deleted but are still available to Google, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(±), Google is required to disclose the following
information to the government for each account listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);
and files;
-2-
actions taken;
f. All subscriber "change history" associated with the account;
g. All search history and web history associated with the account;
h. All location and maps information associated with the account;
1. All Google Analytics information associated with the account (including all
properties and UA codes associated with the account, and, for each of these
proprieties and UA codes, all usemames and email accounts associated with them);
J. All Google Developers Console information associated with the account;
k. All Minutemaid information associated with the account;
1. All Android information associated with the account;
m. All Google Docs associated with the account;
n. All YouTube information associated with the account;
o. All Google Hangouts information associated with the account;
p. All Google Voice information associated with the account;
q. All Web & App Activity associated with the account;
r. All Google Drive information associated with the account;
s. All Google+ information associated with the account;
t. All device information associated with the account, including all instrument or
telephone numbers (including MAC addresses, Electronic Serial Numbers
("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment
Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity
-3-
Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Number
("MSISDN"), International Mobile Subscriber Identifiers ("IMSI"), or
International Mobile Equipment Identities ("IMEi")); and
u. For any accounts linked to the accounts listed in Attachment A, including accounts
linked by cookie, SMS number, or recovery email address, and for accounts for
which the accounts described in Attachment A are the recovery email address,
provide all records or other information regarding the identification of the account,
to include full name, physical address, telephone numbers and other identifiers,
source of payment (including any credit or bank account number).
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
period from June 1, 2015 to the present, including:
-4-
or other obfuscation about knowledge of, or acces~ to, hacked material;
communications or meetings involving Jerome Corsi, Julian
Randy Credico, or any
individual associated with the Trump Campaign;
principals;
e. All images, messages, communications, calendar entries, search terms, "address
book" entries and contacts, including any and all preparatory steps taken in
furtherance of the above-listed offenses;
f. Communications, records, documents, and other files that reveal efforts by any
foreign principals;
-5-
g. Evidence indicating how and when the account was accessed or used, to determine
h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
J. Credit card and other financial information, including but not limited to, bills and
k. All images, messages and communications regarding wiping software, encryption
1. The identity of any non-U.S. person(s)-including records that help reveal the
whereabouts of the person(s}-who made any expenditure, independent
m. The identity of any person(s)-including records that help reveal the whereabouts
principals.
n. Passwords and encryption keys, and other access information that may be necessary
to access the account and other associated accounts;
o. All existing printouts from original storage which concern the categories identified
in subsection II.a.
-6-
UNITED STATES D ISTRICT C OURT D

for the AUG.. 8 2018
CJ.rk, U.S. District and
01nkrupt · · ~
5· Case: 1: 18-sc-02595
(Briefly describe the prop erty to be searched
or identify the person by nam e and address)
IN FORMATION ASSOCIATED WITH
ONE ACCOUNT STORED AT PREMISES CONTROLLED
l Assigned To: Howell, Beryl A
BY GOOGLE

I, a fed eral law enforcement officer or an attorney for the government, request a searc h warrant and state under
penalty of pe1jw·y that I have reason to bel ieve that on the following person or property (idrmrify /he p erson or describe the
property to be searched and give its location) :
See Attachment A
located in the District of California , there is now concealed (identify the
- - - Northern
- - --- ---- -- -- -- - -
person or describe the property to be seized) :
See Attachment B

The application is based on these facts :

0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attache heet.
jl<yle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI
Date ~/LhJ!J Judge's signature
FILE
AUG -8 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District and
Bankruptcy Courts
IN THE MATTER OF THE SEARCH OF Ca~e: 1: 18-sc-02595

INFORMATION ASSOCIATED WITH Ass!gned To : Howell, Beryl A
ONE ACCOUNTS STORED AT PREMISES Ass,g~. ~ate: 8/8/2018 .
CONTROLLED BY GOOGLE Descnpt,on: Search & S .
e1zure Warrant
information associated with the Google account ("Target
Account"), stored at premises owned, maintained, controlled or operated by Google, LLC
("Google"), a company headquartered in Mountain View, California. The information to be
disclosed by Google and searched by the government is described in the following paragraphs and
in Attachments A and B.
4. ,Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that the Target Account contain evidence, fruits, or
-: 1-
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness
tampering), and 52 U.S.C. § 30121 (a)(I )(C) (foreign expenditure ban). There also is probable
cause to search the information described in Attachment A for evidence, contraband, fruits,
and/or instrumentalities of the Subject Offenses, further described in Attachment B.
JURISDICTION
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U .S.C.
§ 271 I (3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below.
PROBABLE CAUSE
i. Roger STONE
-2-
ii. Jerome CORSI
-3-

Election
and maintained that access until at least June 2016." The USIC attributed these tyber activities
-4-
used three new accounts with the same cloud computing service to mbve the "snapshots" to
those accounts.
-5-
presidential election, including conspiracy to commit authorized access to protected computers.
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:l 8-cr-00125).
19. On June 14, 2016, Crowd Strike, the forensic firm that sought to remediate an
on its WordPress blog that, with respect to the documents stolen from the DNC, "[tJhe main part
the DNC.
-6-
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With
regard to the October surprise, what would be your forecast on that given what Julian Assange
has intimated he's going to do?" STONE responded: "Well, it could be any number of things. I
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close
27. On August 21, 2016, using@RogerJStoneJR, STONE tweeted: "Trust me, it will
soon the [sic] Podesta's time in the barrel. #CrookedHillary." In a C-SPAN interview that same
day, STONE reiterated that because of the work of a "'mutual acquaintance' of both his and
-7-
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the
form of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
part of WikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
-8-
th.ought were deleted. I hear that through my emissary."
-9-
1
-10-
40. On Saturday, June I 0, 2017, @RogerJStoneJr sent a direct message to
E. CORSl's Communications with STONE and Others Regarding

Forthcoming Leaks
issued a search warrant for STONE's address . On October
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's l addresses,
On or about December 19, 2017, Chief Judge Howell issued a search
warrant for s email account. On or about March 14, 2018, Chief Judge Howell
issued a search warrant for STONE's iCloud account. Information recovered pursuant to those
search warrants indicated the following:
-11-
43. On or about May 18, 2016, CORSI emailed STONE
with the title, "Roger -- why don't you look this over before I send " I believe that
. CORSI wrote,
44. On July 25, 2016, STONE, usin , sent an email to
45. On or about July 31, 2016, STONE, usin , emailed
CORSI with the subject line, "Call me MON." The body of the email read: h should see
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist - turn him for
, "Word is friend in embassy plans 2 more dumps. One shortly after I'm
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox
for now. Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke --
-12-
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation
debacle." Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2
more dumps" refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
47. On or about August 5, 2016 , an associate of STONE's, emailed
STONE . The email contained a link to a poll indicating that Clinton
: "Did you get the PODESTA writeup." STONE replied "[y]es."
-13-
investigation - tied to Ukraine Y anukovych - Panama papers reveals Podesta hired by
S[b]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
it again today. wrote back, "Awaiting secret file. Explosive ... Hope you are well.
Can't ~ait for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted
and asked: "Assange - what's he got? Hope it's good." STONE wrote
BANNON, who was CEO of the Campaign at the time, and wrote: "You should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stuff to worry
about." The associate responded, "Well clearly he knows what Assange has. I'd say that's
important."
-14-
54. On or about October 4, 2016, AS SAN GE gave a press conference at the
56. That same day, BANNON emailed STONE a , "What was
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a big
democrat."
57. When BANNON spoke with investigators during a voluntary interview on
Are Released.
-15-
article, "Fahrenthold didn 't hesitate. Within a few moments of watching an outtake of footage
On or about August 2, 2016, CORSI emailed STONE using , "I expect
that much of next dump focus, setting stage for Foundation debacle."
3
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31 d74714-8ce5-l l e6-875e-2cl bfe943b66_story.html
-16-
65. At approximately 6:27P L, an author who has written about the
newly-released Podesta emails. Approximately ten minutes later, STONE, using
, forwarded s message to CORSI without comment. STONE
does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE Is
66. On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed -
numbers."
emailed STONE at both , with the subject
line "Podesta talking points." Attached to the email was a file labeled, "ROGER STONE
podesta talking points Oct 12 2016.docx." The "talking points" included the statement that
-17-
financially Podesta personally and the Clintons through the Clinton Foundation."
CORSI back via t l Account, "Got them and used them."
wrote back to STONE, "I'll give you one more-NOBODY YET HAS THIS[:] It looks to me
lik skimmed maybe billions off Skolkovo - Skolkovo kept their money with
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Onc
sent STONE an email a with the subject, "ROGER STONE article
-18-
then asked, "Just how much money di , a controversial Russian billionaire
Metcombank, a Russian regional bank owned 99.978 percent b , with the money
Foundation?"
intel to share."
him[.] Otherwise he's dead anyway, once he's dropped what he has. lf HRC wins, Assange can
-19-
-20-
-21-
t STONE's Congressional Testimony and Public Statements About His Relationship

with Wikileaks
Committee on Intelligence (HPSCI). Although the hearing"was closed, STONE released to the
-22-
such asse11ions are conjecture, supposition, projection, and allegations but none of them
are facts ....
Assange to independently confirm this report, and he subsequently did. This journalist
true.

MR. STONE: No.
you were only referring to a single fact that you had confamed with the intermediary -
MR. STONE: That -
occasions.
89. In the month that followed his testimony before HP SCI, on or about October 24,
2017, STONE published an ai1icle on his website, stonecoldtruth.com, titled "Is it the Podesta's
-23-
Time in the Barrel Yet?" In that article, STONE stated: "[J]t was this inevitable scrutiny of the
J. STONE's Messaging to Randy CREDICO about STONE's "Back channel"
90. On or about November 19, 2017, Randy CREDICO (who, as described further
below, STONE publicly identified as his "intermediary" to ASSANGE), messaged STONE, "My
lawyer wants to see me today." STONE responded, "'Stonewall it. Plead the fifth. Anything to
save the plan' ........ Richard Nixon[.]" CREDI CO responded, "Ha ha."
91. On or about November 21, 2017, CREDICO messaged STONE, "I was told that
the house committee lawyer told my lawyer that I will be getting a subpoena[.]" STONE wrote
back, "That was the point at which your lawyers should have told them you would assert your
5th Amendment rights if compelled to appear." They continued to message, and CREDI CO
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what? Nothing
happening in DC the day before Thanksgiving - why are u busting my chops?"
92. On or about November 24, 2017, STONE, texted CREDICO, "Assange is a
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was
he had the goods [o]n Hillary and would publish them - which he himself said in public b4 u told
me . It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing
about the DNC stuff[.] I just followed his tweets[.]" STONE responded, "U never said anything
about the DNC but it was August." CREDICO wrote back, "It was not August because I didn't
-24-
interview him or meet him until August 26th[.] That was my first communication with his
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
guess Schiff will try to get one of us indicted for perjury[.]"
93. STONE and CREDICO continued to exchange messages and on November 24,
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
times.
"intermediary." In a public Facebook post, STONE further stated that "Credico merely []
confirmed for Mr. Stone the accuracy of Julian Assange's interview of June i2, 2016 with the
pending publication,' ... Credi co never said he knew or had any information as to source or
96. On or about December 1, 2017, CREDI CO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to
the FBI today what a headache[.] 4 You could have just told him the truth that you didn't have a
back Channel they now know that I was not in London until September of this year[.] You had
no back-channel and you could have just told the truth ... You want me to cover you for petjury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything
4
-25-
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th
Amendment rights ifu don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of petjury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the committee knows you
never had a back Channel and if you had just told the truth wouldn't have put me in this bad spot
... you should go back .. ·. and amend your testimony and tell them the truth." CREDI CO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied, "If
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for
perjury if you're stupid enough to testify[.]"
98. On or about December 13, 2017, according to public reporting, CREDI CO
99. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDI CO indicated to STONE that he was having dinner with a reporter.
STONE responded, "Hope u don't fuck Up my efforts to get Assange a pardon[.]" CREDICO
messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
-26-
email I sent to WikiLeaks website email address asking you would do my show[.] That was my
initial contact."
100. On or about January 8, 2018, CREDICO messaged STONE, stating: "Embassy
logs ... + 17 other pieces of information prove that I did not have any conversations with
Assange until September of last year."
25, 2018, CREDICO wrote to STONE: "You lied to the house Intel committee ... But you'll get
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was
not a ba[ck] Channel and I have all those emails from September of2016 to prove it[.]"
. . When you sta11 bringing up my dog, you're crossing the line[.]" 5
stated: "I am so ready. Let's get it on. Prepare to die[.]" In the a11icle, CREDICO stated that he
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-135911370.html
6
https ://www .motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-27-
K. The Target Account
104. According to subscriber records obtained from Google, Target Account
was created on October 27, 2015, in the name o
" The recovery email for the Target Account is STONE' l account,
. Subscriber records obtained in approximately August 2018 indicate
that the last login to the Target Account occurred on May 17, 2018.
105. According to subscriber records obtained from Facebook, Target Account
was used to register a Facebook account in the name o
which was created on October 27, 2015, with the verified telephone numbe
According to a public records database, the telephone numbe is linked
106. was voluntarily interviewed by investigators from the Special
Counsel's Office on or about Friday, May 18, 201 told investigators that he
became STONE's assistant in Florida in 2015, and that during the summer of 2016, he acted as
STONE's right-hand man. According to STONE utilized the services of several
individuals to post social media content to Facebook and Twitter, and that he ) and
STONE both instructed these individuals about what to post. stated that he
purchased a couple hundred fake Face book accounts as part of this work (including both new
and existing accounts), and that bloggers working for STONE would try to build what looked
like real Facebook accounts. 7 further stated that STONE wanted to push out
7
Face book requires that all users of Facebook accounts use their actual name while registering
-28-
WikiLeaks content through his Facebook and Twitter accounts, and that content related to the
stolen Podesta emails was pushed out through STONE's Facebook and Twitter accounts.
107. On or about August 2, 2018, Chief Judge Howell issued a search warrant for the
Facebook account registered to Target Accou . (1: 18-sw-
2570).
108. Search warrant returns for STONE's Hotmail account contain a number of emails
that appear to have been sent to Target Accoun from various
entities, including Facebook and Twitter. Although it is not clear from the face of the emails
how they ended up in STONE l account, 8 they may have been auto-forwarded or
otherwise imported from the Target Account into th l account. These emails include at
least one receipt sent on or about June 30, 2016, from Facebook to the Target Account for a
Facebook advertisement, which was then forwarded from STONE account to
Google account. 9 They also include several emails sent from
to the Target Account in early 2017.
109. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
and operating their accounts. The terms of service explicitly require that "Facebook users
provide their real names and information .... You will not provide any false personal
information on Facebook, or create an account for anyone other than yourself without
permission."
8
Investigators have been unable to access the full headers for these emails.
9
told investigators that he would sometimes send emails from STONE's account.
-29-
obtain an account by registering with Google. During the registration process, Google asks
subscribers to provide basic personal information. Therefore, the computers of Google are likely
to contain stored electronic communications (including retrieved and unretrieved email) for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
of the crimes under investigation because the information can be used to identify the account's
user or users.
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even if
subscribers insert false information to conceal their identity, this information often provides clues
to their identity, location, or illicit activities.
111. In my training and experience, email providers typically retain certain transactional
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in
(i.e., session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
-30-
account. In addition, email providers often have records of the IP address used to register the
account and the IP addresses associated with particular logins to the account. Because every device
that connects to the Internet must use an IP address, IP address information can help to identify
which computers or other devices were used to access the email account.
retain records about such communications, including records of contacts between the user and the
provider's support services, as well as records of any actions taken by the provider or user ::is ::i
result of the communications. In my training and experience, such information may constitute
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where
Google has chosen to store such information. The government intends to require the disclosure
pursuant to the requested warrant of the contents of wire or electronic communications and any
records or other information pertaining to the customers or subscribers if such communication,
record, or other information is within Google's possession, custody, or control, regardless of
whether such communication, record, or other information is stored, held, or maintained outside
the United States.
-31-
the account. This "user attribution" evidence is analogous to the search for "indicia of occupancy"
while executing a search warrant at a residence. For example, email communications, contacts
lists, and images sent (and the data associated with the foregoing, such as date and time) may
indicate who used or controlled the account at a relevant time. Further, information maintained by
the email provider can show how and when the account was accessed or used. For example, as
described below, email providers typically log the Internet Protocol (IP) addresses from which
users access the email account, along with the time and date of that access. By determining the
physical location associated with the logged IP addresses, investigators can understand the
chronological and geographic context of the email account access and use relating to the crime
under investigation. This geographic and timeline information may tend to either inculpate or
exculpate the account owner. Additionally, information stored at the user's account may further
indicate the geographic location of the account user at a particular time (e.g., location information
integrated into an image or video sent via email). Last, stored electronic data may provide relevant
insight into the email account owner's state of mind as it relates to the offense under investigation.
For example, information in the email account may indicate the owner's motive and intent to
commit a crime (e.g., communications relating to the crime), or consciousness of guilt
(e.g., deleting communications in an effort to conceal them from law enforcement).
-32-
CONCLUSION
REQUEST FOR SEALING
~ape ~
Andrew Mitchell
Special Agent
Subscribed and sworn to before me on thief' day of August, 2018.
6//W
-33-
ATTACHMENT A
-1-
ATTACHMENTB
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following
and files;
-2-
actions taken;
i. All Google Analytics information associated with the account (including all
proprieties and UA codes, all usernames and email accounts associated with them);
I. All Android information associated with the account;
n. All Y ouTube information associated with the account;
-3-
-4-
communications or meetings involving Jerome Corsi, , Julian
Assange , Randy Credico, or any
principals;
foreign principals;
-5-
investigation;
I. The identity of any non-U.S. person(s)-including records that help reveal the
principals.
in subsection II.a.
-6-

for the

INFORMATION ASSOCIATED WITH ONE ACCOUNT )
CONTROLLED BY TWITTER ) Description: Search & Seizure Warrant

See Attachment A
See Attachment B
property was taken.
(United Stales Magistrate Judge)
0 Pursuant to 18 U.S.C. § 3103a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
Date and time issued: ----~ /~ -- /?'/7~~/

Judge 's signature
Return
Case No .: Date and time warrant executed: Copy of warrant and inventory left with:
Inventory of the property taken and name of any person(s) seized :
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the following Twitter accounts, which
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California:
-1-
ATTACHMENT B
custody, or control of Twitter, Inc. ("Twitter"), including any messages, records, files, logs, or
information that have been deleted but are still available to Twitter, or have been preserved
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following
A. All "Tweets" and Direct Messages sent, received, "favorited," or retweeted by the account,
and all photographs or images included in those Tweets and Direct Messages;
B. The content of all communications (public or private) sent to or from, stored in draft form
in, or otherwise associated with the account, including the content of all messages,
attachments, and header information;
C. All data and information associated with the profile page, including photographs, "bios,"
and profile backgrounds and themes;
D. All other content associated with the account, including, but not limited to, posts,
documents, spreadsheets, photos, and videos;
E. All information from the "Connect" tab for the account, including all lists of Twitter users
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets
that include the usemame associated with the account (i.e., "mentions" or "replies");
F. All photographs and images in the user gallery for the account;
G. All location data associated with the account, including all information collected by the
"Tweet With Location" service;
H. All information about the account's use of Twitter's link service, including all longer
website links that were shortened by the service, all resulting shortened links, and all
information about the number of times that a link posted by the account was clicked;
I. All data and information that has been deleted by the user;
J. A list of all of the people that the user follows on Twitter and all people who are following
the user (i.e., the user's "following" list and "followers" list);
K. A list of all users that the account has "unfollowed" or blocked;
L. All "lists" created by the account;
-2-
M. All information on the "Who to Follow" list for the account;
N. All privacy and account settings;
0. All records of Twitter searches performed by the account, including all past searches saved
by the account;
P. All current and historical subscriber and payment information, including full name, e-mail
address (including any secondary or recovery email addresses), physical address (including
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number,
websites, screen names, user identification numbers, security questions and answers,
registration IP address, payment history, and other personal identifiers;
Q. All email addresses and telephone numbers ever registered (whether successfully or not)
to the account, including dates of any changes and the IP addresses used for any changes;
R. All past and current usernames, account passwords, and names associated with the account,
including dates of any changes and the IP addresses used for any changes;
S. All data and information associated with the profile page, including photographs;
T. All advertising data relating to the account, including, but not limited to, information
regarding unique advertising IDs associated with the user, any devices used to access the
account, application IDs, UDIDs, payment information (including, but not limited to, full
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads
created;
U. The dates and times at which the account and profile were created, and the Internet Protocol
("IP") address at the time of sign-up;
V. All transactional records associated with the account, including any IP logs or other records
of session times and durations;
W. Any information identifying the device or devices used to access the account, including a
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers,
MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers
("MEIN"), Mobile Equipment Identifiers ("MEID"), Mobile Identification Numbers
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services
Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
information regarding the types of devices used to access the account;
X. All activity logs for the account;
Y. All location information for the account, including all location data collected by any
plugins or widgets;
Z. The types of service utilized by the user;
-3-
AA. All information about the account's use ofTwitter's link service, including all website links
embedded in, exporting data to, or importing data from, the account's website or blog;
BB. All full website links that were shortened by Twitter's link service, all resulting shortened
links, and all information about the number of times that a link posted by the account was
clicked;
CC. All information about connections between the account and third-party websites and
applications, including any Twitter, Facebook or other social networking accounts to which
posts from the account are sent;
DD. All data and information that has been deleted by the user;
EE. The length of service (including start date) and the means and source of any payments
associated with the service (including any credit card or bank account number);
FF. All privacy settings and other account settings, including email addresses or other accounts
that the account has blocked;
GG. Information regarding linked accounts, including accounts linked by cookie, IP address
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
identifier, or any other account or device identifier;
HH. Information regarding accounts linked to accounts to which the Target Accounts are linked;
II. All records pertaining to communications between the Service Provider and any person
regarding the user or the user's account with the Service Provider, including contacts with
support services, records of actions taken, and investigative or user complaints concerning
the subscriber.
-4-
Assange, Randy Credico, or any
principals;
foreign principals;
-5-
investigation;
principals.
in subsection II.a.
-6-

FILED
for the AUG .. 8 2018
District of Columbia Clerk, U.S. District and
Bankrupt.C¥i;lOIU~.:-::-~~
(Briefly describe the property lo be searched ~
Case: 1:18-sc-02596
or identify the person by name and add1·es~~ ) Assigned To : Howell , Beryl A.
ONE ACCOUNT STORED AT PREMISES CONTROLLED )
BY TWITTER )

I, a federal Jaw enforcement officer or an attorney for the government, request a search wanant and state under
penalty of pe1jury that I have reason to believe that on the following person or property (identify the person or describe the
See Attachment A
located in the
- - -Northern
- - -- - District of
---- -California
-- -- - -- , there is now concealed (identify the
See Attachment B '
ri evidence of a crime;
ri contraband, fruits of crime, or other items illegally possessed;

18 U.S .C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy

0 Delayed notice of _ _ days (give exact ending date if more than 30 days:
under 18 U.S.C. § 3103a, the basis of which is set forth on z-~ ) is requested
Reviewed by A USA/SA USA: Applicant's signature
jKyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI

---- 4,t;,u~
FILE D
IN THE UNITED STATES DISTRICT COURT AUG -8 201B
F R TI-IB !STRICT OF OLUMBIA Clertc, U.S. District and
Bankrupt~y Cour-t
IN THE MATIER F 1 J' SEARCH OF Case: 1:18- sc- 02596
INFORMATION A S CIATED WITH Ass!gned To : Howell, Beryl A.
ONE ACCOUN1 STORED AT PREMISES Assrgn. Date : 8/8/2018
CONTROLLED BY TWITTER Description: Search & Seizure Warrant
information associated with the Twitter account ("Target Account"), stored
at premises owned, maintained, controlled or operated by Twitter, Inc. ("Twitter"), a company
headquartered in San Francisco, California. The information to be disclosed by Twitter and
searched by the government is described in the following paragraphs and in Attachments A and B.
2. I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have
-1-
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban). There also is probable
JURISDICTION
judge of such a court) ... that has jurisdiction over the offense being investigated." 18 U.S.C.
PROBABLE CAUSE
i. Roger STONE
ii. Jerome CORSI
-2-
B. Russian Government-Backed Hacking Activity During the 2016, Presidential

Election
-3-
-4-
those accounts.
17. On or about November I, 2016, individuals associated with the GRU
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125).
-5-
the DNC.
-6-
day, STONE reiterated that because of the work of a '"mutual acquaintance' of both his and
-7-
29. On Saturday, October I, 2016, using@RogerJStoneJr, STONE tweeted,
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
part of WikiLeaks' 10-year anniversary celebration - STONE told lnfowars that his intermediary
-8-
think there's at least a reasonable belief that (Assange] may have passed this information on to
(STONE]." Commenting to the NBC News, STONE indicated that he had never met or spoken
1
-9-
the founder ofWikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
-I 0-
E. CORSI's Communications with STONE and Others Regarding

Forthcoming Leaks
issued a search warrant for STONE' address . On October
17, 2017, Chief Judge Howell issued a search warrant for one of STONE' addresses,
warrant fo email account. On or about March 14, 2018, Chief Judge Howell
appears to have forwarded the message to STONE at , who replied to
43. On or about May 18, 2016, CORSI emailed STONE a
with the title, "Roger -- why don't you look this over before I send i I believe that
CORSI wrote,
-11-
44. On July 25, 2016, STONE, usin , sent an email to
CORSI with the subject line, "Call me MON." The body of the email read should see
Assange[.] should find Bernie [S]anders brother who ·called Bill a Rapist - tum him for
debacle." Investigators believe that CORSJ's reference to a "friend in embassy [who] plans 2
-12-
same time, STONE told him he had gone to London to meet ASSANGE also stated
S[b]erbank, Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton
"Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
-13-
it again today wrote back, "Awaiting secret file. Explosive ... Hope you are well.
about file[.]" In a subsequent meeting with investigators indicated this
important."
-14-
56. That same day, BANNON emailed STONE a , "What was
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawye is a big
democrat."
Are Released.
3
then-the-race-was-on/2016/10/07 /31d74714-8ce5-11 e6-875e-2c 1bfe943b66_story.html
-15-
59. According to phone record a, at approximately
61. At approximately l :42PM, STONE called CORSI and the two spoke for
~ccess Hollywood tape.
On or about August 2, 2016, CORSI emailed STONE usin , "I expect
65. At approximately 6:27PM , an author who has written about the
forwarded message to CORSI without comment. STONE
-16-
numbers."
67. On or about Wednesday, October 12, 2016, at approximately 8: 17AM, STONE,
usin emailed Corsi asking him to "send me your best podesta links."
emailed STONE at both , with the subject
-17-
wrote back to STONE, "I'll give you one more -NOBODY YET HAS THIS[:] It looks to me
like skimmed maybe billions off Skolkovo-Skolkovo kept their money with
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via
SOMETHING to.post on Podesta since I have now promised it to a dozen MSM reporters[.]"
-18-
Foundation?"
"On Assange, can you call me now - before 2pm[ .]" STONE responded, "Missed u - just
intel to share."
It's what they used to call a 'Mexican stand offT.]' Only hope is that if Trump speaks out to save
him[.] Otherwise he's dead anyway, once he's dropped what he has. If HRC wins, Assange can
-19-
-20-
-21-
I. STONE's Congressional Testimony and Public Statements About His Relationship

with Wikileaks
are facts ....
My Tweet of August 21 , 2016, in which I said, "Trust me, it will soon be the Podesta's
-22-
info1mation proved to be correct. I have referred publicly to this journalist as an,
true.
members ofHPSCI published excerpts from Stone's September 2017 testimony before HPSCI.

MR. STONE: No.
you were only referring to a single fact that you had confomed with the intermediary -
MR. STONE: That -
occasions.
-23-
lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
save the plan' ........Richard Nixon[.]" CREDI CO responded, "Ha ha."
me. It's a fucking witchunt [sic]." CREDICO replied, "I told you to watch his tweets. That's
about the UNC stutll.J 1just followed his tweetsl.J" STONE responded, "U never said anything
secretary in London, August 26th." STONE wrote back, "Not the way I remember it - oh well I
-24-
now you can relax."
times.
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[]
96. On or about December 1, 2017, CREDICO messaged STONE, "I don't know why
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of us has done anything
Amendment rights if u don't want talk about AND if you turned over anything to the FBI you're
a fool." CREDI CO responded, "You open yourself up to six counts of perjury[.] But I'm sure
4
-25-
that wasn't sworn testimony so you're probably clear[.]' Council for the committee knows you
... you should go back ... and amend your testimony and tell them the truth." CREDICO
repeated: "you need to amend your testimony before I testify on the 15th." STONE replied; "If
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter.
email I sent to WikiLeaks website email address asking you would.do my show[.] That was my
initial contact."
-26-
I 00. On or about January 8,2018, CREDJCO messaged STONE, stating: "Embassy
101. CREDI CO and STONE continued to message each other, and on or about January
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
He was depressed about it. Or was he lying." The article noted that CREDI CO stated he did not
5
https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-l359113 70.html
6
https://www .motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-27-
K. s Statements Regarding STONE's Use of Social Media
104. On or about Friday, May 18, 2018 S was voluntarily interviewed
by investigators from the Special Counsel's Office told investigators that he became
right-hand man.
105. According t , STONE utilized the services of several individuals to
post social media content to Facebook and Twitter, and that he ) and STONE both
accounts.
L. The Target Account
107. The Target Account is a Twitter account with usemam
Search warrant returns for STONE's Hotmail account contain emails from Twitter about Target
which appear to have originally been sent to
. Although it is not clear from the face of the emails how they
ended up in STONE's Hotmail account, 7 they may have been auto-forwarded or otherwise
imported from to the Hotmail account. Subscriber records
7
Investigators have been unable to access the full headers for these emails.
-28-
obtained from Google show th m was registered using STONE's
Hotmail address , as the recovery account. 8
108. Tweets associated with the Target Account, which are publicly available, include
the retweeting of content related to WikiLeaks, STONE's testimony before the House
Intelligence Committee, and the hacking of the DNC. The Target Account was also used to
retweet content with the hashtag #FreeAssange! The Target Account is listed as having been
created in March 2016 and bears the picture of a person purporting to b
109. In my training and experience, I know that, in addition to posting content and
purchasing advertisements, Twitter accounts can be used to communicate privately and directly
with other users through Twitter's direct messaging function. As noted above, STONE used at
least one other Twitter account, @RogerJStoneJr, to communicate with WikiLeaks and
ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING TWITTER
profile pages, which can include a short biography, a· photo of themselves, and location
information. Twitter also permits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
more detail below.
11 I. Upon creating a Twitter account, a Twitter user must create a unique Twitter
8
was also used to register a Facebook account. This Court
authorized a search of that Facebook account on or about August 2, 20 I 8 (I: 18-sw-2570).
-29-
username, password, and name without having to open a new Twitter account.
"avatar") to his or her profile, and can also change the profile background or theme for his or her.
account page. In addition, Twitter users can post ·"bios" of 160 characters or fewer to their profile
pages.
114. Twitter also keeps IP logs for each user. These Jogs contain information about the
-30-
people follow.
-31-
120. In addition to posting Tweets, a Twitter user can also send Direct Messages
(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular user, but older DMs are stored on Twitter's database.
will not be sent to the user'~ phone.
25 past searches.
profiles.
-32-
for breaching Twitter's terms of service, during which time the Twitter user will be prevented
from using Twitter's services.
-33-
their use of Twitter, such as account access information, transaction information, and other account
information.
CONCLUSION
130. Pursuant to 18 U .S.C. § 2703(g), the presence of a law enforcement officer is not
REQUEST FOR SEALING
-34-
Andrew Mitchell
Special Agent
Subscribed and sworn to before me on ~hist~ day of August, 2018.
~!fA;qp
-35-
ATTACHMENT A
-1-
ATTACHMENT B
To the extent that the information described in Attachment A is within the possession;
pursuant to a request made under 18 U .S.C. § 2703(f), Twitter is required to disclose the following
that include the username associated with the account (i.e., "mentions" or "replies");
-2-
by the account;
R. All past and current usemames, account passwords, and names associated with the account,
created;
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
plugins or widgets;
-3-
AA. All information about the account's use of Twitter' s link service, including all website links
clicked;
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
the subscriber.
access ofa protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C.
-4-
principals;
foreign principals;
-5 -
investigation;
that help reveal the whereabouts of such person(s );
whereabouts of the person(s)--who made any expenditure, independent
principals.
in subsection II.a.
-6-

for the

Case: 1: 18-sc-02670
INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date : 8/20/2018
STORED AT PREMISES CONTROLLED BY 1&1 MAIL ) Description: Search & Seizure Warrant
& MEDIA, INC. )

of the following person or property located in the Eastern District of Pennsylvania
See Attachment A
See Attachment B
property was taken.
as required by law and promptly return this warrant and inventory to Hon. Rudolph Contreras-, U.S. District Judge
Date and time issued: if_dJ!J(J.&18 3: l?t t'\L / Judge 's signature
City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge
AO 93 (Rev. l l/13) Search and Seizure Warrant (Page 2)
Return
Case No. : Date and time warrant executed: Copy of warrant and inventory left with:
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the following l&I Mail account, whic;h
is stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, Inc., a
company headquartered i~ Chesterbrook, Pennsylvania:
-1-
ATTACHMENT B
I. Information to be disclosed by l&l Mail
custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
b. All records or other information regarding the identification of the ac.count, to
and files;
-2-
actions taken;
1. All device information associated with the account, including all instrument or
International Mobile Equipment Identities ("IMEI")); and
j. For any accounts linked to the accounts listed in Attachment A, including accounts
-3-
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
and 52 U.S.C. § 30121 (foreign contribution ban), including:
a. Evidence of unauthorized access to protected computers;
b. Evidence of the distribution or transfer of data obtained through unauthorized
access to protected computers;
c. Evidence indicating how and when the account was accessed or used, to determine
d. Evidence indicating the account owner's state of mind as it relates to the crimes
e. The identity of the person(s) who created or used the account, including records
f. Communications, records, documents, and other files related to any expenditure,
g. Records of any funds or benefits disbursed by or offered on behalf of any foreign
principals;
-4-
h. Communications, recorqs, documents, and other files that reveal efforts by any
foreign principals;
i. The identity of any non-U.S. person(s)-including records that help reveal the
J. The identity of any person(s)-including records that help reveal the whereabouts
-5-

for the Clerk, U.S. District & Bankruptcy

Case: 1:18-sc-02670
l
(Briefly describa the property to be searched
or identify the person by name and oddres!i) Ass!gned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH ONE ACCOUNT Assign. Date: 8/20/2018
STORED AT PREMISES CONTROLLED BY 1&1 MAIL &
MEDIA, INC.
)

I, a federal law enforcement offi cer or an attorney for the government, request a search warrant and state under
See Attachment A
located in the -------
Eastern District of Pennsylvania
----"--''--"-...c...r...;_..:....:.._;~- - -
See Attachment B
M evidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;

18 u.s.c. §§ 1030, 371 Unauthorized Access of Protected Computer, Conspiracy

!Kyle R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI
Date: er
City and state: Washington, D.C. Hon. Rudolph Contreras, U.S. District Judge

AUG 2o20'8
Clerk. U.S. District & Bankruptcy
Courts for thil Oiatriat af r · a
INFORMATION ASSOCIATED WITH Case: 1 :18-sc-02670
ONE ACCOUNT STORED AT PREMISES Assigned To: Howell, Beryl A.
CONTROLLED BY l&l MAIL & MEDIA, Assign. Date: 8/20/2018
INC. Description: Search & Seizure Warrant
I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows:
information associated with the account ("Target Account"), stored at
premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("1&1 Mail"), a
company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed by 1& 1
Mail and searched by the government is described in the following paragraphs and in Attachments
A and B.
2. I am a Special Agent with the Federal Bureau of Investigation ("FBI") assigned to
FBI Pittsburgh working directly with the Special Counsel's Office. I have been a Special Agent
with the FBI since 2017. I was previously employed as a network and software engineer for
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national
security investigations relating to foreign intelligence and cybersecurity.
-1-
U.S.C. § 951 (acting as an unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of
a protected computer), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and
conspiracy to commit wire fraud), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditure ban).
There also is probable cause to search the information described in Attachment A for evidence,
contraband, fruits, and/or instrumentalities of the Subject Offenses, further described in
Attachment B.
JURISDICTION
PROBABLE CAUSE
A. Russian Government-Backed Hacking Activity during the 2016 Presidential

Election
6. On June 14, 2016, the cybersecurity firm CrowdStrike, Inc. and its affiliates
("CrowdStrike") published a blog post entitled, "Bears in the Midst: Intrusion into the
-2-
Democratic National Committee." 1 In the blog post, CrowdStrike described how the firm "was
called by the Democratic National Committee (DNC), the formal governing body for the US
Democratic Party, to respond to a suspected breach." According to CrowdStrike, the cyber actor
known as "Fancy Bear" breached the DNC network in 2016. CrowdStrike further assessed:
"Extensive targeting of defense ministries and other military victims [by FANCY BEAR] has
been observed, the profile of which closely mirrors the strategic interests of the Russian
government, and may indicate affiliation with f'nasttoe Pa:rne,ri:hrnaTeJihHoe Yrrpasnem1e (Main
Intelligence Department) or GRU, Russia's premier military intelligence service."
7. Starting in or around mid-2016, published reports also detailed attempts to
compromise both the work and personal email accounts of numerous individuals involved in the
2016 U.S. presidential campaign through "spearphishing" efforts. In this context, spear phishing
refers to the fraudulent practice of sending an email that purports to be from a known or trusted
sender in order to induce the targeted victim to respond in a desired manner, typically by clicking
a malicious link or URL. The perpetrators used Bitly, a link-shortening and management service,
to disguise the malicious URLs. Victims of these spearphishing efforts included John Podesta, the
chairman of the Clinton Campaign, who received a spearphishing email on or about March 19,
2016. The email contained a Bitly link created by the Bitly account john356gh, which the FBI has
linked to a known GRU officer.
8. On or about September 20, 2016, Crowd Strike also identified a new intrusion into
the DNC's virtual private cloud, hosted by Amazon Web Services (AWS). CrowdStrike advised
1
"Bears in the Midst: Intrusion into the Democratic National Committee," June 14, 2016,
available at https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-
committee.
-3-
the FBI that the perpetrators obtained unauthorized access to the DNC's VPC system through the
theft of an administrator credential, which gave the perpetrators the ability to modify the network's
security rules. After gaining this access, the perpetrators modified the rules that limited the
universe of devices that could connect to the victim computers. Based on its forensic analysis,
CrowdStrike determined that the perpetrators copied snapshots of the DNC's cloud-based
computers onto at least three new AWS accounts created by the perpetrators.
9. Following the inception of the spear phishing and intrusion campaigns, a series of
overlapping actors began to be release documents stolen from the DNC, DCCC, and the personal
email accounts of campaign-affiliated individuals. Release of these stolen documents principally
occurred through three forums: (1) a series of accounts operated under the online persona
"Guccifer 2.0"; (2) a website and series of accounts operated under the online persona "DCLeaks";
and (3) the websites and public archives operated by the group "Wikileaks." The releases of stolen
documents included confidential memoranda written by Democratic employees; strategy
documents discussing various components of the 2016 federal elections; and confidential
correspondences of the DNC and DCCC, as well as individuals involved in the presidential
campaign of Hillary Clinton.
"Assessing Russian Activities and Intentions in Recent US Elections." 2 In the report, the USIC
US presidential election. Russia's goals were to undermine public faith .in the US
2
"Assessing Russian Activities and Intentions in Recent US Elections," Jan. 6, 2017, available at
https://www.dni.gov/files/documents/ICA_20l 7_01.pdf.
-4-
"resulted in the compromise of the personal e-mail accounts of Democratic Party officials and
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
(Case No. 1:18-cr-00125).
-5-
B. Guccifer 2.0's Use of WikiLeaks to Further the Interference in the 2016 U.S.
Presidential Election
15. On June 15, 2016, the day after CrowdStrike publicly attributed the DNC hack to
Russian government actors, the persona Guccifer 2.0 published its first post on a WordPress
blog, publicly claiming responsibility for the hack. The post, titled "GUCCIFER 2.0 DNC'S
SERVERS HACKED BY A LONE HACKER," contained a number of documents that Guccifer
2.0 represented as "docs I downloaded from the Democrats network." Guccifer 2.0 also stated in
the same post that, with respect to the documents stolen from the DNC, "[t]he main part of the
papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon."
16. According to open source information, WikiLeaks is a self-described anti-secrecy
organization, which is responsible for releasing stolen documents from a number of government
and non-governmental entities. Julian Assange, an Australian citizen, founded WikiLeaks in or
around 2006, and he has stated in public interviews that he is deeply involved in running the
organization.
17. On or about June 20, 2016, Guccifer 2.0 registered the Twitter account
@GUCCIFER_ 2. Search warrant returns for that Twitter account show that Guccifer 2.0
communicated via direct message with WikiLeaks' Twitter account, @wikileaks, about the stolen
DNC documents, including about ways to maximize the impact of the documents on the 2016
U.S. presidential election. For example, on or about June 22, 2016, WikiLeaks sent a private
message to Guccifer 2.0, via Twitter, telling Guccifer 2.0 to "[s]end any new material [stolen
from the DNC] here for us to review and it will have a much higher impact than what you are
doing." On or about July 6, 2016, WikiLeaks stated, "if you have anything hillary related we
want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National
Convention] is approaching and she will solidify Bernie supporters behind her after." Guccifer
-6-
2.0 responded, "ok ... I see." WikiLeaks explained, "we think trump has only a 25% chance of
winning against Hillary ... so conflict between Bernie and Hillary is interesting."
18. According to information obtained through a court-authorized search of the
Target Account conducted in or around August 2016, I know that on or about July 14, 2016,
Guccifer 2.0 sent WikiLeaks an email with an attachment titled "wk dnc linkl .txt.gpg." Search
warrant returns for the Guccifer 2.0 Twitter account show that Guccifer 2.0 then sent a direct
message to WikiLeaks that appears to explain that the encrypted file contained instructions on
how to access an online archive of stolen DNC documents. On or about July 18, 2016,
WikiLeaks confirmed it had "the 1Ob or so archive" and would make a release of the stolen
documents "this week."
19. On or about July 22, 2016, WikiLeaks released over 20,000 emails and other
documents stolen from the DNC network. This release occurred approximately three days before
the start of the Democratic National Convention. WikiLeaks did not disclose Guccifer 2.0's role
in providing them.
20. On or about October 7, 2016, WikiLeaks released the first set of emails that had
been stolen from John Podesta, chairman of the Clinton Campaign. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately thirty-three tranches
of documents that had been stolen from Podesta. Based on an assessment of the WikiLeaks
releases, investigators believe that the total amount of stolen election-related data released by
WikiLeaks was substantially greater than the 1GB of stolen data apparently contained in the
online archive provided by Guccifer 2.0, as described above.
-7-
21. In an August 2017 interview, AS SANGE indicated that only a small number of
people, including himself, worked on the release of the DNC emails. 3 Based on public source
information, I know that AS SANGE made false and misleading statements about the origins of
the stolen documents, including statements that insinuated that WikiLeaks had received them
from a recently-deceased DNC employee.
22. Investigators have learned that WikiLeaks and/or ASSANGE communicated,
including via intermediaries, about the stolen documents with Roger J. Stone ("STONE"), who
advised the presidential campaign of Donald J. Trump in 2015 and who remained in contact with
individuals employed by the campaign through the 2016 election. For example, search warrant
returns for STONE's Hotmail account , show that on or about July 25,
2016, STONE directed one of his associates, Jerome CORSI, to "[g]et to Assange [a]t the
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... ." On or about July
31, 2016, Stone reached out again to CORSI, suggesting that he should "see Assange." A few
days later, on or about August 2, 2016, CORSI emailed STONE, "Word is friend in embassy
plans 2 more dumps. One shortly after I'm back 2nd in Oct[ober]. Impact planned to be very
damaging .... " I believe that CORSl's reference to a "friend in [the] embassy" refers to
ASSANGE.
C. The Target Account
23. According to subscriber information obtained from WordPress in July 2016, the
Guccifer 2.0 WordPress account ) was created on June 15, 2016 using
the email addres and Target Account was listed as
3
See https://www.newyorker.com/magazine/2017/08/21/julian-assange-a-man-without-a-country
-8-
another email address on the account. Subscriber records for the Target Account indicate that it
was created on July 23, 2016 in the name of "Guccifer Second."
24. The FBI searched the Target Account in approximately August 2016 pursuant to
a search warrant authorized by the Northern District of California. In approximately September
2017, the government obtained additional non-content information about the Target Account
pursuant to 18 U.S.C. § 2703(d), which included header information for the period of time
between approximately August 2016 and September 2017. The header information shows that
the Target Account continued to receive emails through at least approximately February 25,
2017, including emails from WordPress and the file sharing services DropBox and MediaFire,
which were not captured in the original court-authorized search conducted in August 2016.
25. Subscriber records obtained from l&l Mail in August 2018 show that the Target
Account is still active (that is, it has not been deleted). The last login is listed as October 18,
2016. Records from the Target Account will, among other things, assist investigators in
understanding Guccifer 2.0's use of file sharing services, which may in turn assist investigators
in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks
and others.
BACKGROUND CONCERNING l&l MAIL
26. In my training and experience, I have learned that l&l Mail provides a variety of
on-line services, including electronic mail ("email") access, to the public. 1& 1 Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target
Account. Subscribers obtain an account by registering with l&l Mail. During the registration
process, 1& 1 Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1& 1 Mail are likely to contain stored electronic communications (including retrieved
-9-
and unretrieved email for l&l Mail subscribers and information concerning subscribers and their
use of 1& 1 Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute
account. In addition, email providers often have records of the Internet Protocol address
to the account. Because every device that connects to the Internet must use an IP address,
-10-
the email account.
29. In my training and experience, m some cases, email account users will
provider's support services, as well as records of any actions taken by the provider or user as a
under the control of l&l Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
disclosure pursuant to the requested warrant of the contents of wire or electronic communications
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
regardless of whether such communication, record, or other information is stored, held, or
maintained outside the United States.
-11-
32. Because there is probable cause to believe that the Target Account is an
operational account created to further criminal conduct, this application seeks authorization to
seize the information in Attachment B from the time of the creation of the account to the present.
-12-
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team.
CONCLUSION
REQUEST FOR SEALING
-Ei?~
Special Agent
Subscribed and sworn to before me on this _df}_~ yof August, 2018.
__,
rable Rudolph Contreras
United States District Judge
-13-
ATTACHMENT A
This warrant applies to information associated with the following l&l Mail account, which
is stored at premises owned, maintained, controlled, or operated by l&I Mail & Media, Inc., a
company headquartered in Chesterbrook, Pennsylvania:
-1-
ATTACHMENTB
custody, or control of 1& 1 Mail & Media, Inc. (the "Provider"), including any messages, records,
files, logs, or information that have been deleted but are still available to the Provider, or have
been preserved pursuant to a request made under 18 U.S.C. § 2703(£), the Provider is required to
disclose the following information to the government for each account listed in Attachment A:
and files;
-2-
actions taken;
1. All device information associated with the account, including all instrument or
J. For any accounts linked to the accounts listed in Attachment A, including accounts
-3-
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud);
and 52 U.S.C. § 30121 (foreign contribution ban), including:
a. Evidence of unauthorized access to protected computers;
b. Evidence of the distribution or transfer of data obtained through unauthorized
access to protected computers;
c. Evidence indicating how and when the account was accessed or used, to determine
d. Evidence indicating the account owner's state of mind as it relates to the crimes
e. The identity of the person(s) who created or used the account, including records
f. Communications, records, documents, and other files related to any expenditure,
g. Records of any funds or benefits disbursed by or offered on behalf of any foreign
principals;
-4-
h. Communications, records, documents, and other files that reveal efforts by any
foreign principals;
J. The identity of any person(s)-including records that help reveal the whereabouts
-5-


Case: 1:18-sc-02670
INFORMATION AS SOCIA TED WITH ONE
ACCOUNT STORED AT PREMISES
CONTROLLED BY l&l MAIL & MEDIA, Assign. Date : 8/20/2018
INC. Description: Search & Seizure Warrant

TO REQUIRE NO -DIS 'LOSURE UND "' R 18 U.S .C. § 2705(b)
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct l&l Mail & Media, Inc. ("l&l Mail"), an electronic
communication and/or remote computing services provider headquartered in Chesterbrook,
Pennsylvania, not to notify any other person (except attorneys for l&l Mail for the purpose of
receiving legal advice) of the existence or content of the Warrant for a period of one year or until
18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. § 3237.
U.S.C. § 2705(b). l&l Mail provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how l&l Mail may be
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the

1
Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(1 )(B), but the Government does not seek to use the proposed Order for any legal process
2
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
government makes the required showing under § 2705(b ), the court is required to
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
command l&l Mail not to notify any other person (except attorneys for 1&1 Mail for the purpose
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FA N-DlSCLOSURE
6. The Federal Bureau oflnvestigation ("FBI") is investigating WikiLeaks and others
for violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer);
18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud),
3
and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign
contribution ban) (the "Subject Offenses"), in connection with efforts to compromise the networks
of the Democratic National Convention ("DNC"), the Democratic Congressional Campaign
Committee ("DCCC"), and the email accounts of U.S. persons involved in the 2016 presidential
election, followed by the public release of stolen materials through various outlets.
of the Court and that l&l Mail and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for 1& 1 Mail for the purpose of receiving
legal advice) for a period of one year or until further order of the Court. Such an order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant
and related papers may also alert the targets to the scope of information known to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take
steps to undermine the investigation and avoid future prosecution. In particular, given that they
are known to use electronic communication and remote computing services, the potential target
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity.
4
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S .C.
10. Based on prior dealings with l&l Mail, the United States is aware that, absent a
court order under Section 2705(b) commanding l&l Mail not to notify anyone about a legal
request, 1& 1 Mail may, upon receipt of a warrant seeking the contents of electronically stored wire
or electronic communications for a certain account, notify the subscriber or customer of the
existence of the warrant prior to producing the material sought.
1& 1 Mail not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for 1& 1 Mail for the purpose of receiving legal advice) for a period of one year
or until further order of the Court.

Special Counsel
Dated: 8 [2o/( 8 By:

Kyle
The ·a l Counsel's O · e
(202) 616-3812
5
AUG 2o2018
IN THE UNITED STATES DISTRICT COURT Courts tor the District of Columbia

Case: 1: 18-sc-02670
CONTROLLED BY l&l MAIL & MEDIA,
INC.
ORDER
and to require l&l Mail & Media, Inc. ("1&1 Mail"), an electronic communication and/or remote
computing services provider headquartered in Chesterbrook, Pennsylvania, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C . § 2705(b), l&l Mail and its
attorneys for I & I Mail for the purpose of receiving legal advice) for a period of one year or until
//L--
BLE RUDOLPH CONTRERAS
TES DISTRICT JUDGE
oG)oJdfl_c (
2

for the

or identify the person by name and address) ) Ass!gned To : Howell, Beryl A
INFORMATION ASSOCIATED WITH ) Assign. Date: 8/20/2018
ONE CELLULAR TELEPHONE NUMBER THAT IS ) Description: Search & Seizure Warrant
STORED AT PREMISES CONTROLLED BY AT&T )

of the following person or property located in the Southern District of Florida
See Attachment A
See Attachment B
property was taken.
City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge
AO 93 (Rev. I l/13) Search and Seizure Warrant (Page 2)
Return
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the cellular telephone assigned call
number ("the Account"), that is stores at premises controlled by AT&T ("the
Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida.
-1-
ATTACHMENT B
I. Information to be disclosed by Provider
custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.
§ 2703(f), the Provider is required to disclose to the government the following information
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through
November 15, 2016:
a. The following information about the customers or subscribers of the Account:
1. Names (including subscriber names, user names, and screen names);
ii. Addresses (including mailing addresses, residential addresses, business

addresses, and e-mail addresses);
m. Local and long distance telephone connection records;
1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
v. Length of service (including start date) and types of service utilized;
vi. Telephone or instrument numbers (including MAC addresses, Electronic

Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifier ("MEID"); Mobile Identification Number
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MS ISDN"); International
Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi");
vii. Other subscriber numbers or identities (including the registration Internet

Protocol ("IP") address); and
viii. Means and source of payment for such service (including any credit card
or bank account number) and billing records.
-2-
b. All records and other information (not including the contents of communications)
relating to wire and electronic communications sent or received by the Account,
including:
1. the date and time of the communication, the method of the
communication, and the source and destination of the communication
(such as the source and destination telephone numbers (call detail
records), email addresses, and IP addresses); and
11. information regarding the cell tower and antenna face (also known as
"sectors") through which the communications were sent and received.
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting),
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
14, 2016 to November 15, 2016.
-3-
UNITED STATES DISTRICT COURT FI .

for the
AUG 2 O 2018
GI erk, U,S. District & Bankruptcy
(Briefly describ • the p roperty to be searched
or ide111ify the p erson by name nnd address)
ONE CELLULAR TELEPHONE NUMBER STORED AT
l
)
)
PREMISES CONTROLLED BY AT&T )

property to be searched and give its location) :
See Attachment A
located in the - - - -- District of - - --
- --Southern Florida
- - - - - -- -
See Attachment B
0 contraband, fruits of crime, or other items illegally possessed;
0 property designed for use, intended for use, or used in committing a crime;


0 Delayed notice of days (give exact ending date if more than 30 days: - - - - - ) is requested
c_A~,-
.c.-
1. ~ ,..--·-~~-
pp 1ca11 s signature
IKyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI

Date: _ 8_µg!_)i}( (
/ Judge's signature
City and state: Washington, D.C. Hon. Rudolph Contreras, U.S. District Judge
~Il
AUG 2 o 2018
Clork, U.S. District & Baok1optcy
IN THE UNITED STATES DISTRICT COURT Courts for the blstrlct of Columbia

ONE CELLULAR TELEPHONE NUMBER Assign. Date : 8/20/2018
THAT IS STORED AT PREMISES Description: Search & Seizure Warrant
CONTROLLED BY AT&T
1. I make this affidavit in support of an application for a search warrant under 18
U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a
certain cellular telephone assigned call number ("Target Telephone"), which is
stored at premises owned, maintained, controlled or operated by AT&T, a wireless telephone
service provider headquartered in North Palm Beach, Florida. The information to be disclosed by
AT&T and searched by the government is described in the following paragraphs and in
Attachments A and B.
2. I am a Special Agent with the Federal Bureau oflnvestigation (FBI), and have been
since 2011. As a Special Agent of the FBI, I have received training and experience in investigating
criminal and national security matters.
intended to show merely that there is sufficient probable cause for the requested warrant and does
not set forth all of my knowledge about this matter.
4. Based on my training and experience and the facts as set forth in this affidavit; there
- 1-
is probable cause to believe that violations of the following statutes have been committed or are
being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C.
§ 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false
statements), 18 U.S.C. § l 030 (unauthorized access of a protected computer), 18 U.S.C. § 1343
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C.
§ 3012l(a)(l)(C) (foreign expenditure ban). There also is probable cause to search the information
described in Attachment A for evidence of the Subject Offenses, further described in Attachment
B.
JURISDICTION
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
6. When the Government obtains records under § 2703 pursuant to a search warrant,
the Government is not required to notify the subscriber or any other person of the warrant, for such
a period as the Court deems appropriate, where there is reason to believe that such notification will
seriously jeopardize an investigation. 18 U.S.C. § 2705(b).
PROBABLE CAUSE
7. The Special Counsel's Office, with FBI's assistance, is investigating the Russian
government's efforts to interfere in the 2016 presidential election, as well as any links and/or
coordination between the Russian government and individuals associated with the campaign of
President Donald Trump ("Trump Campaign"). This includes investigating Roger Stone (STONE)
-2-
and others known and unknown, in connection with the hacking of email accounts associated with
the Democratic National Committee (DNC), Democratic Congressional Campaign Committee
(DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the
subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization
WikiLeaks, among others.
8. This application seeks cell-site location information for the Target Telephone,
used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this
corresponds to the time period during which there is evidence that STONE was engaged in, and
attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder
Julian ASSANGE about the content of stolen documents prior to their public release. During this
same time period, STONE was also in communications with members of the Trump Campaign.
1. Roger STONE
Donald J. Trump (the "Campaign") until August 2015. Although Stone had no official relationship
with the Campaign thereafter, STONE maintained his support for Trump and continued to make
media appearances in support of the Campaign. As described further below, STONE also
maintained contact with individuals employed by the Campaign, including then-campaign
chairman Paul MANAFORT and deputy chairman Rick GATES.
ii. Jerome CORSI
information, currently serves as the "Washington Bureau Chief for Inforwars.com." According to
-3 -
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter" for
the website "World Net Daily" a/k/a "WNO.com." CORSI has also written a number of books
regarding Democratic presidential candidates. As described further below, CORSI was in contact
with STONE during the summer and fall of 20 I 6 regarding forthcoming disclosures of hacked
information by WikiLeaks, and appears to have obtained information regarding upcoming
disclosures which he relayed to STONE.
B. Russian Government-Backed Hacking Activity During the 2016 Presidential Election
-4-
developed a clear preference for President-elect Trump.
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and
maintained that access until at least June 2016." The USIC attributed these cyber activities to the
Russian GRU, also known as the Main Intelligence Directorate: "GRU operations resulted in the
compromise of the personal e-mail accounts of Democratic Party officials and political figures. By
May, the GRU had exfiltrated large volumes of data from the DNC."
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release
US victim data obtained in cyber operations publicly and in exclusives to media outlets."
-5-
the DNC's cloud-based systems using the cloud provider's own technology. The individuals used
three new accounts with the same cloud computing service to move the "snapshots" to those
accounts.
20. On or about November 1, 2016, individuals associated with the GRU spearphished
over 100 accounts used by organizations and personnel involved in administering elections in
numerous Florida counties.
C. Evidence of Google Searches Relating to the Conduct Under Investigation
22. During the course of its investigation, the FBI has identified a series of searches
that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona.
In pa1iicular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress
blog), records from Google show that searches were conducted for the terms "guccifer" and
-6-
"guccifer j une," from an IP address within the range 107. 77 .216.0/24. 1 This IP range is assigned
to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida.
23. IP logs obtained from Twitter show that STONE used multiple IP addresses within
the range 107.77.216.0/24 to log into his Twitter account@RogerJStoneJr.
24. Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about
June 13, 2018, the FBI obtained all searches conducted by the CookieIDs that conducted the
Guccifer-related searches described above. 2 Based on these results, the FBI has not yet been able
to attribute the searches to any particular user.
D. STONE's Public Interactions with Guccifer 2.0 and WikiLeaks
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on
its WordPress blog that, with respect to the documents stolen from the DNC, "[t]he main part of
the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon." In
that post, Guccifer 2.0 also began releasing hacked DNC documents.
the DNC.
1
Google does not retain full IP addresses for searches conducted more than one year ago. The
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a
range of up to 256 IP addresses.
2
Google assigns unique CookieIDs to searches conducted while a user is not logged into a Google
account. All searches conducted from the same device and browser during a 24-hour window are
associated with the same CookieID.
-7-
28. · On August 8, 2016, STONE addressed the Southwest Broward Republican
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: "With regard
actually have communicated with Assange. I believe the next tranche of his documents pertain to
the Clinton Foundation but there's no telling what the October surprise may be." A few days later,
STONE clarified that while he was not personally in touch with AS SANGE, he had a close friend
who served as an intermediary.
Guccifer 2.0 a "HERO" after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer
2.0's Twitter account was reinstated.
-8-
33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: "Trust me, it will
Assange is a hero ... I think he's taking on the deep state, both Republican and Democrat. I believe
that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton
aides, believe they deleted. That and a lot more. These are like the Watergate tapes."
35. On Saturday, October 1, 2016, usmg @RogerJStoneJr, STONE tweeted,
-9-
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement- which was
described this release as the "mother load." On October 5, 2016, STONE used@RogerJStoneJr to
tweet: "Payload coming. #Lockthemup."
"REI,,EASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer" and containing a link to
approximately 2,050 emails that had been hacked from John Podesta's personal email account.
Day, November 8, 2016. On October 12, 2016, Podesta - referring back to STONE's August 21,
2016 C-SP AN and Twitter references - argued publicly that "[it is] a reasonable assumption to -
influence with him or that I have advanced knowledge of the specifics of what he is going to do. I
do believe he has all of the e-mails that Ruma Abedin and Cheryl Mills, the Clinton aides, thought
were deleted. I hear that through my emissary."
40. On March 27, 2017, CNN reported that a representative ofWikiLeaks, writing from
-10-
an email address associated with WikiLeaks, denied that there was any backchannel
account @wikileaks. 3 The latter account is the official Twitter account of WikiLeaks and has been
described as such by numerous news reports. The message read: "Sine~ I was all over national
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents
and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the
@wikileaks: "Ha! The more you \"correct\" me the more people think you're lying. Your operation
leaks like a sieve. You need to figure out who your friends are."
44. On or about November 9, 2016, one day after the presidential election, @wikileaks
3
On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter
account@RogerJStoneJr.
-11-
sent a direct message to @RogerJStoneJr containing a single word: "Happy?" @wikileaks
to communicate."
45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the
founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: "Still
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from
the government and the courts ruled it was legal to do so and refused to issue an order restraining
the paper from publishing additional articles. If the US government moves on you I will bring
down the entire house of cards. With the trumped-up sexual assault charges dropped I don't know
of any crime you need to be pardoned for - best regards. R." That same day, @JulianAssange
responded: "Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most
@JulianAssange, reading: "I am doing everything possible to address the issues at the highest level
of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this

Forthcoming Leaks
4 7. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia
issued a search warrant for STONE's address, On October 17,
2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
-12-
warrant for email account. On or about March 14, 2018, Chief Judge Howell issued
a search warrant for STONE's iCloud account. Information recovered pursuant to those search
warrants indicated the following:
schedule. Need to get something confirmed now .... " CORSI responded, "I copied Roger Stone
so he knows your availability to meet Manafort and DT this coming week." CORSI appears to
have forwarded the message to STONE at who replied to CORSI that,
"May meet Manafort -guarantee nothing."
CORSI wrote,
50. On July 25, 2016, STONE, using sent an email to CORSI
with the subject line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they deal with
51. On or about July 31, 2016, STONE, using emailed
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist - tum him for
-13-
tweeted about "Podesta's time m the barrel"), CORSI emailed STONE at
back. 2nd in Oct. Impact planned to be very damaging." The email continued, "Signs are Fox will
have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now.
Post-DNC bump for HRC an artifact ofrigged polling. Won't last. I expect presidential campaign
to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed
as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are
now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor
she well. I expect that much of next dump focus, setting stage for Foundation debacle."
Investigators believe that CORSI's reference to a "friend in embassy [who] plans 2 more dumps"
refers to ASSANGE, who resided in Ecuador's London Embassy in 2016.
led Trnmp by 15 points. STONE responded on or about the same day, "enjoy it while u can[.] I
dined with my new pal Julian Assange last night." subsequently stated to investigators
that, around the same time, STONE told him he had gone to London to meet ASSANGE.
also stated that in 2018, told STONE he would be interviewed by the FBI
and would have to divulge the conversation about meeting ASSANGE. STONE told
he was joking and had not actually met AS SAN GE. 4
-14-
54. Through a search of STONE's iCloud account, the FBI has uncovered evidence
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed,
in his email to to have "dined" with ASSANGE. For example, an associate of
STONE sent a text to STONE at approximately 3:38PM on August 2, asking "How did ur meeting
go in LA?" STONE responded. "It's this afternoon[.]" The following day, the associate asked,
"Any report from ur meeting?" On or about August 4, 2016, STONE texted the associate, "Will
call later - heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-Iocation
information indicating that it was taken in Los Angeles.
"Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it's not over
yet. More to come than anyone realizes. Won't really get started until after Labor Day. I'm in NYC
this week. Jerry."
"Did you get the PODESTA writeup." STONE replied "[y]es."
investigation - tied to Ukraine Yanukovych - Panama papers reveals Podesta hired by S [bJerbank,
Russia's largest financial institution-Podesta$$$ ties to Russia undermine Clinton false narrative
attempting to tie Trump to Putin."
-15-
more on Turkey. Need a back channel highly sensitive stuff." CORSI responded, "We have secure
back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again
today." wrote back, "Awaiting secret file. Explosive ... Hope you are well. Can't wait
for the debate. Channeling Reagan, I hope!" CORSI responded, "Keep me posted about file[.]"
In a subsequent meeting with investigators, indicated this conversation concerned
possible derogatory information he was trying to obtain from Turkey.
be out in Jan. Many scores will be settled." The associate forwarded the email to Steve BANNON,
61. On or about October 4, 2016, AS SANGE gave a press conference at the Ecuadorian
Embassy. There had been speculation in the press leading up to that event that ASSANGE would
release information damaging to then-candidate Clinton, but WikiLeaks did not make any new
releases. Instead, ASSANGE promised more documents, including information "affecting three
powerful organizations in three different states, as well as, of course, information previously
referred to about the U.S. election process." ASSANGE also stated that WikiLeaks would publish
documents on various subjects every week for the next ten weeks, and vowed that the U.S.
election-related documents would all come out before Election Day.
-16-
to kill him and the London police are standing done [sic]." BANNON wrote back, "He didn't cut
deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big democrat."
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was
about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON
had been hoping for releases of damaging information that morning.
Are Released
65. According to a publicly available news article, 5 at approximately 11AM on Friday,
October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source
regarding a previously unaired video of candidate Trump. According to the same article,
"Fahrenthold didn't hesitate. Within a few moments of watching an outtake of footage from a 2005
segment on 'Access Hollywood,' the Washington Post reporter was on the phone, calling Trump's
campaign, 'Access Hollywood,' and NBC for reaction."
5
https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-Iev.:d-tape-of-donald-trump-
then-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875e-2c 1bfe943 b66_story.html
-17-
71. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked
from John Podesta that focused primarily on materials related to the Clinton Foundation. On or
about August 2, 2016, CORSI emailed STONE using "I expect that
much of next dump focus, setting stage for Foundation debacle."
forwarded message to CORSI without comment. STONE does
not appear to have forwarded the email to any other individual.
73. On or about October 8, 2016, STONE messaged CORSI, "Lunch postponed-have
to go see T." CORSI responded to STONE, "Ok. I understand." Approximately twenty minutes
later, CORSI texted, "Clintons know they will lose a week of Paula Jones media with T attacking
Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers."
-18-
CORSI wrote back at approximately 8:54AM EDT, "Ok. Monday. The remaining stuff on Podesta
is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian
advance knowledge of the publication of his emails. At approximately 3 :25PM EDT, CORSI
emailed STONE at both , with the subject line
76. CORSI followed up several minutes later with another email titled, "Podesta talking
points," with the text "sent a second time just to be sure you got it." STONE emailed CORSI back
via the Hotmail Account, "Got them and used them."
CLINTON FOUNDATION." STONE responded, "Nice but I was hoping for a piece I could post
under my by-line since I am the one under attack by Podesta and now Mook." CORSI wrote back
to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me like
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once had
the channel open from Metcombank to Deutsche Bank America to Ban[k] of America's Clinton
Fund account, there's no telling how much money he laundered, or where it ended up. Nothing in
-19-
Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia &
Metcombank[.] I'm working on that angle now." STONE replied, "Ok Give me SOMETHING to
post on Podesta since I have now promised it to a dozen MSM reporters[.]"
JOHN PODESTA." The text stated: "Roger[,] You are free to publish this under your own name."
Podesta nor I have I ever received documents or data from Wikileaks." The post then asked, "Just
how much money did a controversial Russian billionaire investor with ties to
the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional
bank owned 99.978 percent by with the money transferred via Deutsche Bank and
Trust Company Americas in New York City, with the money ending up in a private bank account
in the Bank of America that is operated by the Clinton Foundation?"
account, "I'm in NYC. Thinking about writing piece attacking Leer and other women. It's basically
a rewrite of what's out there. Going through new Wikileaks drop on Podesta."
"On Assange, can you call me now - before 2pm[.]" STONE responded, "Missed u - just landed
JFK - on Infowars now." CORSI wrote back, "Call afterwards. Have some important intel to
share."
-20-
with the subject, "Fwd: ASSANGE ... URGENT ... " CORSI wrote,
"From a very trusted source," and forwarded an email with the header information stripped out,
showing only the body text. The email read, "Yes[.] I figured this. Assange is threatening Kerry,
Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that
he has a set of dead man files that include Hillary. It's what they used to call a 'Mexican stand
off[.]' Only hope is that if Trump speaks out to save him[.] Otherwise he's dead anyway, once he's
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange
has to play out. He's called Podesta's bluff and raised him the election."
which he claimed he had, "no advance notice ofWikileaks' hacking of Podesta's e-mails." STONE
stated that, "I predicted that Podesta's business dealings would be exposed. I didn't hear it from
Wikileaks, although Julian Assange and I share a common friend. I reported the story on my
website." STONE linked to the story he had asked CORSI to write for him on October 13, 2016
discussed above.
-21-
I. The Target Telephone
87. Search warrant returns for STONE's Hotmail account,
show that on numerous occasions, including in 2016, STONE provided the Target Telephone
Number to individuals as his cellular telephone number and/or the way to reach him. On or about
August 17, 2017, AT&T, indicated that the "user" of the
Target Telephone Number is "Roger J. Stone." Publicly available databases indicate the Target
Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a
company investigators have linked to STONE.
88. There is evidence that STONE used the Target Phone in connection with the
conduct under investigation. For example, according to records
a) STONE called CORSI on or about July 25, 2016 from the Target Phone, and spoke
with him for approximately twenty-six minutes. Less than roughly two hours after that call,
STONE emailed CORSI, "Get to Assange [a]t the Ecuadorian Embassy in London and get the
pending wikileaks emails .... "
b) On or about July 30, 2016--one day before STONE instructed CORSI to have
contact ASSANGE-Manafort, who was then-Chairman of the Trump Campaign,
called STONE on the Target Phone Number. The two spoke for approximately sixty-seven
minutes.
c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure,
STONE received a call from the Washington Post at the Target Phone Number, and shortly
thereafter, STONE had two conversations with CORSI from the Target Phone Number.
89. As set forth in Attachment B, this application seeks cell-site location information
-22-
for the Target Telephone between Ju ne 14. 201 6-the day before a Google search was conducted
for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0's first public
appearance-and November 15, 2016- one week after the 2016 presidential election and less than
one week after CORSI messaged STONE about having "interesting news" for him. Given
STONE's repeated communications with and/or about the WikiLeaks releases during this time,
including discussions about the content of the documents prior to their release, there is probable
cause to believe that STONE's whereabouts during this time period will yield evidence of the
Subject Offenses under investigation. Location information for the Target Phone will assist
investigators in determining, among other things: whether STONE was in Florida at the time of
the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or
around any of the events or communications discussed above; and where STONE was on the night
he claimed he "dined" with ASSANGE. 6 Location information will also assist investigators in
identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential
co-conspirators during this time period.
BACKGROUND CONCERNING AT&T
90. In my training and experience, I have learned that AT&T is a company that provides
cellular telephone access to the general public. I also know that providers of cellular telephone
service have technical capabilities that allow them to collect and generate information about the
locations of the cellular telephones to which they provide service, including cell-site data, also
6
As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to
have met AS SANGE, but the FBI is investigating whether STONE may have met an intermediary
instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site
location information varies depending on the distance between towers (among other things).
Given the density of Los Angeles, I believe that cell-site location data for STONE's trip there
would assist investigators in determining, among other things, whether STONE was present at the
locations he has publicly claimed to have been.
-23-
known as "tower/face information" or "cell tower/sector records." Cell-site data identifies the
"cell towers" (i.e., antenna towers covering specific geographic areas) that received a radio signal
from the cellular telephone and, in some cases, the "sector" (i.e., faces of the towers) to which the
telephone connected. These towers are often a half-mile or more apart, even in urban areas, and
can be 10 or more miles apart in rural areas. Furthennore, the tower closest to a wireless device
does not necessarily serve every call made to or from that device. Accordingly, cell-site data
provides an approximate location of the cellular telephone but is typically less precise than other
types of location information, such as E-911 Phase II data or Global Positioning Device ("GPS")
data.
91. Based on my training and experience, I know that AT&T can collect cell-site data
about the Target Telephone. Cell-site location data is typically generated only when the phone
is used to engage in communications. I also know that wireless providers such as AT&T typically
collect and retain cell-site data pertaining to cellular phones to which they provide service in their
normal course of business in order to use this information for various business-related purposes.
92. Based on my training and experience, I know that wireless providers such as
AT&T typically collect and retain information about their subscribers in their normal course of
business. This information can include basic personal information about the subscriber, such as
name and address, and the method(s) of payment (such as credit card account number) provided
by the subscriber to pay for wireless telephone service. I also know that wireless providers such
as AT&T typically collect and retain information about their subscribers' use of the wireless
service, such as records about calls or other communications sent or received by a particular
phone and other transactional records, in their normal course of business. In my training and
experience, this information may constitute evidence of the crimes under investigation because
-24-
the information can be used to identify the Target Telephone user or users and may assist in the
identification of co-conspirators and/or victims
other operative privileges. The procedures include use, if necessary, of a designated "filter team,"
separate and apart from the investigative team, in order to address potential privileges. The
government, however, does not at this time anticipate that any of the items described in
Attachment A will contain materials requiring review by a designated filter team.
CONCLUSION
-25-
REQUEST FOR SEALING
c:::::~
Andrew Mitchell
Special Agent
Subscribed and sworn to before me on this .Jfl day of August, 2018.
The Honor ble Rudolph Contreras

United States District Judge
-26-
ATTACHMENT A
This warrant applies to information associated with the cellular telephone assigned call
number ("the Account"), that is stores at premises controlled by AT&T ("the
Provider"), headquartered at 11760 US Highway 1, North Palm Beach, Florida.
-1-
ATTACHMENT B
I. Information to be disclosed by Provider
custody, or control of the Provider, including any information that has been deleted but is still
available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C.
§ 2703(f), the Provider is required to disclose to the government the following information
pertaining to the Account listed in Attachment A for the time period June 14, 2016 through
November 15, 2016:
a. The following information about the customers or subscribers of the Account:
i. Names (including subscriber names, user names, and screen names);
11. Addresses (including mailing addresses, residential addresses, business

addresses, and e-mail addresses);
Ill. Local and long distance telephone connection records;
1v. Records of session times and durations, and the temporarily assigned
network addresses (such as Internet Protocol ("IP") addresses) associated
with those sessions;
v. Length of service (including start date) and types of service utilized;
vi. Telephone or instrument numbers (including MAC addresses, Electronic

Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"),
Mobile Equipment Identifier ("MEID"); Mobile Identification Number
("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"); International
Mobile Subscriber Identity Identifiers ("IMSI"), or International Mobile
Equipment Identities ("IMEi");
vii. Other subscriber numbers or identities (including the registration Internet

Protocol ("IP") address); and
vu1. Means and source of payment for such service (including any credit card
or bank account number) and billing records.
-2-
b. All records and other information (not including the contents of communications)
relating to wire and electronic communications sent or received by the Account,
including:
1. the date and time of the communication, the method of the
communication, and the source and destination of the communication
(such as the source and destination telephone numbers (call detail
records), email addresses, and IP addresses); and
11. information regarding the cell tower and antenna face (also known as
"sectors") through which the communications were sent and received.
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting),
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June
14, 2016 to November 15, 2016.
-3-

for the

or identify the person by name and address) ) Assigned To : Chief Judge Beryl A. Howell
INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date : 8/28/2018
STORED AT PREMISES ) Description: Search and Seizure Warrant
CONTROLLED BY FACEBOOK )

See Attachment A
See Attachment B
~ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
property was taken.
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge
property, will be searched or seized (check the appropriate box).
D for days (not to exceed 30) D until, the facts justifying, the later specific date of
Date and time issued: r ~

f'-"''-',""'""'"--
_ _,'3'--'/'----'-v=-f~ft._Cj,c__---''3"---',
City and state: _W_a_s_hi_n_..g_to_n_:_,_D_C_ _ _ _ _ _ __ Hon. J . Boasberg, U.S. District Judge

AO 93 (Rev. l l/13) Search and Seizure Warrant (Page 2)
Return
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
Facebook, Inc. ("Facebook"), a company headquartered in Menlo Park, California:
-1-
ATTACHMENT B
custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
following information to the government for each account listed in Attachment A:
photographs, rn:ticles, and other items; Notes; Wall postings; friend lists, including
tags; and information about the user's access and use ofFacebook applications;
-2-
"Friend" requests;
(j) All information about the Facebook pages that the account is or was a "fan" of;
(1) All records ofFacebook searches performed by the account;
number);
-3-
(t) All records pertaining to connnunications between Facebook and any person
conspiracy to connnit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the
connnunications regarding hacking, release of hacked material, connnunications
Julian Assange, or connnunications regarding disinformation, denial, dissembling
-4-
principals;
foreign principals;
investigation;
-5-
' 1. The identity of any non-U.S. person(s)-including records that help reveal the
principals.
in subsection II.a.
-6-
AUG 2 B 2018
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. Disirict & Bankruptoy
Courts. tor the District of Ga!mnhia

Assigned To : Chief Judge Beryl A. Howell
INFORMATION ASSOCIATED WITH ONE
ACCOUNT STORED AT PREMISES Assign. Date: 8/28/2018
. CONTROLLED BY FACEBOOK
ORDER
and to require Facebook, Inc. ("Facebook"), an electronic communication and/or remote
computing services provider headquartered in Menlo Park, California, not to disclose the existence
or contents of the Warrant pursuant to 18 U.S.C .. § 2705(b).
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until
ES E. BOASBERG
ISTRICT JUDGE
1/k~~
Date
2
Case
AO 106 (Rev. 04/10) 1:19-mc-00029-CRC

AUG 2 8 2018
for the
District of Columbia Clerk, U.S. Districi &, B~nkruptoy
Courts for the District ot Columbia

Case: 1:18-sc-02727
ONE ACCOUNT STORED AT PREMISES CONTROLLED )l Description: Search and Seizure Warrant
BYFACEBOOK

See Attachment A
located in the Northern District of ----~
California ----
See Attachment B
The basis for the search under Fed. R. Crim. P. 4I(c) is (check one or more}:
D a person to be arrested or a person who is unlawfully restrained.
r/ Continued on the attached sheet.

D Delayed notice of days (give exact ending date if more than 30 days: ) is requested
4~urA{,t!,,u.__ Applicant's signature
!Kyle R. Freeny (ASC) Curtis Heide, Special Agent, FBI

Date: 1/1--f/;t
City and state: Washington, D.C. Hon. J


INFORMATION ASSOCIATED WITH ONE Assigned To : Chief Judge Beryl A. Howell
CONTROLLED BY F ACEBOOK Description: Search and Seizure Warrant

in support thereof ( collectively herein the "Warrant") under seal, and precluding the provider from
disclosure, the proposed Order would direct Facebook, Inc. ("Facebook"), an electronic
communication and/or remote computing services provider headquartered in Menlo Park,
California, not to notify any other person (except attorneys for Facebook for the purpose of
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).


command Facebook not to notify any other person (except attorneys for Facebook for the purpose
order of the Court.
6. The Federal Bureau oflnvestigation ("FBI") is investigating violations of 18 U.S.C.
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
3
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.
10. Based on prior dealings with Facebook, the United States is aware that, absent a
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored wire
Facebook not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year
or until further order of the Court.

Special C o u n u
Dated: -~6c.,/~2==1?!~/~t---ef_,_2~ By:
5
FILED
AUG 2 8 2018
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia

INFORMATION ASSOCIATED WITH Assigned To : Chief Judge Beryl A. Howell
ONE ACCOUNT STORED AT PREMISES Assign. Date : 8/28/2018
CONTROLLED BY FACEBOOK Description: Search and Seizure Warrant
I, Curtis Heide, beingfirst duly sworn, hereby depose and state as follows:
information associated with the Facebook account registered to
("Target Account"), stored at premises owned, maintained, controlled or operated by Facebook,
Inc. ("Facebook"), a company headquartered in Menlo Park, California. The information to be
disclosed by Facebook and searched by the government is described in the following paragraphs
2. I have been a Special Agent with the Federal Bureau of investigation for 12 years.
In the course of my duties, I have been responsible for investigating federal crimes and national
security matters involving both counterintelligence and issues related to cybersecurity.
-1-
JURISDICTION
(c)(1 )(A). Specifically, the Court is "a district court of the United States (including a magistrate
PROBABLE CAUSE
i. Roger STONE
-2-
ii. Jerome CORSI
-3-

Election
-4-
those accounts.
-5-
presidential election, including conspiracy to connnit authorized access to protected computers.
C. STONE's ~.ublic Interactions with Guccifer 2.0 and WikiLeaks
theDNC.
21. On August 5, 2016, STONE published an article on Breitbart.com entftled, "Dear
-6-
later, STONE clarified that while he was not personally in touch with AS SAN GE, he had a close
-7-
part ofWikiLeaks' IO-year anniversary celebration - STONE told Infowars that his intermediary
-8-
-9-
account @wikileaks. l The latter account is the official Twitter account of WikiLeaks and has
37. On or about October 15, 2016,@RogerJStoneJr sent a direct message to
indisputably stolen from the govermnent and the courts ruled it was legal to do so and refused to
1On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the
-10-
40. On Saturday, June 10, 2017,@RogerJStoneJr sent a direct message to

Forthcoming Leaks
17, 2017, Chief Judge Howell issued a search warrant for one ofSTONE's addresses,
warrant for mail account. On or about March 14, 2018, Chief Judge Howell
-11-
CORSI wrote,
Assange[.] should find Bernie [SJ anders brother who called Bill a Rapist~ turn him for
-12-
call later -heading for airport now[.]" Additionally, investigators have identified a photograph in
STONE's iCloud that appears to have been taken on August 3, 2016 and had geo-location
-13-
S [b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
Can't wait for the debate. Channeling Reagan; I hope!" CORSI responded, "Keep me posted
-14-
important."
cut deal w/ clintons???" STONE replied, "Don't think so BUT his lawyer is a big
democrat."
-15-
STONE about WikiLeaks, because he had heard that STONE had a channel to AS SAN GE, and
Are Released.
59. According to a publicly available news article, 3 at approximately I !AM on
Access Hollywoodtape.
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/31d74714-8ce5- l l e6-875e-2c 1bfe943b66_story.html
-16-
On or about August 2, 2016, CORSI emailed STONE using "I expect
that much of hext dump focus, setting stage for Foundation debacle."
numbers."
-17-
emailed STONE at both with the subject
-18-
transferred via Deutsche Bankand Trust Company Americas in New York City, with the money
Foundation?"
intel to share."
-19-
AS SANGE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
which he claimed he had, "no advance notice of Wikileaks' hacking of Podesta' s e-mails."
-20-
-21-

with Wikileaks
-22-
of Clinton campaign chairman John Podesta' s email, that I had advanced knowledge of
are facts ....
true.

MR. STONE: No.
-23-
MR. STONE: That -
occasions.
2017, STONE published an article on his website, stonecoldtruth.com, titled "ls it the Podesta's
Time in the Barrel Yet?" In that article, STONE stated: "[l]t was this inevitable scrutiny of the
have quite falsely claimed, to the hacking and publication almost two months later of Jolm
save the plan' ........ Richard Nixon[.]" CREDICO responded, "Ha ha."
5th Amendment rights if compelled to appear." They continued to message, and CREDICO
-24-
guess Schiff will try to get one ofus indicted for perjury[.]"
now you can relax."
times.
pending publication,' ... Credi co never said he knew or had any information as to source or
-25-
the FBI today what a headache(.] 4 You could have just told him the truth that you didn't have a
no back-channel and you could have just told the truth ... You want me to cover you for perjury
now[.]" STONE responded, "What the fuck is your problem? Neither ofus has done anything
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure,
98. STONE and CREDICO continued to message each other on or about December I,
-26-
initial contact."
Assange until September oflast year."
from you," referring to CREDICO's therapy dog. CREDICO stated that it was "cetiainly scary .
5 https://www.yahoo.com/news/comedian-randy-credico-says-trurnp-adviser-roger-stone-
-27-
K Statements Regarding STONE's Use of Social Media
105. On or about Friday, May 18, 2018 was voluntarily interviewed
right-hand man. 7
106. According t STONE utilized the services of several individuals to
instructed these individuals about what to post. tated that he purchased a couple
accounts.
6 https ://www.motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
7 told investigators that he would sometimes send emails from STONE's account.
-28-
108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,
the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
account show that STONE or one of his associates created an ad
campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
Intel says he is."
109. According to subscriber records, the email account
was created on August 17, 2015, in the name of"Falo Memo Tio." 8 STONE's Hotmail account
is listed as the recovery email for the account. In my training and
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
example, in the event a password is lost or compromised. Accordingly, there is probable cause
to believe that STONE controls (directly, or through an employee or associate) the email account
110. The goverrnnent obtained non-content information associated with the
pursuant to an order issued by Chief Judge Howell under 18 U.S.C.
8 Subscriber records list the "Language Code" for the email account as "pt_BR." I believe this
indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-
§ 2703(d). Although subscriber records indicate that the last login to the email account took
place on August 18, 2015, header information shows that the account continued to receive emails
until at least July 27, 2018, including from companies that offer advertisement placements.
111. Header information shows that the email account received multiple emails from
Facebook between approximately November 3, 2016 and November 7, 2016, shortly before the
U.S. presidential election. On or about October 5, 2016, the email account also received an
email from [email protected], an account that I believe is associated with Google
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
advertising on its network of content sites.
112. Based on a query performed through Facebook's law enforcement portal, the FBI
has confirmed that the email account is registered to an active
Facebook account. As explained further below, in my training and experience, I know that, in
addition to posting content and purchasing advertisements, Facebook accounts can be used to
communicate privately and directly with other users through Facebook's messaging function.
This function is similar to the direct messaging function of Twitter, which STONE used to
communicate with WikiLeaks and ASSANGE in 2016 and 2017.
BACKGROUND CONCERNING FACEBOOK
113. Facebook owns and operates a free-access social networking website of the same
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish
accounts with Facebook, and users can then use their accounts to share written news, photographs,
videos, and other information with other Facebook users, and sometimes with the general public.
-30-
114. Facebook asks users to provide basic contact and personal identifying information
to Facebook, either during the registration process or thereafter. This information may include the
user's full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook
security questions and answers (for password retrieval), physical address (including city, state, and
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook
also assigns a user identification number to each account.
115. Facebook users may join one or more groups or networks to connect and interact
with other users who are members of the same group or network. Facebook assigns a group
identification number to each group. A Facebook user can also connect directly with individual
Facebook users by sending each user a "Friend Request." If the recipient of a "Friend Request"
accepts the request, then the two users will become "Friends" for purposes of Facebook and can
exchange communications or view information about each other. Each Facebook user's account
includes a list of that user's "Friends" and a "News Feed," which highlights information about the
user's "Friends," such as profile changes, upcoming events, and birthdays.
116. Facebook users can select different levels of privacy for the communications and
information associated with their Facebook accounts. By adjusting these privacy settings, a
Facebook user can make information available only to himself or herself, to particular Facebook
users, or to anyone with access to the Internet, including people who are not Facebook users. A
Facebook user can also create "lists" of Facebook friends to facilitate the application of these
privacy settings. Facebook accounts also include other account settings that users can adjust to
control, for example, the types of notifications they receive from Facebook.
117. Facebook users can create profiles that include photographs, lists of personal
interests, and other information. Facebook users can also post "status" updates about their
-31-
whereabouts and actions, as well as links to videos, photographs, articles, and other items available
elsewhere on the Internet. Facebook users can also post information about upcoming "events,"
such as social occasions, by listing the event's time, location, host, and guest list. In addition,
Facebook users can "check in" to particular locations or add their geographic locations to their
Facebook posts, thereby revealing their geographic locations at particular dates and times. A
particular user's profile page also includes a "Wall," which is a space where the user and his or
her "Friends" can post messages, attachments, and links that will typically be visible to anyone
who can view the user's profile.
118. Facebook allows users to upload photos and videos, which may include any
metadata such as location that the user transmitted whens/he uploaded the photo or video. It also
provides users the ability to "tag" (i.e., label) other Facebook users in a photo or video. When a
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the
photo or video. For Facebook's purposes, the photos and videos associated with a user's account
will include all photos and videos uploaded by that user that have not been deleted, as well as all
photos and videos uploaded by any user that have that user tagged in them.
119. Facebook users can exchange private messages on Facebook with other users.
These messages, which are similar to e-mail messages, are sent to the recipient's "Inbox" on
Facebook, which also stores copies of messages sent by the recipient, as well as other information.
Facebook users can also post comments on the Facebook profiles of other users or on their own
'
profiles; such comments are typically associated with a specific posting or item on the profile. In
addition, Facebook has a Chat feature that allows users to send and receive instant messages
through Facebook. These chat communications are stored in the chat history for the account.
-32-
Facebook also has a Video Calling feature, and although Facebook does not record the calls
themselves, it does keep records of the date of each call.
120. If a Facebook user does not want to interact with another user on Facebook, the
first user can "block" the second user from seeing his or her account.
121. Facebook has a "like" feature that allows users to give positive feedback or connect
to particular pages. Facebook users can "like" Facebook posts or updates, as well as webpages or
content on third-party (i.e., non-Facebook) websites. Facebook users can also become "fans" of
particular Facebook pages.
122. Facebook has a search function that enables its users to search Facebook for
keywords, usemames, or pages, among other things.
123. Each Facebook account has an activity log, which is a list of the user's posts and
other Facebook activities from the inception of the account to the present. The activity log includes
stories and photos that the user has been tagged in, as well as connections made through the
account, such as "liking" a Facebook page or adding someone as a friend. The activity log is
visible to the user but cannot be viewed by people who visit the user's Facebook page.
124. Facebook Notes is a blogging feature available to Facebook users, and it enables
users to write and post notes or personal web logs ("biogs"), or to import their biogs from other
services, such as Xanga, LiveJournal, and Blogger.
125. The Facebook Gifts feature allows users to send virtual "gifts" to their friends that
appear as icons on the recipient's profile page. Gifts cost money to purchase, and a personalized
message can be attached to each gift. Facebook users can also send each other "pokes," which are
free and simply result in a notification to the recipient that he or she has been "poked" by the
sender.
-33-
126. Facebook also has a Marketplace feature, which allows users to post free classified
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace.
127. In addition to the appJications described above, Facebook also provides its users
with access to thousands of other applications ("apps") on the Facebook platform. When a
Facebook user accesses or uses one of these applications, an update about that the user's access or
use of that application may appear on the user's profile page.
128. Some Facebook pages are affiliated with groups of users, rather than one individual
user. Membership in the group is monitored and regulated by the administrator or head of the
group, who can invite new members and reject or accept requests by users to enter. Facebook can
identify all users who are currently registered to a particular group and can identify the
administrator and/or creator of the group. Facebook uses the term "Group Contact Info" to
describe the contact information for the group's creator and/or administrator, as well as a PDF of
the current status of the group profile page.
129. Facebook uses the term "Neoprint" to describe an expanded view of a given user
profile. The "Neoprint" for a given user can include the following information from the user's
profile: profile contact information; News Feed information; status updates; links to videos,
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends'
Facebook user identification numbers; groups and networks of which the user is a member,
including the groups' Facebook group identification numbers; future and past event postings;
rejected "Friend" requests; comments; gifts; pokes; tags; and information about the user's access
and use of Facebook applications.
130. Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP address.
These logs may contain information about the actions taken by the user ID or IP address on
-34-
Facebook, including information about the type of action, the date and time of the action, and the
user ID and IP address associated with the action. For example, if a user views a Facebook profile,
that user's IP log would reflect the fact that the user viewed the profile, and would show when and
from what IP address the user did so.
131. Social networking providers like Facebook typically retain additional information
about their users' accounts, such as information about the length of service (including start date),
the types of service utilized, and the means and source of any payments associated with the service
(including any credit card or bank account number). In some cases, Facebook users may
communicate directly with Facebook about issues relating to their accounts, such as technical
problems, billing inquiries, or complaints from other users. Social networking providers like
Facebook typically retain records about such communications, including records of contacts
the provider or user as a result of the communications.
132. As explained herein, information .stored in connection with a Facebook account
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a
Facebook user's "Neoprint," IP log, stored electronic communications, and other data retained by
Facebook, can indicate who has used or controlled the Facebook account. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a search warrant
at a residence. For example, profile contact information, private messaging logs, status updates,
and tagged photos (and the data associated with the foregoing, such as date and time) may be
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook
-35-
account activity can show how and when the account was accessed or used. For example, as
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their
accounts along with the time and date. By determining the physical location associated with the
logged IP addresses, investigators can understandthe chronological and geographic context of the
account access and use relating to the crime under investigation. Such information allows
investigators to understand the geographic and chronological context ofFacebook access, use, and
events relating to the crime under investigation. Additionally, Facebook builds geo-location into
some of its services. Geo-location allows, for example, users to "tag" their location in posts and
Facebook "friends" to locate each other. This geographic and timeline information may tend to
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may
provide relevant insight into the Facebook account owner's state of mind as it relates to the offense
under investigation. For example, information on the Facebook account may indicate the owner's
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from
law enforcement).
133. Therefore, the computers of Facebook are likely to contain all the material
described above, including stored electronic communications and information concerning
subscribers and their use ofFacebook, such as account access information, transaction information,
and other account information.
-36-
CONCLUSION
REQUEST FOR SEALING
13 7. I further request that the Court order that all papers in support of this application,
/;'-1,~ A~/~,b~
Curtis Heide
Special Agent
Subscribed and sworn to before me on this J!f day of August, 2018.
-37-
ATTACHMENT A
This warrant applies to information associated with the Facebook accounts registered to
the following email addresses, stored at premises owned, maintained, controlled, or operated by
Facebook, Inc. ("Facebook"), a company headquartered in Menlo Park, California:
-1-
ATTACHMENT B
custody, or control of Facebook, Inc. ("Facebook"), including any messages, records, files, logs,
or information that have been deleted but are still available to Facebook, or have been preserved
following information to the government for each account listed in Attachment A:
( c) All photos and videos uploaded by that user ID and all photos and videos uploaded
tags; and information about the user's access and use ofFacebook applications;
-2-
"Friend" requests;
G) All information about the Facebook pages that the account is or was a "fan" of;
(1) All records of Facebook searches performed by the account;
number);
-3-
conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contributions ban) for the
-4-
principals;
foreign principals;
.h. Evidence indicating the account user's state of mind as it relates to the crimes under
investigation;
i. The identity of the person( s) who created or used the account, including records
that help reveal the whereabouts of such person( s);
-5-
AO 93 (Rev. 1 l/13) Search and Seizure Warrant

for the

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date: 8/28/2018

See Attachment A
See Attachment B
'iii in the daytime 6:00 a.m. to I 0:00 p.m. 0 at any time in the day or night because good cause has been established.
property was taken.
0 for days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued: -~=m-/-Jo,icf,)J.t,_/(._f>'-_-~,,,_._:)":1._,/'-'-""'--------
City and state: _W_as_h_in_.g,_t_on_.,c_D_C_ _ _ _ _ _ __ U.S. District Judge

Return
Certification
designated judge.
Date:

ATTACHMENT A
-1-
ATTACHMENT B
and files;
-2-
e. All records pertaining to connnunications between the Provider and any person
actions taken;
-3-
-4-
c. Communications, records, documents, and ot4er files related to any expenditure,
principals;
foreign principals;
-5-
investigation;
principals.
in subsection II.a.
-6-
AO 106 (Rev. 04/10} Application 'for a Search Warrant

for the AUG 2 8 2018
District of Columbia Clerk, U.S. Districi & Bankruptuy
Courts for the District of Columllia
(Briefly describe the property to be searched )~ Case: 1:18-sc-02728
ONE ACCOUNT STORED AT PREMISES CONTROLLED )~ Assign. Date: 8/28/2018
BY GOOGLE Description: Search and Seizure Warrant

property to be searched and give its location);
See Attachment A
located in the Northern District of _ _ _ __-C,:.:a:.:.lic.:fo::-r..n.,,ia,...__ _ _ , there is now concealed (identify the
See Attachment B
Mevidence of a crime;
Mcontraband, fruits of crime, or other items illegally possessed;


0 Delayed notice of _ _ days (give exact ending date if more than 30 days: ) is requested
~ s, /I, ,,?ktA,,..___
!Kyle R. Freeny (ASC) Curtis Heide, Special Agent, FBI

Date:
City and state: Washington, D.C.

FILED
AUG 2 8 2018
IN THE UNITED STATES DISTRICT COURT Cieri(, U.S. District & Bankruptcy

INFORMATION ASSOCIATED WITH Assigned To : Chief Judge Beryl A. Howell
ONE ACCOUNT STORED AT PREMISES Assign. Date: 8/28/2018
CONTROLLED BY GOOGLE Description: Search and Seizure Warrant
I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows:
information associated with the Google account ("Target Account"),
stored at premises owned, maintained, controlled or operated by Google, LLC ("Google"), a
company headquartered in Mountain View, California. The information to be disclosed by Google
and searched by the government is described in the following paragraphs and in Attachments A
andB.
-1-
JURISDICTION
PROBABLE CAUSE
i. Roger STONE
-2-
ii. Jerome CORSI
.-3-

Election
-4-
15. For example, inor around September 2016, these individuals successfully gained
those accounts.
-5-
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-00125).
theDNC.
-6-
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoneJr thauks that
27. On August 21, 2016, using @RogerJStoneJR; STONE tweeted: "Trust me, it will
-7-
[AS SANGE], the public [could] expect to see much more from the exiled whistleblower in the
29. On Saturday, October!, 2016, using@RogerJStoneJr, STONE tweeted,
"Wednesday@ HillaryC!inton is done. #WikiLeaks."
of the Ecuadoran Embassy in London. Onthe day o£the AS SANGE announcement - which was
part ofWikiLeaks' IO-year anniversary celebration- STONE told Infowars that his intermediary
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #imWithHer" and containing a link
-8-
Day, November 8, 2016. On October 12, 2016, Podesta-referring back to STONE's August 21,
2016 C-SPAN and Twitter references-argued publicly that "[it is] a reasonable assumption to -
charges I knew about the hacking of Podesta's email (speculation and conjecture),and the timing
limited things I did predict (Oct disclosures) all came true,''
-9-
the founder ofWikiLeaks. For example, on June 4, 2017,@RogerJStoneJr directly messaged
@JulianAssange, an address associated with AS SANGE in numerous public reports, stating:
1
-10-

Forthcoming Leaks
17, 2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
warrant for email account. On or about March 14, 2018, Chief Judge Howell
-11-
.43. On or about May 18, 2016, CORSI emailed STONE at
CORSI wrote,
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist -turn him for
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential
-12-
same time, STONE told him he had gone to London to meet AS SANGE. also stated
go in LA?'' STONE responded. "It's this afternoon[.]" The following day, the associate asked,
-13-
S[b]erbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
-14-
important."
not make any new releases. Instead, AS SAN GE promised more documents, including
information previously referred to about the U.S. election process." AS SAN GE also stated that
56. On or about October. 4, 2016, CORSI messaged STONE at his iCloud account:
democrat."
-15-
Are Released.
then-the-race-was-on/2016/10/07/31d74714-8ce5-11 e6-875e-2c 1bfe943b66_ story.html
-16-
G. STONE Asks CORSl for "SOMETHING" to Post About Podesta After STONE Is
67. On or about October 8, 2016, STONE messaged CORSI, "Lunchpostponed-
numbers."
-17-
had the c)lannel open from Metcombank to Deutsche Bank America to Ban[k] of America's
-18-
Foundation?"
74. On or about October 17,2016, CORSI messaged STONE at his iCloud account,
.. "On Assange, can you call me now- before 2pm[.)" STONE responded, "Missed u- just
intel to share."
-19-
-20-
80. On or about November 10, 2016, CORSI messaged STONE at his iC!oud
-21-
-22-

with Wikileaks
are facts ....
true.
-23-

MR. STONE: No.
MR. STONE: That -
occas10ns.
J, STONE's Messaging to Randy CREDICO about STONE's "Back channel"
-24-
wrote, "My lawyer wants me to cut a deal." STONE wrote back, "To do what ? Nothing
now you can relax."
times.
"intermediary." In a public Facebook post1 STONE further stated that "Credico merely[]
-25-
pending publication,' ... Credico never said he knew or had any inf01mation as to source or
a fool." CREDICO responded, "You open yourself up to six counts of perjury[.] But I'm sure
never had a back Charmel and if you had just told the truth wouldn't have put me in this bad spot
-26-
initial contact."
off because you're friends with Trump so don't w01Ty. I have all the forensic evidence[.] I was
-27-
. . When you start bringing up my dog, you're crossing the line[.)" 5
K. Statements Regarding STONE's Use of Social Media
105. On or about Friday, May 18, 2018, was voluntarily interviewed
right-hand man.
106. According to STONE utilized the services of several individuals to
accounts.
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
6 https://www.motherjones.com/po litics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-
108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell,
the FBI searched several Facebook accounts associated with STONE, which (among other
things) were used to purchase Facebook advertisements. Search warrant returns for one of those
accounts show that STONE or one of his associates created an ad
campaign on or about August 26, 2016, that included the text, "The Democrats are right to fear
Assange's next email drops will be devastating to Hillary." The same account was also used to
create and run a Facebook ad campaign on or about March 28, 2017, that included the following
text: "ROGER STONE - NO consensus that Guccifer 2.0 is a 'Russian Asset' just because US
Intel says he is."
109. According to subscriber records, Target Account was
created on August 17, 2015, in the name of"Falo Memo Tio." 7 STONE's account
is listed as the recovery email for the Target Account. In my training and
experience, when setting up a new email account, users typically provide an email account under
their control as the recovery account in order to ensure continued access to the new account, for
example, in the event a password is lost or compromised.
7
Subscriber records list the "Language Code" for the Target Account as "pt_BR." I believe
this indicates that the subscriber selected Brazilian Portuguese as the primary language for the
account. Based on machine translation, the customer name "Falo Memo Tio" translates from
Portuguese to "I speak Memo Uncle."
-29-
110. The government obtained non-content information associated with the Target
Account pursuant to an order issued by Chief Judge Howell under 18 U.S.C. § 2703( d).
Although subscriber records indicate that the last login to the Target Account took place on
August 18, 2015, header information shows that the account continued to receive emails until at
least July 27, 2018, including from companies that offer advertisement placements.
111. Header information shows that the Target Account received multiple emails
from Facebook between approximately November 3, 2016 and November 7, 2016, shortly before
the U.S. presidential election. On or about October 5, 2016, the Target Account also received
an email from [email protected], an account that I believe is associated with Google
AdSense. According to open source information, Google AdSense is a program that matches ads
to websites based on their content and visitors, and it allows individuals to place targeted
advertising on its network of content sites.
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
to contain stored electronic communications (including retrieved and unretrieved email) for
application information. In my training and experience, such information may constitute evidence
-30-
user or users.
account and the IP addresses associated with particular logins to the account. Because every device
11 S. In my training and experience, in some cases, email account users will
-31-
evidence of the· crimes under investigation because the information can be used to identify the
the United States.
-32-
physical location associated with the Jogged IP addresses, investigators can understand the
conducted pursuant to established procedures designed to collect evidence in a manner consistent·
CONCLUSION
-33-
REQUEST FOR SEALING
~,~A /LA~
· ide
Special Agent
Subscribed and sworn to before me on this~ day of August, 2018.
-34-
ATTACHMENT A
-1-
ATTACHMENT B
pursuant to a request made under 18 U.S.C. § 2703(!), Google is required to disclose the following
include full name, physical address, . telephone numbers and other identifiers,
and files;
-2-
actions taken;
-3-
International Mobile Equipment Identities ("!MEI")); and
-4-
principals;
foreign principals;
-5-
investigation;
1. The identity of any non-U.S. person(s}-including records that help reveal the
m. The identity of any person(s}-including records that help reveal the whereabouts
principals.
in subsection II.a.
-6-
AO 93 (Rev. l l/13) Search and Seizure Warrant

for the

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date: 8/28/2018
CONTROLLED BY 1&1 MAIL & MEDIA, INC. )

of the following person or property located in the Eastern District of Pennsylvania
See Attachment A
See Attachment B
f1 in the daytime 6:00 a.m. to 10:00 p.m.
property was taken.
City and state: Washington, DC E. Boasberg, U.S. District Judge

Return
Certification
designated judge.
Date:

ATTACHMENT A
This warrant applies to information associated with the following I & I Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by I & I Mail & Media,
Inc. ("I &I Mail"), a company headquartered in Chesterbrook, Pennsylvania:
-1-
ATTACHMENT B
custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), 1&1 Mail is required to disclose
the following information to the government for each account listed in Attachment A:
and files;
-2-
actions taken;
i. All device information associated with the account, including all instrument or
j. For any accounts linked to the accounts listed in Attaclunent A, including accounts
which the accounts described in Attaclunent A are the recovery email address,
provided dming registration, methods of connecting, log files, and means and
somce of payment (including any credit or bank account number).
-3-
principals;
-4-
foreign principals;
investigation;
-5-
principals.
in subsection II.a.
-6-
UNITED STATES DISTRICT COURT FILED

for the AUG 2 B 2018
District of Columbia Clerk, U.S. District & Bankruptcy
Courts tor th~ Oistrict of G0!uml1ta
~
)
Case: 1:18-sc-02729
ONE ACCOUNT STORED AT PREMISES CONTROLLED ~ Description: Search and Seizure Warrant
BY 1&1 MAIL & MEDIA, INC. )

See Attachment A
- - - - - District of
located in the - - -Eastern _,P,_e__,n...n..s,_,y_..lv"a.._n...ia~--- , there is now concealed (identify the
See Attachment B
r.f evidence of a crime;
r.f contraband, fruits of crime, or other items illegally possessed;
fl property designed for use, intended for use, or used in committing a crime;


~'llzA . . ? ~ ~
IKyle R. Freeny (AS() Curtis Heide, Special Agent, FBI

Date:
City and state: Washington, D.C. U.S. District Judge

FILED
IN THE UNITED STATES DISTRICT COURT AUG 2 8 2018
Courts for tfle District of Columbia

INFORMATION ASSOCIATED WITH case: 1:18-sc-02729
ONE ACCOUNT STORED AT PREMISES Assigned To : Chief Judge Beryl A. Howell
CONTROLLED BY l&l MAIL & MEDIA, Assign. Date: 8/28/2018 .
INC. Description: Search and Seizure Warrant
information associated with the 1& 1 Mail account ("Target Account"),
stored at premises owned, maintained, controlled or operated by l&l Mail & Media, Inc. ("l&l
Mail"), a company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed
by l&l Mail and searched by the government is described in the following paragraphs and in
Attachments A and B.
-1-
JURISDICTION
PROBABLE CAUSE
i. Roger STONE
-2-
ii. Jerome CORSI
-3-

Election
Goverrunent developed a clear preference for President-elect Trump.
that the Russian goverrunent employed during its interference. The USIC summarized the efforts
activity-with overt efforts by Russian Goverrunent agencies, state-funded media, third-party
-4-
the DNC's cloud-based systems using the cloud provider's own\technology. The individuals
those accounts.
-5-
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).
Russian govermnent actors and the media reported on the announcement. On June 15, 2016, the
theDNC.
-6-
regard to the October surprise, what would be your forecast on that given what Julian Assange .
later, STONE clarified that while he was not personally in touch with AS SANGE, he had a close
-7-
tweeted regarding an announcement AS SAN GE had scheduled for the next day from the balcony
part ofWikiLeaks' 10-year anniversary celebration- STONE told Infowars that his intermediary
-8-
charges I knew about the hacking of Podesta' s email ( speculation and conjecture) and the timing
or scope of their subsequent disclosures. So l am clairvoyant or just a good guesser because the
-9-
39. In addition, @RogerJStoneJr also exchanged direct messages with AS SANGE,
@JulianAssange, an address associated with AS SAN GE in numerous public reports, stating:
-10-
issue an order restraining the paper from publishing additional articles. If the US govermnent
level of Govermnent. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in

Forthcoming Leaks
-11-
CORSI wrote,
Assange[.] should find Bernie [S]anders brother who called Bill a Rapist-tum him for
Trump[.] hould find or more proof of Bill getting kicked out."
-12-
STONE sent a text to STONE at approximately 3 :3 8PM on August 2, asking "How did ur meeting
-13-
51. On or.about August 31, 2016, CORSI messaged STONE, "Podesta paid $180k to
-14-
important."
democrat."
-15-
Are Released.
then-the-race-was-on/2016/10/07/31d74 714-8ce5-l l e6-875e-2c 1bfe943b66_story .html
-16-
II
I
l
numbers."
-17-
-18-
Foundation?"
"On Assange, can you call me now - before 2pm[.J" STONE responded, "Missed u-just ·
intel to share."
-19-
-20-
-21-
-22-

with Wikileaks
are facts ....
true.
-23-

MR. STONE: No.
MR. STONE: That -
occasions.
2017, STONE published an article on his website, stonecoldtrnth.com, titled "Is it the Podesta's
below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
-24-
2017, CREDICO wrote to STONE, "Forensic evidence proves that there is no back Charmel. So
now you can relax."
times.
"intermediary." In a public Facebook post, STONE further stated that "Credico merely []
-25-
now[.]'' STONE responded, "What the fuck is your problem? Neither ofus has done anything
'
-26-
initial contact."
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]"
-27-
K. Stone's Use of the Target Account
105. According to subscriber records, Target Account was
created on November 4, 2015 in the name of Roger Stone, and the last login to the account was
May29,2018. 7
106. Based on communications identified through a court-authorized search of
STONE's .Gmail account , I have learned that STONE used Target
Account to send and receive communications about WikiLeaks and
Assange:
107. For example, on or about March 21, 2018, STONE used the Target Account to
send an email with the subject, "Randy [Credico] and Me: The Truth about WikiLeaks." The
threatened-dog0135911370.html
6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
7 The customer date of birth listed in the subscriber records is not STONE's birthdate. In my
training and experience, providers such as l&l. Mail do not verify customer dates of birth.
-28-
email appears to be a media blast sent to a distribution list that included STONE's Gmail account
In the email, STONE claimed, in substance and in part, that in 2016 he
had asked Credico to confirm that Assange had credible information on Clinton, and that Credico
"never said from whom he gained [the] confirmation, or the source, or the content of whatever
was coming."
108. At least one reporter also emailed STONE at the Target Account about
WikiLeaks and Assange. In particular, on or about May 11, 2018, a reporter with the
Washington Post emailed STONE at both nd Target Account
[email protected] about "a story on the Mueller investigation." The reporter described "a
scene when says he was asked about an email he received
from [STONE] that made reference to an upcoming meeting with Julian Assange." After noting
, STONE's position that no meeting with Assange ever occurred, the reporter also asked STONE,
in substance and in part, if he had anything further to add to the story.
I 09. On or about the same day, STONE responded from his Google account
stating that the email concerning a meeting with Assange was "a joke
made while trying to get off the phone." STONE also wrote, "Now would be a good time
for the Washington Post to report that the accusation there was an email that proved that I knew
about the contents of the WikiLeaks disclosures in advance has never been seen by the
Washington Post and was then ascribed to a 'phone call."'
BACKGROUND CONCERNING l&l MAIL
110. In my training and experience, I have learned that !&I Mail provides a variety of
on-line services, including electronic mail ("email") access, to the public. l&l Mail allows
subscribers to obtain email accounts at several domain names, including mail.com, like the Target
-29-
Account. Subscribers obtain an account by registering with l&l Mail. During the registration
process, l&l Mail asks subscribers to provide basic personal information. Therefore, the
computers of 1&1 Mail are likely to contain stored electronic communications (including retrieved
and unretrieved email for 1&1 Mail subscribers and information concerning subscribers and their
use of l&l Mail services, such as account access information, email transaction information, and
account application information. In my training and experience, such information may constitute.
-30-
the email account.
113. In my training and experience, m some cases, email account users will
under the control of 1& I Mail, a provider subject to the jurisdiction of this court, regardless of
where 1& 1 Mail has chosen to store such information. The government intends to require the
and any records or other information pertaining to the customers or subscribers if such
communication, record, or other information is within l&l Mail's possession, custody, or control,
maintained outside the United States.
provide crucial evidence of the "who, what, why, when, where, and how" ofthe criminal conduct
-31-
lists, and images sent. (and the data associated with the foregoing, such as date and time) may
-32-
CONCLUSION
REQUEST FOR SEALING
'
/~ /-1 . .d-1; ~
~ d e '1'
Special Agent
Subscribed and sworn to before me on this~ day of August, 2018.
-33-
ATTACHMENT A
This warrant applies to information associated with the following l&l Mail accounts,
which are stored at premises owned, maintained, controlled, or operated by l&l Mail & Media,
Inc. ("l&l Mail"), a company headquartered in Chesterbrook, Pennsylvania:
-1-
ATTACHMENT B
custody, or control of l&l Mail & Media, Inc. ("1&1 Mail"), including any messages, records,
files, logs, or information that have been deleted but are still available to 1& 1 Mail, or have been
preserved pursuant to a request made under 18 U.S.C. § 2703(f), l&l Mail is required to disclose
the following information to the government for each account listed in Attachment A:
and files;
-2-
actions taken;
i. All device information associated with the account, including all instrument or
J. For any accounts linked to the accounts listed in Attachment A, including accounts
-3-
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18U.S.C. § 1349 (attempt and
period from June I, 2015 to the present, including:
. b. All records, information, documents or tangible materials that relate in any way to
Assange Randy Credico, or any
c. Communications, records, documents, and other files related to any expenditure;
principals;
-4-
foreign principals;
investigation;
-5-
principals.
in subsection II.a.
-6-

for the

Case: 1: 18-sc-02905
or identify the person by name and address) Assigned To: Howell, Beryl A.
INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES Description: Search & Seizure Warrant
CONTROLLED BY TWITTER )

See Attachment A
See Attachment B
YOU ARE COMMANDED to execute this warrant on or before October 9, 2018 (not to exceed 14 days)
property was taken.
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell., Ch ief U.S. District Judge
0 Pursuant to 18 U.S.C. § 3 !03a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
Date and time issued: -tkl2P1J?g:/- f..:. (}o/;); Judge 's signature
City and state: Wash ington, DC Hon. Beryl A. Howell, Chief U.S. District Judge
- - - - - - -- - - - --- Printed name and title
Return
Certification
designated judge.
Date:

ATTACHMENT A
-1-
ATTACHMENT B
H. All information about the account's use of Twitter' s link service, including all longer
-2-
by the account;
R. All past and current usernames, account passwords, and names associated with the account,
created;
("IMSI"), or International Mobile Equipment Identities ("IMEi"), and any other
plugins or widgets;
-3-
clicked;
applications, including any Twitter, Face book or other social networking accounts to which
ID, Known Device Token, Normalized Email Address, Android ID, IMEi, GUID, device
the subscriber.
period from March 1, 2016 to the present, including:
-4-
Assange, , Randy Credico, any
individual associated with the Trump Campaign, or any witness in the
investigation;
principals;
f.. Communications, records, documents, and other files that reveal efforts by any
foreign principals;
-5-
investigation;
that help reveal the whereabouts of such person(s );
principals.
in subsection II.a.
-6-
III. Review Protocols
-7-

for the
F
District of Columbia SEP 2. 6 2018
fWk U.S. District & Bankrupt(;Y
r.~~~ts for tila 0\!Hict Di f,{llumbla
Case: 1: 18-sc-02905 1
(JJricjly describe ihe p roperty to be searched )
or ide mijj, 1/w person by name and address) Ass!gned To: Howell, Beryl A.
)
INFORMATION ASSOCIATED WITH )
ONE ACCOUNT STORED AT PREMISES CONTROLLED
)
BY TWITTER ) Description: Search & Seizure Warrant

I, a foderal Jaw enfo rcement officer or an attorney for the government, request a search wa1rnnt and state under
penalty of pe1jury that I have reason to beli.eve that on the following person or property (identify the person or describe the
See Attachment A
located in the - --
Northern
- - - --
District of California
_ __ ____c:....;......;.;__.- - - - " - - --
See Attachment B
~ p~operty designed for use, intended for use, or used in committing a crime;

b/ Continued on the attached sheet.

IKyle R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI

Printed name a.nd title
Judge's signature
SEP 2 6 2016
Clsrk, U.S. Dlst(fct & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for the Dfstrlct of Columbia

INFORMATION AS SOCIA TED WITH Assigned To : Howell, Beryl A.
ONE ACCOUNT STORED AT PREMISES Assign. Date : 9/26/2018
CONTROLLED BY TWITTER, INC.
information associated with the Twitter account , which is
stored at premises owned, maintained, controlled or operated by Twitter, Inc. ("Twitter"), a
company headquartered in San Francisco, California.
Upon receipt of the information described in Attachment A, government-authorized persons will
review that information to locate the items described in Attachment B.
-1-
there is probable cause to believe that the Target Account contains evidence, fruits, or
JURISDICTION
PROBABLE CAUSE
i. Roger STONE
-2-
Donald J. Trump (the "Campaign") until August 2015 . Although Stone had no official
ii. Jerome CORSI
.,3_

Election
-4-
those accounts.
-5-
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
the DNC.
-6-
27. On August 21, 2016, using@RogerJStoneJr, STONE tweeted: "Trust me, it will
-7-
28. On September 16., 2016, STONE said in a radio interview with Boston Herald
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the AS SAN GE announcement - which was
-8-
-9-
1
-10-

Forthcoming Leaks
-11-
appears to have forwarded the message to STONE a who replied to
with the title, "Roger -- why don't you look this over before I send it to I believe that
CORSI wrote,
-12-
had not actually met AS SAN GE. 2
-13-
Did you get the PODESTA writeup." STONE replied "[y]es."
S[b]erbank, Russia's largest financial institution- Podesta$$$ ties to Russia undermine Clinton
Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
-14-
important."
democrat."
-15-
Are Released.
59. According to a publicly available news article, 3 at approximately 11 AM on
3
then-the-race-was-on/2016/10/07 /31d74 714-8ce5-11e6-875 e-2cl bfe94 3b66_story.html
-16-
On or about August 2, 2016, CORSI emailed STONE usin "I expect
66. At approximately 6:27PM an author who has written about the
numbers."
-17-
emailed STONE at both and with the subject
CLINTON FOUNDATION." STONE responded, ''Nice but I was hoping for a piece I could
-18-
then asked, "Just how much money did , a controversial Russian billionaire
Foundation?"
"On Assange, can you call me now- before 2pm[.]" STONE responded, "Missed u- just
intel to share."
-19-
which he claimed he had, "no'advance notice ofWikileaks' hacking of Podesta's e-mails."
-20-


with Wikileaks
such asse1iions are conjecture, supposition, projection, and allegations but none of them
are facts ....
information proved to be con-ect. I have referred publicly to this journalist as an,
true.
-23-

encouragement heen in any type of contact with Julian Assange?
MR. STONE: No.
MR. STONE: That -
occasions.
Time in the Ban-el Yet?" In that aiiicle, STONE stated: "[l]t was this inevitable scrutiny of the
-24-
now you can relax."
received from HP SCI that was dated November 27, 2017. Toll records show that on November
times.
-25-
no back-channel and you could have just told the truth ... You want me to cover you for pe1jury
now[.]" STONE responded, "What the fuck is your problem? Neither of tis has done anything
you testify you' re a fool. Because of tromp [sic] I could never get away with a certain [sic] my
perjury if you' re stupid enough to testify[.]"
4
Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI.
-26-
yourself a real lawyer instead of some liberal wimp who doesn't kriow how to tell his guys to
initial contact."
I 02. CREDI CO and STONE continued to message each other, and on or about January
103. On or about April 13, 2018, news repo1is stated that CREDICO had shown
-27-
from you," referring to CREDICO's therapy dog. CREDJCO stated that it was "ce11ainly scary .
K. The Target Account
5
https ://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-ro ger-stone-
threatened-dog-135911370 .html
6
https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/
-28-
BACKGROUND CONCERNING TWITTER
-29-
information. Twitter also pennits users create and read 140-character messages called "Tweets,"
and to restrict their "Tweets" to individuals whom they approve. These features are described in
more detail below.
usemame, password, and name without having to open a new Twitter account.
account page. In addition, Twitter users can post "bias" of 160 characters or fewer to their profile
pages.
-30-
account also 'is provided a user gallery that includes images that the user has shared on Twitter,
-31-
people follow.
120. In addition to posting Tweets, a Twitter user can also send Direct Messages
(DMs) to one of his or her followers. These messages are typically visible only to the sender and
the recipient, and both the sender and the recipient have the power to delete the message from the
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a
particular user, but older DMs are stored on Twitter's database.
25 past searches.
profiles.
-32-
from using Twitter's services.
search warrant at a r~sidence. For example, profile contact information, communications,
-33-
their use of Twitter, such as account access information, transaction information, and other account
information.
CONCLUSION
-34-
REQUEST FOR SEALING
131. I fmther request that the Court order that all papers in support of this application,
c~
Special Agent
Subscribed and sworn to before me on this ~,1Zy of September, 2018.
~d/~
-35-
ATTACHMENT A
This warrant applies to information associated with the following Twitter accoun~s, which
- 1-
ATTACHMENT B
To the extent that the info1mation described in Attachment A is within the possession,
-2-
by the account;
R. All past and current usemames, account passwords, and names associated with the account,
created;
("IMSI"), or International Mobile Equipment Identities ("IMEI"), and any other
plugins or widgets;
-3-
clicked;
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device
the subscriber.
-4-
Assange, Randy Credico, any
individual associated with the Trump Campaign, or any witness in the
investigation;
principals;
foreign principals;
-5-
investigation;
principals.
in subsection II.a.
-6-
pursuant to established procedures designed to collect ~vidence in a manner consistent with
-7-


CONTROLLED BY TWITTER
disclosure, the proposed Order would direct TWITTER, LLC ("TWITTER"), an electronic
communication and/or remote computing services provider headquartered in San Francisco,
California, not to notify any other person (except attorneys for TWITTER for the purpose of

18 U.S.C. § 2711 (3)(A)(i). Acts or omissions in furtherance of the offense under investigation
occurred within Washington, D.C. See 18 U.S.C. § 3237.
U.S.C. § 2705(b). TWITTER provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§,2701-2712, governs how TWITTER may be
"non-content" information using a court order, and Section 2703(a)-(b)(1 )(A) allows the
notification. In relevant paii, Section 2705(b) provides as follows: 1

1
Section 270.S(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
§ 2703(b)(l)(B), but the Government does not seek to use the proposed Order for any legal process
2

that a nondisclosure order under Section 2705(h) must he issued once the Government makes the
subpoena may lead to one of the deleterious outcomes listed under § 2705(b ), the
In re Application for Order of Nondisclosure Pursuant to 18 US.C. § 2705(b) for Grand Jury
command TWITTER not to notify any other person (except attorneys for TWITTER for the
purpose ofreceiving legal advice) of the existence of the Subpoena for a period of one year or until
6. The Federal Bureau oflnvestigation ("FBI") is investigating violations of 18 U.S.C.
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. § 611 et seq.
3
· Offenses"), arising out of the conduct of Roger Stone and others. It does not appear that Stone is
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this
warrant to Stone could lead him to destroy evidence or notify others who may delete information
relevant to the investigation.
of the Court and that TWITTER and its employees be directed not to notify any other person of
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of
receiving legal advice) for a period of one year or until further order of the Court. Such an order
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and
nature of which is neither public nor known to the targets of the investigation, and its disclosure
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of
the Warrant and related papers may also alert the targets to the scope of information known to the
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and
otherwise take steps to undermine the investigation and avoid future prosecution. In particular,
given that they are known to use electronic communication and remote computing services, the
potential target could quickly and easily destroy or encrypt digital evidence relating to their
criminal activity.
4
§ 2705(b )(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
10. Based on prior dealings with TWITTER, the United States is aware that, absent a
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored
wire or electronic communications for a certain account, notify the subscriber or customer of the
TWITTER not to notify any other person of the existence or contents of the above-captioned
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of
one year or until further order of the Court.

Special Counsel
Dated: :) /2 (o /l'3 By:

Kyl
The cial Counsel's Office
(202) 616-3812
5
1L'
SEP 2 6 2018
FOR THE DISTRICT OF COLUMBIA Courts for the District of Golumb/a

INFORMATION AS SOCIA TED WITH ONE Assigned To : Howell, Beryl A.
ACCOUNT STORED AT PREMISES Assign. Date : 9/26/2018
CONTROLLED BY TWITTER
ORDER
and to require TWITTER, INC. ("TWITTER"), an electronic communication and/or remote
computing services provider headquartered in San Francisco, California, not to disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its
attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until
TIIEHON&t~LL
2
ATTACHMENT A
This wmrnnt applies to information associated with the Twitter accounts registered to the
following email addresses, which are stored at premises owned, maintained, controlled, or
operated by Twitter, Inc. ("Twitter"), a company headquartered in San Francisco, California
-1-
ATTACHMENT A
This wanant applies to infonnation associated with the Facebook accounts registered to
the following email addresses ("Target Facebook Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook, Inc. ("Facebook"), a company headquartered in
Menlo Park, California:
This wanant also applies to information associated with the Instagram accounts registered
to the following email addresses ("Target Instagram Accounts"), stored at premises owned,
maintained, controlled, or operated by Facebook:
1-

for the

or identify the person by name and address) ) Assigned To : Howell, Be /
INFORMATION ASSOCIATED WITH THREE ) Ass,g~. Date: 9/27/2018 ry A.
ACCOUNTS STORED AT PREMISES ) Descnpt,on: Search & S .
CONTROLLED BY MICROSOFT ) e1zure Warrant
An application by a federal law enforcement officer or an attorney for the govenunent requests the search
of the following person or property located in the Western District of Washington
(Mentify the person or describe the property to be searched and give its location):
See Attachment A
described above, and that such search will reveal (;dentify the person or describe the property to be seized):
See Attachment B
;/ in the daytime 6:00 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established.
property was taken.
D for days (not to e,ceed 30) D until, the facts justifying, the later specific date of
-----·
AO 93 (Rev. I 1/13) Search and Seizure Warranl (Page 2)
Retum
Case No.: Date aud time warrant executed: Copy ofwanant and inventory left with:
Certification
I declare nnder penalty of petjury that this inventory is correct and was returned along with the original wanant to the
designated judge.
Date:
Ei:ecuting officer's signature
-·---,.,,-- ...
ATTACHMENT A
This wanant applies to information associated with the following Microsoft accounts,
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation
("Microsoft"), a company headquartered in Redmond, Washington:
This wanant also applies to infmmation associated with the following Skype usernames
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
Corporation, an electronic communication and/or remote computing service provider with
headquarters in Redmond, Washington:
-1-
ATTACHMENTB
I. Information to be disclosed by Microsoft
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such infmmation is stored, held or maintained inside or outside of the United States, and including
any emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
b. The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
conversation history for the account;
c. All records or other information regarding the identification of the account, to
d. The types of service utilized;
-2-
e. All Windows Live and OneDrive data and content;
f. All Microsoft Developer information and content and any other information and
content relating to software development and testing;
g. All records or other information stored at any time by an individual using the
and files;
h. All records pertaining to communications between the Provider and any person
actions taken;
1. All Lyne content;
j. All subscriber "change history" associated with the account;
k. All search history and web history associated with the account (including Bing
history);
I. All location and maps info1mation associated with the account;

'
m. All device infonnation associated with the account, including all instrument or
n. For any accounts linked to the accounts listed in Attachment A, including accounts
-3-
provide all records or other information regm·ding the identification of the account,
to include full nmne, physical addrnss, telephone numbers and other identifiers,
which consists of evidence, fruits, or instrumentalities of violations of 18 U .S.C. § 2 (aiding and
Julian Assange, or connnunications regm·ding disinformation, denial, dissembling
or other obfuscation about lmowledge of, or access to, hacked material;
-4-
b. All records, infonnation, documents or tangible materials that relate in any way to
individual associated with the Trump Campaign, any witness in the investigation;
principals;
foreign principals;
investigation;
-5-
J. Credit card and other financial information, inclnding but not limited to, bills and
I. The identity of any 11011-U.S. person(s)-including records that help reveal the
principals.
in subsection II.a.
-6-
\;t~: '!i'
tt{ ~
lL [i'c'. r~
\:J.;;.,: ,.,oS,; <,..'.:<
IN THE UNITED STATES DISTRJCT COURT Stf1 2 7 2t118

FOR THE DISTRICT OF COLUMBIA Clerk, U.S. lll8trlct e, ll~~lm,p!GY

THREE ACCOUNTS STORED Assigned To : Howell, Beryl A.
AT PREMISES CONTROLLED BY Assign. Date: 9/27/2018
MICROSOFT CORPORATION Description: Search & Seizure Warrant
ORDER
documents, including the application and affidavit in suppo1i thereof (collectively the "Warrant"),
and to require Microsoft Corporation ("Microsoft"), an electronic communication and/or remote
computing services provider headquartered in Redmond, Washington, not to disclose the existence
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
materials, the instant motion to seal, and this Order be SEALED until further order of the Corui;
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Microsoft and its
attorneys for Microsoft for the purpose of receiving legal advice) for a period of one year or until
THEHONO~t~~
2
Case
AO !06 (Rev. 04/10) 1:19-mc-00029-CRC

for the
SEP 2 7 2018
Clark, U.S. District & Bankruptcy
!111wt,1 lor 11m l.ll0lrlc1 u1 Gi;:rni,\tfffi
or identify the person by name and address) Assigned To : Howell, Beryl A.
)
INFORMATION ASSOCIATED WITH ) Assign. Date: 9/27/2018
THREE ACCOUNTS STORED AT PREMISES ) Description: Search & Seizure Warrant
CONTROLLED BY MICROSOFT )

I, a federal law enforcement officer or an attorney for the goverument, request a search warrant and state under
penalty of perjury that I.have reason to believe that on the following person or property (identify the person or describe the
property lo be searched and give its location):
See Attachment A
located in the Western District of _ _ ___,W=a,,,sh...i..
n,,_gt"o""n'-~· , there is now concealed (identify the
See Attachment B
0 a person to be arrested or a person who is unlawfully restrained .
.The search is related to a violation of:


0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
~
~ c a n t ' s Signature
Fyle R. Free~y (ASC) Patrick J. Myers, Special Agent, FBI- - - -

Sworn to before me and signed in my presence. ·
Judge's signature
City and state: Washington, D.C. Hon. Beryl A Howell, Chief U.S. District Judge
---
SEP 2 ! 2018
Clerk, U.S. DIHtrlct & Bankruptcy
FOR THE DISTRICT OF COLUMBIA Courts for tl10 District ot Columbia

Case: 1:18-sc-02920
THREE ACCOUNTS STORED AT
PREMISES CONTROLLED BY
MICROSOFT
AN APPLICATION FOR A SEARCH ARRANT ,v
information associated with the Microsoft email account ( "Target
Accounts 1") and the Skype accounts registered to ("Target Account
2") and to ("Target Account 3"), stored at premises owned,
maintained, controlled or operated by Microsoft Corporation ("Microsoft"), a company
headquartered in Redmond, Washington.
Upon receipt of the information described in Attachment A, government-authorized persons will
. review that information to locate the items described in Attachment B.
2. I am a Special Agent with the Federal Bureau ofinvestigation ("FBI") assigned to
approximately fifteen years, including for the FBI. As a Specia!Agent, I have conducted national
-1-
4. Based on my training and experience and the facts as set fmih in this affidavit,
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
tampering), and 52 U.S.C. § 30121(a)(l)(C) (foreign expenditnre ban). There also is probable
cause to search the infonnation described in Attachment A for evidence, contraband, fruits,
JURISDICTION
(c)(l )(A). · Specifically, the Co111i is "a district court of the United States (including a magistrate
-2-
PROBABLE CAUSE
i. Roger STONE
ii. Jerome CORSI

'
information, served as the "Washington Bureau Chief for Inforwars.com." According to
publicly-available sources, from 2014 until January 2017, CORSI was a "senior staff reporter"
contact with STONE during the sunrmer and fall of 2016 regarding forthcoming disclosures of
-3-

Election
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and hmm her
Govermnent developed a clear preference for President-elect Trump.
that the Russian gove1mnent employed during its interference. The USIC summarized the effo1is
-4-
confidence that the GRU used the Guecifer 2.0 persona, DCLeaks.com, and WikiLealcs to
September, these individuals stole data from these cloud~based computers by creating backups of
those accounts.
-5-
. spearphishcd over 100 accounts used by organizations and personnel involved in administering
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: l 8-cr-00125).
C. STONE's. Public Interactions with Guccifcr 2.0 and WikiLeaks
on its WordPress blog that, with respect to the doclL.rnents stolen from the DNC, "[t]he main part
theDNC.
-6-
why he did the hack of the DNC." The article also stated: "Gliccifer 2.0 made a fateful and wise
numbers and email addrnsses from the files of the DCCC.
great man. please tell me ifI can help u anyhow. it would be a great pleasure to me."
-7-
soon the [sic] Podesta' s time in the barrel. #CrookedHillary." In a C-SPAN interview that same
fmm of strategically-dumped Clinton email batches." He added: "Well, first of all, I think Julian
"Wednesday@HillatyClinton is done. #WildLeaks."
tweeted regariling an announcement AS SANGE had scheduled for the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement -which was
part of WikiLeaks' 10-year anniversary celebration - STONE told Infowars that his inte1mediary
-8-
published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
Day, November 8, 2016. On October 12, 2016, Podesta-refening back to STONE's August 21,
everything I know is through that channel of connnunications. I'm not implying I have any
influence with him or that I have advanced knowledge ofthe specifics of what he is going to do.
communication during the Cmnpaign between STONE and WikiLeaks. The same article quoted
-9-
or scope of their subsequent disclosures. S9 I am clairvoyant or just a good guesser because the
limited things I did predict (Oct disclosures) all came tme."
to rexarnine the strategy of attacking me- cordially R."
@wildleaks immediately followed up with another message less than a minute later: "We are
39. In addition,@RogerJStoneJr also exchanged direct messages with ASSANGE,
1 Onor about August 7, 2017, Chief Judge Beryl A Howell issued a search warrant for the
-10-
indisputably stolen from 1he government and the courts ruled it was legal to do so and refused to

Forthcoming Leaks
2017, Chief Judge Howell issued a search warrant for one of STONE's addresses,
issued a search warrant for STONE's iC!oud account. Information recovered pursuant to those
-11-
Stone so he knows your availability to meet Manafmt and DT this coming week." CORSI
CORSI wrote,
Assange[.J should find Bernie [SJ anders brother who called Bill a Rapist - turn him for
Word is friend in embassy plans 2 more dumps. One shortly after I'm
-12-
campaign to get serious staiiing Sept. Still in pre-season games. Time to let more than Podesta to
hackers are now about. Would not hurt to start suggesting HRC old, memmy bad, has stroke --
debacle." Investigators believe that CORSI' s reference to a "friend in embassy [who] plans 2
in his email to to have "dined" with ASSANGE. For exainple, an associate of
-13-
STUNE's iC!oud that appears to have been taken on August 3, 2016 and had gco-location
Give me a call today if you can. Despite MSM drumroll that HRC is
invest in Uranium One - was hired by Rosatom in Giustra sca.'1dal. Podesta now under FBI
investigation - tied to Ukraine Yanukovyeh - Panama papers reveals Podesta hired by
S [bJerbank, Russia's largest financial institution - Podesta $$$ ties to Russia undermine Clinton
-14-
sked: "Assange -what's he got?Hope it's good." STONE wrote
be ont in Jan. Many scores will be settled." The associate forwarded the email to Steve
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. You didn't get from me." BANNON wrote back, "I've got important stnffto worry
important."
information previously referred to about the U.S. election process." AS SAN GE also stated that
WikiLealcs would publish documents on various subjects every week for the next ten weeks, and
-15-
democrat."
·Are Released.
59. According to a publicly available news article,3 at approximately 11AM on
3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a0lewd-tape-of-donald-trump-
then-the-race-was-on/2016/10/07/3 ld74714-8ce5-l le6-875e-2cl
.
bfe943b66- story.html
-16-
65. At approximately 4:30PM, WikiLeaks tweeted out its first release ofemails
numbers."
-17-
· Podesta is complicated. Two articles in length. I can give you in raw forni the stuff I got in
emailed STONE at both ith the subject
PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to
wrote back to STONE, "I'll give you one more - NOBODY YET HAS THIS[:] It looks to me
had the channel open from Metcombm1k to Deutsche Bank America to Ban[k] of America's
-18-
have had some back-channel conununications with Wikileaks I had no advance notice about the
Metcombank, a Russian regional bank owned 99 .978 percent by with the money
transferred via Deutsche Bank and Trust Company Americas in New Yark City, with the money
ending up in a private bank account in the 'Bank of America that is operated by the Clinton
Foundation?"
73. On or about October 14, 2016, CORSI sent a message to STONE at his iC!oud
74. On or about October 17, 2016, CORSI messaged STONE at his iC!oud account,
intel to share."
-19-
figured this. Assange is threatening Keny, Ecuador and U .K. He will drop the goods on them ii
It's what they used to call a 'Mexican stand off{.]' Only hope is that if Trump speaks out to save
raised him the election." Based on review of the original email that CORSI forwarded, the
"trusted source" was a self-identified retired librarian who gathers information from public chat
rooms.
79. On or about November 9, 2016, CORSI messaged STONE at his iC!oud account,
-20-
account, "Arc you available to talk on phone?" Several minutes later, CORSI messaged, "I'm in
-21-
-22-

with Wikiieaks
are facts ....
My Tweet of August 21, 2016, in which I said, "Trnst me, it will soon be the Podesta' s
would come under public scrntiny ....
[L]et me address the charge· that I had advance knowledge of the timing, content and
source of the WikiLealcs disclosures from the DNC. On June 12, 2016, WikiLeaks'
Assange to independently confirm this· report, and he subsequently did. This journalist
assured me that WikiLeaks would release this infotmation in October and continued to
information proved to be c01rect. I have referred publicly to this journalist as an,
true.
-23-

encouragement been in any type of contact with.Julian Assange?
MR. STONE: No.
cmmnunication with Assange or communication through an intermediary with Assange,
you were only referring to a single fact that you had confirmed with the intennediary -
MR. STONE: That - .
occasions.
Time in the Barrel Yet?" In tl1at article, STONE stated: "[I]t was this inevitable scrutiny of the
below, STONE publicly identified as his "intermediary" to AS SAN GE), messaged STONE, "My
-24-
back, "That was the point at which your lawyers should have told them you would asse1t your
happening in DC the day before Thanksgiving- why are u busting my chops?"
93. On or about November 24, 2017, STONE, texted CREDlCO, "Assange is a
he had the goods [o Jn Hillary and would publish them - which he himself said in public b4 u told
secretary in London, August 26th." STONE wrote back, "Not the way I remember it- oh well I
now you can relax."
times.
-25-
British ITV network, where Assange said he had 'e-mails related to Hillaty Clinton which are
pending publication,' ... Credico never said he ]mew or had any information as to source or
97. On or about December 1, 2017, CREDlCO messaged STONE, "l don't know why
back Channel they now know that I was not in London until September ofthis year[.] You had
wrong or illegal. You got the best press of your life and you can get away with assetiing for 5th
a fool." CREDICO responded, "You open yourself up to six counts ofpe1jury[.] But I'm sme
that wasn't sworn testimony so you're probably clear[.] Council for t_l-1e committee !mows you
never had a back Channel and if you had just told the trnth wouldn't have put me in this bad spot
... you should go back ... and amend yom testimony and tell them the truth." CREDICO
perjmy if you're stupid enough to testify[.]"
4
Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-
98. STONE and CREDICO continued to message each other on or abont December 1,
fnck off good night." CREDICO then wrote: "Just tell them the truth and swallow your ego you
99. On or about December 13, 2017, according to public repmiing, CREDICO
100. STONE and CREDI CO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter,
STONE responded, "Hope u don't fuck Up my effmis to get Assange a pardon[.]" CREDICO
· messaged STONE, "I have the email from his chief of staff August 25th 2016 responding to an
initial contact."
logs ... + 17 other pieces of info1mation prove that I did not have any conversations with
'
103. On or about April 13, 2018, news rep01is stated that CREDICO had shown
repmiers c~pies of email messages he had received from STONE in the prior few days that
-27-
K. The Target Accounts
6 https ://www.motherjones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-
-29-
BACKGROUND CONCERNING MICROSOFT
115. In my training and experience, I have learned that Microsoft provides a variety of
online services, including electronic mail ("email") access, voice communications services such
-31-
as Skype, Windows Live services, cloud storage services such as OneDrive, and software
development kit accounts, to the public. Subscribers obtain any of these types of accounts by
registering with Microsoft. During the registration process, Microsoft asks subscribers to provide
basic personal information. Therefore, the computers of Microsoft are likely to contain stored
electronic connnunications (including retrieved and unretrieved email for email subscribers and
information concerning subscribers and their use of email services, such as account access
information, email transaction information, and account application information. In my training
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
provide certain personal identifying information when registering for a services account. Such
(including any credit or bank accou._'lt number). In my training and experience, such information
subscribers inseit false information to conceal their identity, this information often provides clues
117. In my training and experience, email providers typically retain ce1tain transactional
information about the creation and use of each account on theit systems. This information can
-32-
("IP address") used to register the account and the IP addresses associated with paiiicular logins
to the account. Because every device that connects to the Internet must use. an IP address,
the email account.
118. In my training and experience, in some cases, account users will communicate
directly with a service provider about issues relating to the account, such as technical problems,
billing inquiries, or complaints from other users. Providers typically retain records about such
communications, including records of contacts between the user mid the provider's supp01i
services, as well as records of any actions taken by fue provider or user as a .result of the
communications. In my training and experience, such information may constitute evidence of the
crimes under investigation because the information can be used to identify fue account's user or
users.
under the control of Microsoft, a provider subject to tl1e jurisdiction of this court, regardless of
where Microsoft has chosen to store such information. The government intends to require the
and any records or oilier infonnation pertaining to the customers or subscribers if such
communication, record, or otherinformation is within Microsoft's possession, custody, or control,
maintained outside the United States. It is my understanding that Microsoft has access to email
accounts with the top level domain .au, which is associated with Australia.
-33-
occupancy"'while executing a search warrant at a residence. For example, email
or used. For example, as described below, email providers typically log the IP addresses from
which users access the email account, along with the time and date of that access. By
determining the physical location associated with the logged IP addresses, investigators can
understand the chronological and geographic context of the email account access and use relating
to the crime under investigation. This geographic and timeline information may tend to either
inculpate or exculpate the account owner. Additionally, information stored at the user's account
may further indicate the geographic location of the account user at a particular time (e,g.,
location infom1ation integrated into an image or video sent via email). Last, stored electronic
data may provide relevant insight into the email account owner's state of mind as it relates to the
· offense under investigation. For example, information in the email account may indicate the
owner's motive and intent to commit a crime (e.g., communications relating to the crime), or
consciousness of guilt (e.g., deleting communications in an effort to conceal them from law
enforcement).
-34-
121. Review of the items described in Attaclnnent A and Attaclnnent B will be
other operative privileges. The procedures include use, if necessary, of a designated ''filter
CONCLUSION
122. Based on the forgoing, I request that the Comt issue the proposed search warrant.
REQUEST FOR SEALING
including the affidavit and search warrant, be sealed until fmiher order of the Court. These
docmnents because their premature disclosure may seriously jeopardize that investigation.
~~
~y-e-rs____________
Special Agent
Subscribed and sworn to before me on this l~y of September, 2018.
~48
-35-
ATTACHMENT A
This warrant applies to information associated with the following Microsoft accounts,
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation
("MiLausufl''), a comprury headqurutered in Redmond, Washington:
This warrant also applies to information associated with the following Skype usernrunes
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft
Corporation, an electronic communication and/or remote computing service provider with
headquarters in Redmond, Washington:
-1-
ATTACHMENT B
I. Information to be disclosed by Microsoft
custody, or control of the Microsoft Corporation (hereinafter "the Provider"), regardless of whether
such information is stored, held or maintained inside or outside of the United States, and including
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
destination addresses associated with each email, the date arid time at which each
b. The contents of all Skype communications sent to or from the account, including
videos, instant messages, group messages, and attachments, as well as the complete
conversation history for the account;
c. All records or other information regarding the identification of the account, to
include full name, physical address, _telephone numbers and other identifiers,
t¥e length of service, the IP address used to register the account, log-in IP addresses
d. The types of service utilized;
-2-
which 1he accounts described in Attachment A are the recovery email address,
to include full name, physical address, telephone numbers and oilier identifiers,
1he length of service, the IP address used to register the account, log-in IP addresses
I
Any and all records 1hat relate in any way to the accounts described in Attachment A
which consists of evidence, fruits, or instrumentalities of violations ofl8 U.S.C. § 2 (aiding and
abetting), 18 U.S.C. § 3 (accessory after 1he fact), 18 U.S.C. § 4 (misprision of a felony), 18
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unau1horized
with persons ~r entities associated with WikiLealcs, including but not limited to
-4-
connnnnications or meetings involving Jerome Corsi, Julian
c. Connnnnications, records, documents, and other files related to any expenditure,
independent expenditure, or disbursement for an electioneering connnunication;
government, foreign officials; foreign entities, foreign persons, or foreign
principals;
e. All images, messages, connnunications, calendar entries, search terms, "address

;
f. Connnunications, records, documents, and other files that reveal eff01ts by any
any foreign govermnent, foreign officials, foreign entities, foreign persons, or
foreign principals;
g. Evidence indicating how and when the acconnt was accessed or used, to determine
(
to the crimes nnder investigation and to the account owner;
investigation;
i. The identity of the person(s) who created or used the acconnt, including records
-5-
whereabouts. of the person(s)-who made any expenditure, independent
foreign goverurnent, foreign officials, foreign entities, foreign persons, or foreign
principals.
n. Passwords and encryption keys, and other access infonnl'ltion that may be necessary
in subsection II.a.
pursuant to established procedures designed to collect evidence in a manner consistent with·
professional responsibility requirements concerning the maintenance of attorney-client and .other
-6-


THREE ACCOUNTS STORED Assign. Date: 9/27/2018
AT PREMISES CONTROLLED BY Description: Search & Seizure Warrant
MICROSOFT CORPORATION

in support thereof (collectively herein the "Wanant") under seal, and precluding the provider from
notifying any person of the WaiTant pursuant to 18 U.S.C. § 2705(b). In regard t9 the non-
disclosure, the proposed Order wonld direct Microsoft Corporation ("Microsoft"), an electronic
communication and/or remote computing services provider headquartered in Redmond,
Washington, not to notify any other person (except attorneys for Microsoft for the purpose of
receiving legal advice) of the existence or content of the Wanant for a period of one year or until
1. The Court has the inherent power to seal comt filings when appropriate,
court of competent jurisdiction" as defined by 18 U.S.C. § 2711. Specifically, the Comt is a
"district court of the United Slates ... that - has jurisdiction over the offense being investigated."
occuned within Washington, D.C. See 18 U.S.C. § 3237.
U.S.C. § 2705(b). Microsoft provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Microsoft may be
wanant. Specifically, Section 2703(c)(2) authorizes the Government to obtain ce1tain basic
. "subscriber information" using a subpoena, Section 2703( d) allows the Government to obtain other
Government to obtain contents of communications using a search wanant. See 18 U.S.C. § 2703.

1 Section 2705(b) contains additional requirements

for legal process obtained pursuant to 18 U.S.C.
2
18 U.S.C. § 2705(h). The United States District Court for the District of Columbia has made clear
that a nondisclosnre order under Section 2705(b) must be issued once the Government makes the
In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d I, 5 (D.D.C. 2014).
command Microsoft not to notify any other person (except attorneys for Microsoft for the purpose
order of the Court.
6. The Federal Bureau ofinvestigation ("FBI") is investigating violations of 18 U.S.C.
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an umegistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq.
3
(foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject
Offenses"), in connection with efforts to compromise the networks of the Democratic National
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public
release of stolen materials tln·ough various outlets.
of the Court and that Microsoft and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Microsoft for the purpose of receiving
legal advice) for a period of one year or until further order of the Court. Such an. order is
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature
of which is neither public nor known to the targets of the investigation, and its disclosure may alert
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant.
and related papers may also ale1t the targets to the scope of information !mown to the FBI. Once
alerted to this information, potential targets would be immediately prompted to destroy or conceal
4
See Robinson, 935 f.2d at 287-89.
10. Based on prior dealings with Microsoft, the United States is aware that, absent a
court order under Section 2705(b) commanding Microsoft not to notify anyone about a legal
request, Microsoft may, upon receipt of a warrant seeking the contents of electronically stored wire
existence of the wan-ant prior to producing the material sought.
Microsoft not to notify any other person of the existence oi: contents of the above-captioned
warrant (except attorneys for Microsoft for the purpose of receiving legal advice) for a period of
one year or until further order of the Court.

Special Counsel
Dated: ':) IZ?: / \ Y2 By:
5

for the

Case: 1:18-sc-02921
INFORMATION ASSOCIATED WITH TWO ACCOUNTS )

See Attachment A
I find that the affidavit(s), or any recorded testimony; establish probable cause to search and seize the person or property
See Attachment B
r;t in the daytime 6:00 a.m. to 10:00 p.m.
person from whom, or from whose premises, the prope1iy was taken, or leave the copy and receipt at the place where the
prope1iy was taken.
The officer executing this warrant, or an officer present during the execution of the wanant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District ~llQilL ______ .
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the pe1:son who, or whose
property, will be searched or seized (check the appropriate box) I
' ·
0 for _ _ days (nottoexceed30) 0 until, the facts justifying, the later specific dat'(1bf - - - ~ - - - --~-----
Date and time issued: ~-~~

Judge 's signature
Return
Certification
designated judge.
Date: -
·--··
ATTACHMENT A
This warrant applies to info1mation associated with the Google accounts registered to the
operated by Google, LLC ("Google"), a company headquartered in Mountain View, California:
-1-
ATTACHMENT B
infmmation to the government for each account listed in Attachment A:
associated with session times and dates, account status, alternative email addresses,
and files;
-2-
e. All records pertaining to connnunications between the Provider and any person
actions taken;
h. All location and maps inf01mation associated with the account;
proprieties and UA codes, all usernames and email accounts associated with them);
J. All Google Developers Console inf01mation associated with the account;
1. All Android information associated with the account;
n. All Y ouTube information associated with the account;
r. All Google Drive inf01mation associated with the account;
s. All Google+ infmmation associated with the account;
-3-
-4-

I
b. All records, infonnation, documents or tangible materials that relate in any way to
principals;
foreign principals;
-5-
g. Evidence indicating how and when the account was accessed or used, to detennine
investigation;
J. Credit card and other financial infonnation, including but not limited to, bills and
L The identity of any non-U.S. person(s)-including records that help reveal the
principals.
n. Passwords and encryption keys, and other access info1mation that may be necessary
in subsection II.a.
-6-
-7-
,,r' 'J,r r1L, rt~

;"',\;;;l lf"\'i
\h, '""''
SEP 2 l wm
Clerk U.S. rnstrlct & Bankru\ltcy
FOR THE DISTRICT OF COLUMBIA r.ourt; for \lie O\stric1 oi Columbia

Case: 1:18-sc-02921
INFORMATION ASSOCIATED WITH TWO
Assigned To: Howell, Beryl A
ACCOUNTS STORED AT PREMISES
CONTROLLED BY GOOGLE
ORDER
and to require Google, an electronic communication and/or remote computing services provider
headquartered in Mountain View, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. § 2705(b).
witnesses. See 18 U.S.C. § 270S(b)(2)-(5).
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its
employees shall not disclose the existence or content of the Wa.1Tant to any other person (except
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until
THE HONORABLEBRYL A. HOWELL

Wi,r(;pr!
Date
2
Case
AO 106 (Rev. 04/lO) 1:19-mc-00029-CRC
UNITED STATES DISTRICT COURT tF: J! lL r;

for the
District of Columbia SEP 2 '/ 201t\
Clark, U.S. District & [)ankruptcy
Cm:rt::1 J1Jr thg nil'ltfict of Cnhnn.bla
)
)
TWO ACCOUNTS STORED AT PREMISES ) Assign. Date: 9/27/2018
CONTROLLED BY GOOGLE ) Description: Search & Seizure·Warrant

property Jo be searched and give its location):
See Attachment A
Northern
located in the - - - -----
District of _ __-C-.-a..li...fo,,.r_..n...,ia.__ _ _ , there is now concealed (identify the
See Attachment B
r'lf evidence of a cri1ne;

See attached Affidavit. ·
r./ Continued on tbe attached sheet.

0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ _ ) is reqnested
Reviewed by AUSA/SAUSA: Applicant's signatui·e
!Kyle R. Fre~ny (ASC)

I Patrick J. Myers, Special Agent, FBI
~--------,,,~d
7
~
Judge's signature
City and state: Washingto_n_,_D_.C_.________ Hon. Beryl A Howell, Chief U.S. District Judge
er:1:i ·,·,. ·1 UI
;i;_ 1
,n1''G
FOR THE DISTRICT OF COLUMBIA C1~rk, U.S. lllotrlct & Hankruptcy
Courts tor tt10 District o1 Golumbla
IN THE MATTER OF THE SEARCH OF Case: 1:18~sc-02921

TWO ACCOUNTS STORED AT PREMISES Assign. Date: 9/27/2018
CONTROLLED BY GOOGLE Description: Search & Seizure Warrant
information associated with the Google accounts registered to and
(the "Target Accounts 1 & 2"), stored at premises owned, maintained,
controlled or operated by Google, LLC ("Google"), a company headquartered in Mountain View,
California. As set forth below, the Target Accounts
Upon receipt of the information
described in Attachment A, government-authorized persons will review that information to locate
the items described in Attachment B.
2. I am a Special Agent with the Federal Bureau oflnvestigation ("FBI") assigned to
-1-
there is probable cause to believe that the Target Accounts contains evidence, fruits, or
abetting), 18 U.S.C, § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18
tampering), and 52 U.S.C. § 3012l(a)(l)(C) (foreign expenditure ban). There also is probable
JURISDICTION
(c)(l )(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) ... that has jurisdiction over the offense being investigated." 18. U.S.C.
PROBABLE CAUSE
i. Roger STONE
-2-
ii. Jerome CORSI
inf01mation, served as the "Washington Bureau Chief for Inforwars.com." According to
-3-

Election
that the Russian govennnent employed during its interference. The USIC summarized the effmis
activity-with overt efforts by Russian Govennnent agencies, state-funded media, third-pmiy
-4-
14. The Special Connsel's Office has determined that individuals associated with the
access to DNC computers housed on a third-party cloud-compnting service. In or aronnd late
the DNC's cloud-based systems using the cloud provider's ovm technology. The individuals
those accounts.
emails from a fotmer White House advisor who was then advising the Clinton Campaign. These
-5-
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1: 18-cr-OO 125).
C. STONE's Public Interactions with Guccifer 2.0 and WikiLcaks
Russian govermuent actors and the media reported on the announcement. On June 15, 2016, the
persona Guccifer 2.0 appeared and publicly claimed responsibility fol' the DNC hack. It stated
theDNC.
why he did the hack of the DNC." The atiicle also stated: "Guccifer 2.0 made a fateful and wise
-6-
has intimated he's going to do'/" STU NE responded: ''Well, it could be any number of things. I
-7-
soon the [sic] Podesta's time in the ba1Tel. #CrookcdHillary." In a C-SPAN interview that same
[ASSANGEJ, the public [could] expect to see much more from the exiled whistle blower in the
"Wednesday @HillaryClinton is done. #WildLeaks."
30. On Sunday, October 2, 2016, MSNBC _Moming Joe producer Jesse Rodriquez
tweeted regarding an announcement AS SAN GE had scheduled foi" the next day from the balcony
of the Ecuadoran Embassy in London. On the day of the ASSANGE am1ouncement -which was
part of WikiLeaks' 10-yeaT anniversary celebration - STONE told Infowars that his intermediary
described this release as the "mother load." On October 5, 2016, STONE nsed@RogerJStoneJr
32. Approximately a half hour later, at 4:32 PM, WikiLeal(s sent a Tweet reading
-8-
33. WikiLealcs continued to release John Podesta's hacked emails through Election
Day, November 8, 2016. On October 12, 2016, Podesta- refeITing back to STONE's August 21,
think there's at least a reasonable belief that [Assange] may have passed this infonnation on to
everything I know is through that channel of communications. I'm not implying l have any
35. On October 13, 2016, while WikiLealcs was in the midst of releasing the hacked
-9-
account @wikilcaks. 1 The latter account is the official Twitter account of WikiLeaks and has
operationleaks like a sieve. You need to figure out who your friends are."
"Still nonsense. As a journalist it doesn't matter where you get infonnation only that it is
accurate and authentic. The New Y orlc Times printed the Pentagon Papers which were
-10-
issue an order restrnining the paper from publishing additional articles. If the US government

Forthcoming Leaks
issued a search warrant for STONE's address On October 17,
2017, Chief Judge Howell issued a search warrant for one ofSTONE's addresses,
-11-
CORSI that, "May meet Manafo1t -guarantee nothing."
CORSI wrote,
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recogpized us immediately and
44. On July 25, 2016, STONE, using sent arr email to
CORSI with the subject line, "Get to Assarrge." The body of the message read: "Get to Assarrge
Assarrge[.] should find Bernie [S]arrders brother who called Bill a Rapist-tmn him for
Trmnp[.] should find or more proof of Bill getting kicked out."
"Word is frie11.d in embassy plans 2 more dumps. One shortly after I'm
for now. Post-DNC bump for HRC arr artifact of rigged polling. Won't last. I expect presidential
-12-
divulge the conversation about meeting ASSANGE. STONE told he was joking and
STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting
-13-
call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
invest in Uranium One -was hired by Rosatom in Giustra scandal. Podesta now under FBI
more on Turkey. Need a back chaunel highly sensitive stuff." CORSI responded, "We have
secure back chaunel through Roger. I saw him again in NYC last Friday and spoke to him about
it again today." wrote back, "Awaiting secret file. Explosive... Hope you are well.
Can't wait for the debate. Chauneling Reagan, I hope!" CORSI responded, "Keep me posted
-14-
about." The associate responded, "Well clearly he knows whatAssange has. I'd say that's
important."
57. That same day, BANNON emailed STONE a "What was
democrat."
February 14, 2018; he initially denied knowing whether the October 4, 2016 email to STONE
was about WikiLeaks. Upon further questioning, BANNON aclmowledged that he was asking
Are Released.
then-the-race-was-on/2016/10/07 /3 ld74 714-8ce5-11e6-875e-2c 1bfe943b66_ story.html
-16-
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacldng bad job
numbers."
-17-
-18-
KUSS1AN MAJ:ilA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and
JOrIN PODESTA." The text stated: "Roger[,] You are free to publish this under your own
Metcombank, a Russian regional bank owned 99 .978 percent by with the money
Foundation?"
"On Assange, can you call me now- before 2prn[.]" STONE responded, "Missed u-just
intel to share."
-19-
AS SAN GE ... URGENT ... " CORSI wrote, "From a very trusted source," and forwarded an email
rooms.
77. On or about October 19; 2016, STONE published an article on Breitbart.com in
-20-
-21-
-22-

with Wikilcaks
88. On September 26, 2017, STONE testified before the House Pennanent Select
public what he said were his opening remarks to the committee. In. them, STONE stated:
Members of this Committee have made three basic asse1tions against me which must be
of Clinton campaign chairman Jolm Podesta's email, that I had advanced knowledge of
the source or actual content of the WikiLeaks disclosures regarding Hillm-y Clinton or
are facts ....
time in the barrel. #CrookedHillary" must be exan1ined in context. I posted this at a time
campaign over allegations regm·ding his business activities in Ukraine. I thought it
publisher Julian Assange[] armounced that he was in possession of Clinton DNC emails.
true.
-23-

MR. STONE: No.
you were only refe1Ting to a single fact that you had confirmed with the intermediary -
MR. STONE: That -
MR. STONE: That is con-ect, even though it was repeated to me on numerous separate
occasions.
2017, STONE published an article on his website, stonecoldtruth.com, titled "Is it the Podesta' s
Time in the B=el Yet?" In that ariicle, STONE stated: "[I]t was this inevitable scrutiny of the
Podestas' underhanded business dealings that my 'time in the ban-el' referred to and not, as some
Podesta's emails .... [M]y tweet refe1Ted to Podesta's business dealings with Russia, and the
91. On or about November 19,.2017, Randy CREDICO (who, as described further
save the plan' ........Richard Nixon[.]" CREDICO responded, "Ha ha."
the house connnittee lawyer told my lawyer that I will be getting a subpoena[.]'' STONE wrote
-24-
wrote, "My lawyer wants me to cut a deal." STONE wrote back, 'To do what? Nothing
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
about the DNC stuffI.J I just followed his tweets[.]" STONE responded, "U never said anything
interview him or meet him until August 26th[.] That was my :first communication with his
guess Schiff will try to get one ofus indicted for perjmy[.]"
94. STONE and CREDI CO continued to exchange messages and on November 24,
now you can relax."
times.
-25-
pending publication,' ... Credico never said he knew or had any infmmation as to source or
97. On or about December 1, 2017, CREDICO messaged STONE, "I don't lmowwhy
back Channel they now lmowthat I was not in London tmtil September of this year[.] You had
no back-chatmel and you could have just told the truth ... You want me to cover you for pe1jury
wrong or illegal. You got the best press of your life and you can get away with asse1iing for 5th
a fool." CREDICO resp~nded, "You open yourself up to six counts ofpe1jury[.] But I'm sure
that wasn't sworn testimony so you're probably clear[.] Council for the connnittee knows you
... you should go back ... and am.end your testimony and tell them the truth." CREDICO
· you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my
4Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the
FBI.
-26-
I 00. STONE and CREDICO continued to exchange text messages, and on or about
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a rep01ter.
STONE responded, "Hope u don't fuck Up my effo1ts to get Assange a pardon[.]" CREDICO
initial contact."
Assange until September oflast yeai."
102. CREDICO and STONE continued to message each other, and on or about Januaty
off because you're friends with Tnunp so don't worr):'. I have all the forensic evidence[.] I was
not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
103. On or about April 13, 2018, news rep01ts stated that CREDICO had shown
repo1ters copies of email messages he had received from STONE in the prior few days that
-27-
stated, "You arc a rat. You are a stoolie. You backstab your friends - run your mouth my
from you," referring to CREDICO's therapy dog. CREDICO slated that it was "certainly scary .
He was depressed about it. Or was he lying." The aiticle noted that CREDI CO stated he did not
K. The Target Accounts
5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviscr-roger-stone-
6 https ://www.mothcrj ones.com/politics/2018/05/ro gcr-stone-to-associate-prcpare-to-die/
-28-
-29-
-30-
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers
to contain stored electronic communications (inclnding retrieved and umetrieved email) for
-31-
application inforn1ation. In my training and experience, such information may constitute evidence
user or users.
provide certain personal identifying inforn1ation when registering for an email account. Such
subscribers insert false infonnation to conceal their identity, this information often provides clues
info1mation about the creation and use of each account on their systems. This information can
account an.d the IP addresses associated with particular logins to the account. Because every device
-32-
118. In my training and cxpenence, m some cases, email account users will
119. This application seeks a wanant to search all responsive records and information
pursuant to the requested wanant of the contents of wire or electronic communications and any
the United States.
while executing a search wanant at a residence. For example, email communications, contacts
-33-
conducted pursuant to established procedures designed to collect evidence in a manner c~nsistent
CONCLUSION
122. Based on.the forgoing, I request that the Court issue the proposed search wanant.
-34-
REQUEST FOR SEALING
124. I further request that the Court order that all papers in supp01i of this application,
including the affidavit and search warrant, be sealed until frniher order of the Court. These
Special Agent
Subscribed and sworn to before me on this ~ a y of September, 2018.

-35-
ATTACHMENT A
This warrant applies to information associated with the Google accounts registered to the
-1-
e. All records pe1taining to communications between the Provider and any person
regarding the account, including contacts with suppmt services and records of
actions taken;
g. All search hislory aml web hislory associated with the account;
proprieties and UA codes, all usemarnes and email accounts associated with them);
j. All Google Developers Console information associated with the account;
-3-
a. All records, infoimation, documents or tangible materials that relate in any way to
commnnications regarding hacking, release of hacked material, communications
or other obfuscation about knowledge of, or access to, hacked material; '
b. All records, infmmation, documents or tangible materials that relate in any way to
c. Commnnications, records, documents, and other files related· to any expenditure,
independent expenditure, or disbursement for an electioneering commnnication;
govermnent, foreign officials, foreign entities, foreign persons, or foreign
principals;
e. All images, messages, commnnications, calendar entries, seaTch terms, "address
book" entries and contacts, including any and all preparatory steps talcen in
f. Commnnications, records, documents, and other files that reveal efforts by any
any foreign govermnent, foreign officials, foreign entities, foreign persons, or
foreign principals;
-5-
investigation;
of the person(s}--who communicated with the account about any matters relating
· principals.
n. . Passwords and encryption keys, and other access information that may be necessary
in subsection II.a.
-6-
Review of the items described in Attaclnnent A and Attaclnnent B shall be conducted
-7-


INFORMATION ASSOCIATED WITH TWO Assigned To: Howell, Beryl A.
ACCOUNTS STORED AT PREMISES Assign. Date: 9/27/2018
CONTROLLED BY GOOGLE Description: Search & Seizure Warrant

in support thereof(collectively herein the "Wan-ant") under seal, and precluding the provider from
notifying any person of the Wan-ant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered in Mountain View, California, not to notify any other
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or
content of the Warrant for a period of one year or until fiuther order of the Comt.
WRISDICTION AND LEGAL BACKGROUND
including the Wan-ant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
the Wmrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
2. In addition, this Comt has jurisdiction.to issue the requested order because it is "a
occmred within Washington, D.C. See 18 U.S.C. § 3237.
U.S.C. § 2705(b). Google provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Google may be
compelled to supply communications and other records using a subpoena, comt order, or search
"non-content" infmmation using a comt order, and Section 2703(a)-(b)(l)(A) allows the
subpoenas, court orders, or search wanants under Section 2703. However, many have voluntarily

1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C.
2

18 U.S.C. § 2705(b ). The United States District Court for the District of Columbia has made clear
subpoena may lead to one of the deleterious outcomes listed under§ 2705(b), the
In re Application for Order of Nondisclosure Pursuant to 18 USC § 2705(b) for Grand Jury
order of the Court.
6. The Federal Bureau oflnvestigation ("FBI") is investigating violations ofl 8 U.S.C.
§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the "Subject Offenses"), in
connection with efforts to compromise the networks of the Democratic National Convention
("DNC"}, the Democratic Congressional Campaign Committee ("DCCC"), and the email accounts
of U.S. persons, followed by the public release of stolen materials through various outlets.
3
existence or content of the Wmrnnt (except attorneys for Google for the purpose ofreceiving legal
because the Wanant relates to an ongoing criminal investigation, the scope and nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal.
are !mown to use electronic communication and remote computing services, the potential target
WmTant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S. C.
4
compelling govermnental interest in confidentiality to justify the govermnent's sealing request.
10. Based on prior dealings with Google, the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request,
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or
electronic communications for a certain account, notify the subscriber or customer of the existence
of the warrant prior to producing the material sought.
(except attorneys for Google for the purpose of receiving legal advice) for a period ofone year or

Special Counsel
By: /
Kyle . eeny
The Special Counsel '.s Office
(202) 616-3812
5
..1 and Seizure Warrant
.I
for the

Case: 1: 18-sc-02922
or identify the person by name and address) Assigned To: Howell, Beryl A.
INFORMATION ASSOCIATED WITH ONE ACCOUNT
STORED AT PREMISES Description: Search & Seizure Warrant
CONTROLLED BY APPLE /

An application by a federal law enforcement officer or an attorney for the govermnent requests the search
See Attachment A
I fmd that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the pe1wn or describe the property to be seized):
See Attachment B
,;{ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
prope,ty was taken.
as required by law and promptly return this warrant and inventory to -·· Hon. Beryl A. Howell, Chief U.S. District Judge ___
0 Pursuant to 18 U.S.C. § 3103a(b), Ifind that immediate notification may have an adverse result listed in 18 U.S.C. j
§ 2705 (except for delay of trial), and autl1orize the officer executing this warrant to delay notice to the person who, or whose
propetty, will be searched or seized (check the appropriate box) II
Ii
'
Date and time issued: __ 1/J--r/7p17 c/' f'ld/A ~ , , / . ~

, · Judge's signature
I
11
.___
I!
I
,I
Return
Certification
I declare under penalty of pe1jury that this inventmy is correct and was returned along with the original warrant to the
designated judge.
Date: -

ATTACHMENT A
This warrant applies to info1mation associated with the following accounts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company
headquartered in Cupertino, California:
-1-
ATTACHMENT B
To the extent that the infonnation described in Attaclnnent A is within the possession,
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(:1:), the
Provider is required to disclose the following information to the govennnent for each account or
identifier listed in Attachment A:

and files;
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
names associated with the subscriber, methods of connecting;
-2-
f. All search histo1y or web history;
g. All records indicating the services available to subscribers of the accounts;
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
i. All cookies, including third-party cooldes, associated with the user;
J. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic · Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMSI"), or International Mobile Equipment Identities
("IMEI").
period from June 1, 2016, to December 31, 2017, including:
a. All records, infmmation, documents or tangible materials that relate in any way to
-3-
b. All records, inf01mation, documents or tangible materials that relate in any way to
communications or meetings involving Jerome Corsi , Julian
Assang , Randy Creclico, Charles
Orte!, or any individual associated with the Tmmp Campaign;
independent expencliture, or disbursement for an electioneering communication;
d. Records of any furids or benefits disbursed by or offered on behalf of any foreign
principals;
book" entries and contacts, including any and aH preparatory steps taken in
foreign principals;
h. Evidence inclicating the account user's state of mind as it relates to the crimes under
investigation;
-4-
m. Th~ identity of any person(s)-including records that help reveal the whereabouts
principals.
in subsection II.a.
-5-
team," separate and apaii from the investigative team, in order to address potential privileges.
-6-
FILED
SEP 2 7 2018
Courts for the District of Col~mbla

INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Beryl A.
ACCOUNT STORED AT PREMISES Assign. Date : 9/27/2018
CONTROLLED BY APPLE, INC. Description: Search & Seizure Warrant
ORDER
and to require Apple, Inc., an electronic conununication and/or remote computing services
provider headquartered in Cupertino, California, not to disclose the existence or contents of the
Warrant pursuant to 18 U.S.C. § 2705(b).
The Cowt finds that the United States has established that a compelling governmental
and
IT IS .FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until
futther order of the Court.
THE HONORAJ3LEOR LA. HOWELL

2
AO 106 (Rev, 04/ IO) Application for a Search Warrant

FILED
for the SEP 27 2018
District of Columbia Clark, U.S. District & Bankruptcy
Courts for the District of Columbia.
In the Malter of the Search of ) Case: 1:18-sc-02922
(Briefly describe the property to he searched )
or idenlijy the person by name and address) ) Assigned To : Howell, Beryl A.
INFORMATION ASSOCIATED WITH ) Assign. Date : 9/27/2018
ONE ACCOUNT STORED AT PREMISES CONTROLLED ) Description: Search & Seizure Warrant
BY APPLE )

penalty of perjury that I have reason to believe that on the following person or prope1ty (identify the person or describe the
See Attachment A
located in the Northern District of California , there is now concealed (identify the
--- ·--~===----
person or describe the property to be setzed):
See Attachment B
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or mo,e):
d property designed for use, intended for use, or used in committing a crime;

r;( Continued on the attached sheet.

0 Delayed notice of days (give exact ending date if more than 30 days: _ _ _ _ ) is requested
under I 8 U.S.C. § 3 I 03a, the basis of which is set forth on the attached sheet.
Reviewed by AUSA/SAUSA: Applicanr 's signawre
!Kyle R. Freeny (ASC) Patrick J. Myers, S_pecial Agent, FBI

Printed name and Jitle
Date: _ t/;, ?j}!/1 ~. f(~~

Judge's signature
City and state: Washington, _D_.c_._ _ _ _ __ --~H~on. Beryl A Howell, Chief U.S. District Judge
Printed name and tille
FILED
IN THE UNITED STATES DISTRICT COURT SEP 2 7 2018
Courts tor th& Dlstrlct o1 Golumbl,
Case: 1:18-sc-02922
ONE ACCOUNT STORED AT PREMISES
CONTROLLED BY APPLE
1. I make this affidavit in support. of an application for a search warrant for
information associated with the Apple account "Target Account"), stored at
premises owned, maintained, controlled or operated by Apple, Inc. ("Apple"), a company
headquartered in Cupertino, California. As set forth below, the Target Account is believed to be
used by an associate of STONE who was in communication with STONE on the day that
WikiLeaks first released emails stolen from Clinton Campaign chair John Podesta and who appears
to have met with STONE in October 2016 on the same day that STONE publicly claimed to have
had dinner with his back-channel to WikiLeaks founder Julian Assange. Upon receipt of the
information described in Attachment A, government-authorized persons will review that
info1mation to locate the items described in Attachment B.
-1-
there is probable cause to believe that the Target Account contains evidence, fruits, or
U.S.C. § I 001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected
,JURISDICTION
5. This Court has jurisdiction to issue the requesteq warrant because it is "a court of
(c)( 1)(A). Specifically, the Court is "a district court of the United States (including a magistrate
-2-
II
i!
!
PROBABLE CAUSE
I
A. Background on Relevant Individuals !
.1
i. Roger STONE
II
ii. Jerome CORSI
information, served as the "Washington Bureau Chief for lnforwars.com." According to
-3-

Election
Govermnent developed a clear preference for President-elect Trump.
-4-
I
I
I'
,,
services conducted cyber operations against targets associated with the 2016 US presidential I
I
election, including targets associated with both major US political parties." Fmiher, "[i]n July I
:1
I
I
r
'
I 2. With respect to the release of stolen materials, the USIC assessed "with high
those accounts.
-5-
See United States v. Viktor Borisovich Netyksho, et al. (Case No. l:18-cr-00125).
theDNC.
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Gucci fer
-6-
regard to the October surprise, what would be your forecast on that given what Julian Assangc
23. On August 12, 2016, Guccifer 2.0 publicly tweeted: "@RogerJStoncJr thanks that
-7-
I
I,
,1
i~
I!
,,
I

Ii
soon the [sic] Podesta's time in the batTel. #CrookedHillary." In a C-SPAN interview that same
[ASSANGE], the public (could] expect to see much more from the exiled whistleblower in the
Assange is a hero ... [ think he's taking on the deep state, both Republican and Democrat. I
believe that he is in possession of all of those emails that Huma Abcdin and Cheryl Mills, the
Radio that he expected WikiLcaks to "drop a payload of new documents on Hillary on a weekly
29. On Saturday, October!, 2016, using@RogerJStoneJr, STONE tweeted,
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement - which was
part of WikiLeaks' I 0-year anniversary celebration - STONE told lnfowars that his intermediary
-8-
published an mticle containing a recorded conversation from a 2005 Access Hollywood shoot in
"RELEASE: The Podesta Emails #HillaryC!inton #Podesta #im WithHer" and containing a link
I do believe he has all of the e-mails that 1-Juma Abedin and Cheryl Mills, the Clinton aides,
-9-
I
Ji
1:
i/
t
D. STONE's Private Twitter Direct Messages with.WikiLeaks and ASSANGE
35. On October 13, 2016, while WikiLcaks was in the midst of releasing the hacked
Podesta emails, the Twitter account @RogerJStoncJr sent a private direct message to the Twitter
1
-10-
the founder of WikiLcaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged
charges dropped I don't know of any crime you need to be pardoned for - best regards .. R." That
40. On Saturday, June 10, 2017, @RogcrJStoneJr sent a direct message to
@J ulianAssange, reading: "I am doing everything possible to address the issues at the highest

Forthcoming Leaks
41. On September 11, 2017, ChiefJudge Beryl A. Howell of the District of Columbia
. 2017, Chief Judge Howell issued a search warrant for one ofSTONE' addresses,
warrant fo email account. On or about March 14, 2018, Chief Judge Howell
.search warrants indicated the following:
-11-
Stone so he knows your ayailability to meet Manafort and DT this coming week." CORSI
appears to have forwarded the message to STONE at ho replied to
with the title, "Roger -- why don't you look this over before I send it to I believe that
CORSI wrote,
44. On July 25, 2016, STONE, using ent an email to
CORSI with the subject line, "Get to Assange." The body of the message read: "Get.to Assange
Foundation, allegedly." The text of this email from STONE to CORSI substantially mirrored the
text of ah email that STONE received from ~a freelance blogger who had been
conducting research into the Clintons during presidential campaign---on or about the same day.
45. On or aboutJuly 31, 2016, STONE, using emailed
Assangc[.J should find Bernie [S]anders brother who called Bill a Rapist - tum him for
46. On or ahout August 2, 2016 (approximately 19 days before STONE publicly
tweeted about "Podesta's time in the banel"), CORSI emailed STONE at
-12-
11
)
i
"Word is friend in embassy plans 2 more dumps. One shortly after I'm j
l
I
I
,,
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, I
I•
for now. Post-DNC bump for HRC an artifact of rigged polling. Won't last. I expect presidential I
i
~
i
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- IIi
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation .
I
I
Ir
divulge the conversation about meeting ASSANGE. STONE told he was joking and
had not actually met AS SAN GE. 2
48. Tlu·ough a search of STONE's iCloud account, the FBI has uncovered evidence
-13-
j
ll.
I
[
i
in his email t , to have "dined" with ASSANGE. For example, an associate of II

I'
STONE sent a text to STONE at approximately 3 :38PM on August 2, asking "How did ur meeting !
call later- heading for airport now[.]" Additionally, investigators have identified a photograph in
Did you get the PODESTA writeup." STONE replied "[y]es."
51. On or about August 31, 2016, CORSI messaged STONE, "Podesta paid $ l 80k to
investigation - tied to Ukraine Y anukovych - Panama papers reveals Podesta hired by
S[b ]erbank, Russia's largest financial institution - Podesta$$$ ties to Russia undermine Clinton
Roger[,] Is NY Post going to use the Pedesta [sic] stuff?"
-14-
BANNON, who was CEO of the Campaign at the time, and wrote: "Yon should call Roger. See
below. Yon didn't get from me." BANNON wrote back, "I've got important stuff to worry
important."
ASSANGE would release infonnation damaging to then-candidate Clinton, but WikiLeaks did
-15-
57. That same day, BANNON emailed STONE "What was
democrat."
Are Released.
3
then-the-race-was-on/2016/10/07 /3 l d7 4 7 l 4-8ce5- l l e6-875e-2cl bfe943 b66_story.html
-16-
66. At approximately 6:27PM, -the person who originally suggested
"get[ting] to Assange," and who, according to emails and phone records, regularly
communicated with STONE-sent STONE an email titled, "WikiLeaks - The Podesta Emails,"
with a link to the newly-released Podesta emails. Approximately ten minutes later, STONE,
using forwarded message to CORSI without comment.
STONE does not appear to have forwarded the email to any other individual.
G. STONE Asks CORSI for "SOMETHING" to Post About Podesta After STONE ls
numbers."
-17-
usin m, emailed Corsi asking him to "send me your best podesta links."
emailed STONE at bot , with the subject
: "PO DEST A -- Joule & ties to RUSSIA MONEY LAUNDERING to
wrote back to STONE, "I'll give you one more- NOBODY YET HAS THIS[:] It looks to me
Metcombank[.] The Russians launched a criminal investigation[.] (web link] Once
-18-
had the channel open from Metcombank to Deutsche Bank America to Ban[k) of America's
sent STONE an email a with the subject, "ROGER STONE article
then asked, "Just how much money did , a controversial Russian billionaire
investor with ties to the Vladimir Putin and the Russian goverrnnent, launder through
Metcombank, a Russian regional bank owned 99.978 percent b with the money
Foundation?"
-19-
intel to share."
It's what they used to call a 'Mexican stand offl.]' Only hope is that if Trump speaks out to save
rooms.
-20-
-21-
I
I
!
!1
I
l
I'
11
-22-
!
I
I
[
I
i
II
I!
I
I
I

with Wikileaks
Committee on Intelligence (HPSCJ). Although the hearing was closed, STONE released to the
that, my now public exchange with a persona that oµr intelligence agencies claim, but
are facts ....
oligarchs around Putin, their uranitun deal, their bank deal, and their Gazprom deal,
-23-
true.
89. In a document dated March 26, 2018 titled "MinorityViews," Democratic

MR. STONE: No.
MR. STONE: That -
occasions.
J, STONE's Messaging to Randy CREDICO about STONE's "Back channel"
-24-
II
!
t
lawyer wants to see me today." STONE responded, '"Stonewall it. Plead the fifth. Anything to
'
92. On or about November 21, 2017, CREDI CO messaged STONE, "I was told that
back, 'That was the point at which your lawyers should have told them you would assert your
he had the goods [oJn Hillary and would publish them - which he himself said in public b4 u told
about the DNC but it was August." CREDI CO wrote back, "It was not August because I didn't
94. STONE and CREDI CO continued to exchange messages and on November 24,
2017, CREDI CO wrote to STONE, "Forensic evidence proves that there is no back Channel. So
now you can relax."
-25-
27 and 28, 2017, CREDI CO and STONE communicated via text message more than a dozen
times.
"intermediary." In a public Facebook post, STONE further stated that "Credico merely[)
97. On or about December I, 2017, CREDICO messaged STONE, "I don't know why
you had to lie and say you had a back Channel now I had to give all ofmy forensic evidence to
the FBI today what a headache[.]' You could have just told him the truth that you didn't have a
Amendment rights ifu don't want talk about AND if you tumed over anything to the FBI you're
that wasn't swom testimony so you 're probably clear[.] Council for the committee knows you
4
Contrary to his statement, CREDI CO had not at the time provided any forensic evidence to the
FBI.
-26-
!
l•I
I
Fifth Amendment rights but you can. I guarantee you you [sicJ are the one who gets indicted for
fl
perjury if you're stupid enough to testify[.]" '
initial contact."
102. CREDI CO and STONE continued to message each other, and on or about January
-27-
I
lf:
II
off because you're friends with Trump so don't worry. I have all the forensic evidence[.] I was '~
I
!I
not a ba[ ck] Channel and I have all those emails from September of 2016 to prove it[.]"
I
11
103. On or about April 13, 2018, news reports stated that CREDICO had shown 11
I
Ii,1
K. STONE's Communications with
105. As noted above, in late July 2016 emailed STONE to "get to Assange,"
which appears to have precipitated STONE's email to CORSI with the same instruction.
106. On or about August 17, 2016 sent an email to STONE's Gmail account
with the subject line, "Introduction." The email was also sent to the work account o
5
https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-
threatened-dog-1359113 70.htrnl
6
https: //www. motherj ones.com/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/
-28-
listed both STONE' telephone numbers, and he advised them, "You should find
time to chat."
107. Toll records for STONE's cellphone show that between August 18, 2016 and
November 3, 2016 was in contact with STONE approximately 60 times. This
included several calls on October 7, 2016, the day that WikiLeaks began releasing Podesta's
emails. On that day called STONE at approximately 12:33PM, within an hour of
STONE's call with the Washington Post, which was about to publish information about the
"Access Hollywood" tape. The call lasted approximately seven minutes. appears to
be the first person, other than journalists, to talk to STONE after STONE's call with the
Washington Pos called STONE a second time at approximately 2:38PM on the same
day. That call lasted approximately one minute. STONE also had a missed FaccTime call from
at approximately 3:32PM the same day. WikiLeaks released the first tranche of stolen
Podesta emails approximately one hour later.
108. As noted above told investigators that in January 2017, CORSI told
him that he (CORSI) and STONE were involved in and were aware of the timing and content of
the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta,
and CORSI implied, in sum and substance, that STONE was involved in the release of the
Podesta emails by WikiLeaks.
109. According to open source information, on or about October 12, 2016, five days
after the first release of stolen Podesta emails, STONE told a local news outlet in Florida, "I do
have a back-channel communication with Assange, because we have a good mutual friend. That
-29-
i
!
I!
friend travels back and forth from the United States to London and we talk. I had dinner with II
ri
him last Monday." 7 "Ibe Monday prior to the date ofSTONE's statement was October 10, 2016. !
!I
!,
110. In the early hours of October 10, 2016, at approximately 3:26AM EDT
texted STONE: "H . If you are still in NY we MUST meet tomorrow. Major major
I
stuff." At approximately 8:26AM the same day (but, effectively, the next morning, given the I
I
hour o R's text), STONE replied, "Ok- can we meet UES?" UES appears to be a
iI
reference to the Upper East Side of New York City, where STONE maintained a residence.
texted STONE at approximately 9:02AM, "Sure. Lunch? Coffee? Time?" and again at I
10:55AM, "What time works." Investigators have not located a response from STONE, although
called STONE at approximately 4:45PM°'with a call duration of approximately 4
seconds.
111. Cell-site location data for STONE shows that he was in the Upper East Side on
the evening of October 10, 2016, when he claimed to have met with his contact to Assange,
Financial records for STONE show a
transaction on October 10, 2016, at a pizza parlor located in the Upper East Side, in the amount
of approximately $20.
112. Search warrant returns show that after WikiLeaks began to release Podesta's
emails in October 2016, emailed STONE several times from the account
("Target Account") with links to WikiLeaks' website and discussion about the
us Podesta emails that WikiLeaks had released. For example, on or about
October 25, 2016, sent an email from the Target Acconnt to STONE' account
7
https ://miami .cbslocal.com/2016/1 0/12/trump-all y-roger-stone-admits-back-channel-tie-to-
wikileaks/
-30-
I
i
j
[
with a link to the portion ofWikiLeaks' website containing Podesta emails, with the comment, I
I
"Cheryl Mills & John Podesta panic to cover Obama's lies on Hillary emails." !
I'
113. Search warrant returns for CORSI k account show th was in j
communication with CORSI at least in 2017. During an email exchange in June 2017 that
I
I
appears to relate to financial policy-makers, CORSI tol that he was "concerned about
Mueller," following up shortly thereafter to clarify that had "meant Mnuchen," the Secretary of
Treasury. CORSI added, "Guess I have Special Counsel on mind these days."
114. For the foregoing reasons, there is probable cause to believe that the Target
Account contains evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses.
BACKGROUND CONCERNING APPLE
115. In my training and experience, I have learned that Apple provides a variety of on-
line services, including electronic mail ("email") access, to the public. Apple allows subscribers
to obtain email accounts at the domain name me.com, like the Target Account. Subscribers obtain
an account by registering with Apple. During the registration process, Apple asks subscribers to
provide basic personal information. Therefore, the computers of Apple are likely to contain stored
electronic communications (including retrieved and unretrieved email for Apple subscribers and
information concerning subscribers and their use of Apple services, such as account access
information, email transaction information, and account application information. In my training
and experience, such information may constitute evidence of the crimes under investigation
because the information can be used to identify the account's user or users.
provide certain personal identifying· information when registering for an email account. Such
-31-
IP address information can help to identify which computers or other devices were.used to access
the email account.
.
-32-
119. This application seeks a wanant to search all responsive records and information
under the control of Apple, a provider subject to the jurisdiction of this court, regardless of where
Apple has chosen to store such information. The government intends to require the disclosure
record, or other information is within Apple's possession, custody, or control, regardless of
the United States.
-33-
I
f
I
Ir1
I•
11
under investigation. This geographic and timeline information may tend to either inculpate or I
I·,I
ii
II
I
insight into the email account owner's state of mind as it relates to the offense under investigation. I
II

I
CONCLUSION
-34-
I
I
Ii"
II
I
~
REQUEST FOR SEALING I
I
124. I further request that the Court order that all papers in supp01t of this application,
i
including the affidavit and search warrant, be scaled until further order of the Court. These 1
I
i
~
atrickJ.Myers
Special Agent
Subscribed and sworn to before me on this .,,2}_~ of September, 2018.

hf/~
-35-
II
!
i
II
ATTACHMENT A
I
1
!~
This warrant applies to information associated with the following acconnts, which are
stored at premises owned, maintained, controlled, or operated by Apple, Inc. ("Apple"), a company
headquartered in Cupe1tino, California:

I
~j
ij"
I
11
II
"
-1-
ATTACHMENTB
custody, or control of the Apple, Inc. (hereinafter "the Provider"), regardless of whether such
infonnation is stored, held or maintained inside or outside of the United States, and including
Provider, or has been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the
Provider is required to disclose the following information to the government for each account or
identifier listed in Attachment A:

include full name, physical address, telephone nnmbers and other identifiers,
and files;
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
names associated with the subscriber, methods of connecting;
-2-
f. All search history or web history;
g. All records indicating the services available to subscribers of the accounts;
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
1. All cookies, including third-party cookies, associated with the user;
j. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMS!"), or International Mobile Equipment Identities
("IMEI").
period from June I, 2016, to December 31, 2017, including:
-3-
Assange, Randy Credico,
or any individual associated with the-Trump Campaign;
independent expenditure, or disbursement for an electionee1ing communication;
principals;
f Communications, records, documents, and other files that reveal efforts by any
any foreign government, foreign officials~ foreign entities, foreign persons, or
foreign principals;
h. Evidence indicating the account user's slate of mind as it relates to the crimes under
investigation;
-4-
I. The identity of any non-U.S. person(s)--including records that help reveal the
whereabouts of the person(s)--who made any expenditure, independent
m. The identity of any person(s)--including records that help reveal the whereabouts
principals.
n. Passwords and encryption keys, and other access inf01mation that may be necessary
in subsection II.a.
-5-
-6-
i
I
I
I
FOR THE DISTRICT OF COLUMBIA I
11
I
Ii

INFORMATION ASSOCIATED WITH ONE
Case: 1:18-sc-02922
I
I
CONTROLLED BY APPLE Description: Search & Seizure Warrant

TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705{b)
disclosure, the proposed Order would direct Apple, Inc. ("Apple"), an electronic communication
.'
and/or remote computing services provider headquartered in Cupertino, California, not to notify
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the
existence or content of the Warrant for a period of one year or until further order of the Court.
1. The Court has the inherent power to seal court filings when .appropriate,
'\
'
the Warrant. See Washington Postv. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991).
"district court of the United States .. , that - has jurisdiction over the offense being investigated."
,occurred within Washington, D.C. See 18 U.S.C. § 3237.
3. Further, the Court has authority to require non-disclosure of the W arraot under 18
U.S.C. § 2705(b). Apple provides an "electronic communications service," as defined in 18
Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712, governs how Apple may be
compelled to supply communications aod other records using a subpoena, court order, or search
warrant. Specifically, Section 27~3(c)(2) authorizes the Government to obtain certain basic
"no.n-content" information using a court order, and Section 2703(a)-(b)(l)(A) allows the
J
Government to obtain contents of communications using a search warraot. See 18 U.S.C. § 2703.
4. The SCA does not set forth aoy obligation for providers to notify subscribers about
subpoenas, court orders, or search warraots under Section 2703. However, many have voluntarily
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such ·

entity acting under section 2703 ... may apply to a court for ao order commaoding
whom a warrant, subpoena, or court order is directed, for such period· as the court
deems appropriate, not to notify aoy other person of the existence of the warraot,
subpoena, or court order. The court shall enter such ao order if it determines that
(1) endaogering the life or physical safety of ao individual;
1
Section 2705(b) contains additional requirements for legal process obtained pursuaotto 18 U.S.C.
§ 2703(b)(I)(B), but the Govenunent does not seek to use the proposed Order for aoy legal process
,under that provislon.
2

18 U .S.C. § 2705(b ). The United States District Court for the District of Cohunbia has made clear
'
government makes the required showing under§ 2705(b), the court is required to
command Apple not to notify any other person (except attorneys for Apple for the purpose of
order of the Court.
6. The Federal Bureau ofinvestigation ("FBI") is investigating violations of 18 U.S.C.
felony), 18 U.S.C. § 371 '(conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent),
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U,S,C. § 1343 (wire fraud),
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S,C. § 611 et seq.
Offenses"), in connection with efforts to compromise the networks of the Democratic National '
Convention ("DNC"), the Democratic Congressional Campaign Committee ("DCCC"), and the
3
email accounts of U.S. persons, followed by the public release of stolen materials through various
outlets.
7. In this matter, the government requests that the Warrant be sealed until further order ·
of the Court and that Apple and its employees be directed not to notify any other person of the ·
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such ar1 order is appropriate
because the Warrarit relates to an ongoing criminal investigation, the scope arid nature of which is
neither public nor known to the targets of the investigation, and its disclosure may alert these
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrarit and
related papers may also alert the targets to the scope of information known to the FBI. Once alerted
to this information, potential targets would be immediately prompted to destroy or conceal
8. Given the complex arid sensitive nature of the criminal activity under.investigation,
and \tlso given that the criminal scheme may be ongoing, the, Government anticipates that this
longer needed, the Government will notify the Court and seek appropriate relief,
Warrant will seriously jeopardize the investigation, including by giving the targets fill opportunity
to flee from prosecution, destroy or tamper with evidence, arid intimidate witnesses. See 18 U.S.C.
4
compelling governmental interest in confidentiality to justify the governmenfs sealing request.
I 0. Based on prior dealings with Apple, the United States is aware that, absent a court
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, Apple
may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic
communications for a certain account, notify the subscriber or customer of the existence of the
warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the governmentrespectfully requests that the
above-captioned watrant, the application and affidavit in support thereof, and all attachments
thereto'and other related materials be placed under seal, and furthermore, iliat the Court command
Apple not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or

Special Counsel
Dated: 'J/2...7: /\ '(> By:'

Ky!
The. p al Counsel's Office
(202) 616-3812
5
ATTACHMENT A
This warrant applies to information associated with the Google accounts registered to the
-1-

for the

(Briefly describe the property to be searched ) Case: 1: 19-sw-00057
or identify the p erson by name and address) ) Assigned To : Chief Judge Howell, Beryl A.
VARIOUS ELECTRONIC DEVICES BELONGING TO ) Assign. Date: 2/13/2019
ROGER J. STONE, JR. ) Description : Search and Seizure Warrant
)

of the following person or property located in the District of Columbia
See Attachment A.
described above, and that such search will reveal (identify the p erson or describe the prop erty to be seized):
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before February 27, 2019 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m.
property was taken.
0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U .S.C.
property, will be searched or seized (check the approp riate box)
City and state: Washington, DC Hon. Beryl A. Kowell, Ghief U.S. District Judge
Return
Certification
designated judge.
Date:

ATTACHMENT A
The following devices provided to the FBI by currently in the District of
Columbia:
ATTACHMENT B
Items to be seized from the Subject Devices
1. The items to be seized are fruits, evidence, information relating to, contraband, or
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code 1512(b){l) (witness tampering), those violations involving Roger Stone, for
the time period June 2015 to the present, including:
a. Documents and communications that discuss or are related to WikiLeaks, Julian
Assange, and/or Russian interference in the 2016 U.S. presidential election;
b. Documents reflecting communications between Stone and Jerome Corsi;
c. Documents reflecting communications between Stone and Randy Credico;
d. Documents reflecting communications between Stone and members of the Trump
Campaign or Trump Campaign associates, including Steve Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump;
e. Documents related to or discussing the U.S. House of Representatives Permanent
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or
the Federal Bureau of Investigation;
f. Records and information relating to the e-mail accoun
a ;
g. Records and information relating to the WhatsApp account associated with
telephone number
h. Records and information relating to the Signal account associated with telephone
number
Page 1 of 3
1. Records and information relating to the Wicla account associated with telephone
number ;
j. Any computers, media storage devices, tablets/iPads, cellular telephones,
smartphones, personal data assistant devices, or other electronic devices used to
commit the violations described above or to store records or documents described
above;
k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
reference materials, in whatever form;
l. Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form;
2. For any computer or storage medium whose seizure is otherwise authorized by this
warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
entries, configuration files, saved usernames and passwords, documents, browsing
history, user profiles, email, email contacts, "chat," instant messaging logs,
photographs, and correspondence;
b. evidence of software that would allow others to control the COMPUTER, such as
viruses, Trojan horses, and other forms of malicious software, as well as evidence
of the presence or absence of security software designed to detect malicious
software;
Page 2 of 3
c. evidence of the lack of such malicious software;
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
under investigation and to the computer user;
e. evidence indicating the computer user' s state of mind as it relates to the crime under
investigation;
f. evidence of the attachment to the COMPUTER of other storage devices or similar
containers for electronic evidence;
g. evidence of counter-forensic programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h. evidence of the times the COMPUTER was used;
1. passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;
J. documentation and manuals that may be necessary to access the COMPUTER or
to conduct a forensic examination of the COMPUTER;
k. records of or information about Internet Protocol addresses used by the
COMPUTER;
l. records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookmarked" or "favorite"
web pages, search terms that the user entered into any Internet search engine, and
records of user-typed web addresses;
m. contextual information necessary to understand the evidence described in this
attachment.
Page 3 of3
AO 106 ( Rev. 04/1 0) Applicat ion for a Search Warrant
UNITED STATES DISTRICT COURT ;:r_-~

for the
fEB 13 Wt9
r.:eri<, tJ.~ ._ Distnct u uar,r<!'ll!)!Ci
Cnurts t{'(I' m-e District of"Cn! w ~
In the Matter of the Search of ) Case: 1 :19-sw-00057
or identify the person by name and address) ) Assigned To : Chief Judge Howell, Beryl A .
VARIOUS ELECTRONIC DEVICES BELONGING TO ) Assign. Date : 2/13/2019
ROGER J. STONE , JR. ) Description: Search and Seizure Warrant
)

See Attachment A
located in the - -- - -- - -
District of _ __ __
Columbia
_ ;.c...;...;.- '--- ---
person or describe the property to be seized) :
See Attachment 8
rJ property designed for use, intended for use, or used in committing a crime;

18 U.S.C. § 1505 Obstruction of Proceeding
18 U.S.C. § 1512 Witness Tampering
18 U.S.C. § 1001 False Statements

& ., A~ Applicant's signature
Curtis Heide, Special Agent, FBI

Faron Zelinsky (ASC)
Date: 02/13/2019

=~===:~~~~~~~~- ~~~- :;===1== ~ = --~~-=-·· a,• .•• • ·.a . .• •. · - · ·• • . .. • · ·- - - - ·· -
IN THE MATTER OF THE SEARCH OF Case: 1: 19-sw-00057

VARIOUS ELECTRONIC DEVICES Assigned To : Chief Judge Howell, Beryl A.
BELONGING TO ROGER J. STONE, JR. Assign. Date : 2/13/2019
1. I make this affidavit in support of an application for a search warrant for the
following devices (the "Subject Devices") associated with Roger J. Stone, Jr. ("Roger Stone"),
described below and further in Attachment A, currently located in the District of Columbia:
a.
b.
c.
2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have
been since 2006. In the course of my duties, I have been responsible for investigating federal
crimes and national security matters involving both counterintelligence and issues related to
cybersecurity.
3. I am currently involved in the investigation into Roger J. Stone, Jr., ("Roger Stone")
and others known and unknown to the government, for the commission of unlawful activities in
the District of Columbia, and elsewhere, including, but not limited to: (i) obstruction of
proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in
Page 1 of 41
violation of Title 18, United States Code, Section l 001 and (iii) witness tampering, in violation of
Title 18, United States Code l 512(b)(1) (collectively the "Specified Federal Offenses").
4. On January 24, 2019, a Grand Jury in the District of Columbia indicted Roger Stone
on seven counts: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section
1505 (Count 1); (ii) false statements, in violation of Title 18, United States Code, Section 1001
(Counts 2-6) and; (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(l)
(Count 7). See United States v. Roger Jason Stone, Jr., 19-cr-18-ABJ, Dkt. 1. On January 29,
2019, Roger Stone pied not guilty to the charges before Magistrate Judge Deborah A. Robinson.
5. I have personally participated in this investigation and am aware of the facts
contained herein based on my own investigation, as well as my review of documents, records, and
information provided to me by other law enforcement officers and technical experts.
6. This affidavit is intended to show merely that there is sufficient probable cause for
the requested warrant and does not set forth all of my knowledge about this matter. Unless
specifically indicated, all conversations and statements in this affidavit are related in substance
and part. Where I assert that an event took place on a particular date, I am asserting that it took
place on or about the date specified.
7. For the reasons set forth in this Affidavit, there is probable cause to believe that one
or more of the Specified Federal Offenses have been committed by Roger Stone and others known
and unknown to the government. Further, there is probable cause to believe that each of the Subject
Devices have been used to facilitate the commission of one or more of the Specified Federal
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and
instrumentalities of violations of the Specified Federal Offense may be present in each of the
Subject Devices, as described further in Attachment B.
Page 2 of 41
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S . politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of
Donald J. Trump ("Trump Campaign") until in or around August 2015, and subsequently
maintained regular contact with and publicly supported the Trump Campaign through the 2016
election.
9. Julian Assange is the founder and director of WikiLeaks, which is publicly
described as a non-profit organization that disseminates non-public information and classified
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
London, United Kingdom.
10. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly
with Stone throughout the campaign, including about the release of stolen documents by
WikiLeaks.
12. Based on the investigation to date, Randy Credico was a radio host who has known
Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent
Selection Committee on Intelligence ("HP SCI") on or about September 26, 2017, Stone described
Credico (without naming him) as an " intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by
Page 3 of 41
name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that Assange, had
'"[e]mails related to Hillary Clinton which are pending publication." '
13. Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gates, 1:l 7-cr-201 (D.D.C.).
14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief
executive officer of the Trump Campaign.
B. Hacking Activity During the 2016 Presidential Election
16. John Podesta is a U.S. citizen who served for years as a political consultant. During
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
1
In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.
Page 4 of 41
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation, through which an actor would have gained access to Podesta's email
account, allowing the actor to steal emails and documents from that account.
17. The Democratic National Committee ("DNC") and Democratic Congressional
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity
company CrowdStrike to investigate the intrusions and remediate.
18. On or about June 14, 2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdStrike
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
engage in extensive political and economic espionage for the benefit of the government of the
Russian Federation and are believed to be closely linked to the Russian government's powerful
and highly capable intelligence services."
19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia
returned an indictment against eleven Russian nationals, charging them with partaking in a
conspiracy to hack into, among other things, the email account of John Podesta, as well as the
Page 5 of 41
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: l 8-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
C. WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
20. As alleged in the Netyksho indictment, after successfully hacking the DNC and
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the stolen
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the
transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior DNC
officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
22. Beginning in or around October 2016, WikiLeaks began to release tens of
thousands of emails and documents stolen from Podesta's email account. Between on or about
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents.
D. Stone's Communications About WikiLeaks During the Campaign
23. In April 2018 interviews with the Special Counsel's Office, Richard Gates stated
that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by
Page 6 of 41
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
WikiLeaks and Stone's prediction of the release .
24. According to Gates, Manafort directed Gates to contact Stone about any additional
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel' s Office in or
around October 2018, Gates recalled that at one point during the campaign he was with then-
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.
25. Emails recovered through a court-authorized search of Stone's email account
show that shortly after the July 22, 2016 release of stolen DNC emails
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to
obtain other emails damaging to the Clinton Campaign:
a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject
line, "Get to Assange." The body of the message read, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WikiLeaks emails .. . they
deal with Foundation, allegedly." On or about the same day, Corsi forwarded
2
A search of was authorized on or about September 11, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-661 (D.D.C. Sept. 11, 2017). A
second search of was authorized on or about August 3, 2018 by the U.S.
District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 2703(d) for records connected to Case No. I: 18-sc-2911 (D.D.C. Sept.
26, 2018). Records provided in response by Microsoft Corporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
Page 7 of 41
Stone' s email to who lived in the United Kingdom and who was a
supporter of the Trump Campaign.
b. On or about July 31, 2016, Stone emailed Corsi with the subject line, "Call me
MON." The body of the email read in part that "should see Assange."
c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he
was currently in Europe and planned to return in mid-August. Corsi stated, "Word
is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct.
Impact planned to be very damaging." In a law enforcement interview, Corsi stated
that the phrase "friend in embassy" referred to Assange. Corsi added in the same
email, "Time to let more than Podesta to be exposed as in bed w enemy if they are
not ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
26. According to recorded public statements recovered by the FBI, starting in early
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated
statements about information he claimed to have learned from Assange:
a. According to a public video posted to YouTube, on or about August 8, 2016, Stone
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
Page 8 of 41
During the interview, Stone stated that he was "in communication with Assange"
but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communications with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN television interview on or about August 18, 2016, Stone stated that he
had communicated with Assange through an "intermediary, somebody who is a
mutual friend."
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio
interview he did with Stone on or about August 23, 2016 during which the two
discussed Stone's prior claims to be in contact with Assange. At one point during
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
or have influence with Assange because I do not. . . . We have a mutual friend,
somebody we both trust and therefore I am a recipient of pretty good information."
27. In or around November 2018, , Stone
produced a series of text messages between Stone and Credico during the 2016 presidential
Page 9 of 41
campaign. 3 These text messages show that, beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeaks and Assange planned to
do. Emails recovered through a court-authorized search of Stone's email account
show additional written communications between Stone and Credico
about WikiLeaks in or around September 2016.
a. On or about August 19, 2016, Credi co sent a text message to Stone that read in part,
"I'm going to have Julian Assange on my show next Thursday." On or about
August 21 , 2016, Credi co sent another text message to Stone, writing in part, "I
have Julian Assange on Thursday so I' m completely tied up on that day."
b. On or about August 25, 20 16, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Assange talk[ed] about you last night." Stone replied and asked what
Assange said, to which Credico responded, "He didn't say anything bad we were
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was " in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
am e-mailing u a request to pass on to assange." Credico responded "Ok," and
3
As discussed below, Stone had previously released some of these text messages to members of
the media, who had written about them and published them in part.
Page 10 of 41
added in a later text message, "Just remember do not name me as your connection
to Assange you had one before that you referred to."
e. Later on or about September 18, 2016, Stone emailed Credi co an article with
allegations against then-candidate Clinton related to her service as Secretary of
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
article] or confirm this narrative."
f. On or about September 19, 2016, Stone texted Credico again, writing, "Pass my
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.
g. On or about September 30, 2016, Credico sent Stone via text message a photograph
of Credico standing outside the Ecuadorian Embassy in London where Assange
was located.
h. On or about October l, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday . . . now pretend u don't know me ...
Hillary's campaign will die this week." In the days preceding these messages, the
press had reported that Assange planned to make a public announcement on or
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary
of the founding of WikiLeaks.
Page 11 of 41
1. On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
and a link to an article at the website http://heatst.com/politics/october-surprise-
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to-
security-concerns. Credico responded to Stone, "head fake."
J. On or about Monday, October 3, 2016, Stone wrote Credico and asked, "Did
Assange back off." Credico initially responded, "I can't tal[k] about it." After
further exchanges with Stone, Credico responded, "I think it[']s on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
this line ... Please leave my name out of it."
28. Emails and text messages recovered by the FBI show that, in or around October
2016, Stone made statements about Assange' s future releases that were similar to prior statements
made by Credico to him. For example:
a. In a court-authorized search of Stone's email account the
FBI recovered an email from Stone to sent on or about October 3, 2016,
which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
b. In a court-authorized search of the FBI also recovered an
email exchange from on or about October 3, 2016 between Stone and a reporter
who had connections to Bannon. In the exchange, the reporter asked, "Assange -
4
A search of was authorized on or about October 17, 2017 by the U.S.
District Court for the District of Columbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
District Court for the District of Columbia. Case No. 1: 18-sc-2583 (D.D.C. Aug. 3, 2018).
Page 12 of 41
what' s he got? Hope it's good." Stone responded, " It is. I'd tell Bannon but he
doesn't call me back."
c. On or about October 4, 2016, Assange held a press conference but did not release
any new materials pertaining to the Clinton Campaign. In a court-authorized search
o , the FBI recovered an email exchange between Stone and
Steve Bannon on or about October 4, 2016 that occurred after the press conference.
In the exchange, Bannon asked, " What was that this morning???", referring to
Assange's press conference. Stone responded, "Fear. Serious security concern. He
thinks they are going to kill him and the London police are standing do[wn].
However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account, 5 the FBI recovered text
messages between Stone an from on or about October 4, 2016. In one text
message asked Stone if he had "hear[d] anymore from London." Stone
replied, " Yes - want to talk on a secure line - got Whatsapp." In an interview with
the Special Counsel ' s Office in or around May 2018 confirmed that he and
Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from
Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read "well done." Similarly,
5
A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No. l: 18-sc-662 (D.D.C. Mar. 14, 2018). The
records for Stone's iCloud account contained some, but not all, of Stone's communications from
the campaign period.
Page 13 of 41
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release,
Stone said, "I told you this was coming."
E. Stone's Communications with the House Permanent Select Committee on Intelligence
30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating
allegations of Russian interference in the 2016 presidential election and possible links to
individuals associated with political campaigns. 6 During a public HPSCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone' s prior public
statements about having communications with Assange (particularly those from August 2016)
were of interest to the committee.
31. In or around May 2017, HP SCI sent a letter requesting that Stone voluntarily appear
before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was
recovered by the FBI from a court-authorized search of Stone' s email account
[email protected]). The letter requested Stone produce:
Any documents, records, electronically stored information

including e-mail, communication, recordings, data and tangible
things (including, but not limited to, graphs, charts, photographs,
images and other documents) regardless of form, other than those
widely available (e.g., newspaper articles) that reasonably could
lead to the discovery of any facts within the investigation's publicly-
announced parameters.
32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and
stated that "Mr. Stone has no documents, records, or electronically stored information, regardless
of form, other than those widely available that reasonably could lead to the discovery of any facts
6
On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
on Intelligence ("SSCI") announced the committee would conduct an inquiry that would
investigate, among other things, any intelligence regarding links between Russia and individuals
associated with political campaigns, as well as Russian cyber activity and other "active measures"
directed against the United States in connection with the 2016 election.
Page 14 of 41
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone' s email account .
F. Stone's Testimony Before HPSCI
33. On or about September 26, 2017, Stone provided HPSCI with an "opening
statement" that his counsel requested be included as part of the record of proceedings before
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,7 Stone
stated, "These hearings are largely based on a yet unproven allegation that the Russian state is
responsible for the hacking of the DNC and John Podesta and the transfer of that information to
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony in a closed session
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Special Counsel' s Office from HPSCI in or around
December 2018. Stone appeared before HP SCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearing, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
Stone 's Testimony About Documents He Possessed Related to WikiLeaks
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document
7
On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Stone's interview with HPSCI, as well as any written submissions and/or correspondence from
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone' s written opening statement, and various
correspondence from Stone' s counsel to members ofHPSCI.
Page 15 of 41
request and whether Stone had any documents or written communications that discussed Julian
Assange, Russian interference, or other relevant documents:
Q: The committee wrote to you on May 9th requesting no later

than May 22 any documents, records, electronically stored
information, including email communication, recordings,
data, and other tangible things relevant to our investigation.
You wrote back through counsel that you had no documents,
records, or electronically stored information regardless of
form responsive to our requests. Was that a false statement?
A: That is not a false statement. That's what -- I believe that to

be true.
[ ...]
Q: So you have no emails to anyone concerning the allegations

of hacked documents or your conversations with the
Guccifer 2[.0] or any discussions you have had with third
parties about Julian Assange? You have no emails, no texts,
no documents whatsoever, any kind of that nature?
A: That is correct. Not to my knowledge. I think we met, again,

the precise criteria of your request, and we complied. Again,
if you have a more specific request, I'm happy to go back and
look. ...
Q: I just want to ask you under oath -
A: We did an extensive search consistent with the direction of

my attorneys, and we found nothing that met the criteria that
you asked for.
Q: I just want to be certain because you are under oath, where

your letter was not under oath, that you have no documents,
no emails, no texts, no tweets that refer to Julian Assange or
Guccifer 2[.0] or Paul Manafort or the allegations
concerning Russian connections with the campaign. You
have had no discussions in any written form. You've written
no documents yourself.
A: In connection with Russian collusion, consistent with your

exact and precise request, yes.
36. In fact, and as described above, Stone had sent and received numerous emails and
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and
Page 16 of 41
WikiLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
(including ) and his iCloud account show that,
at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017.8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016 that read in part, "Get to Assange [a]t
Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that "should
see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016
that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
load every week going forward."
Stone's Testimony About His Early August 2016 Statements
37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to
explain his statements in early August 2016 about being in contact with Assange. Stone was
specifically asked about his statement on or about August 8, 2016 that "I've actually
8
The warrant for Stone's email account was obtained on or about
September 11, 2017 and executed shortly thereafter. Records provided in or around September
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account was obtained on or about October 17, 2017 and executed
shortly thereafter. The warrant for Stone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
Page 17 of 41
communicated with Assange," as well as his statement on or about August 12, 2016 that he was
"in communication with Assange" but was "not at liberty to discuss what I have."
38. Stone testified that these public references to having a means of contacting
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a "go-
between, as an intermediary, as a mutual friend" of Assange. Stone declined to tell HPSCI the
name of this "intermediary," but he provided a description in his testimony that was largely
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
39. In fact, documents recovered during the investigation (including those obtained via
search warrant returns show that Stone did not begin communicating
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9- approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after his August 12, 2016 statements of being " in communication with
Assange" and "not at liberty to discuss what I have."
40. When interviewed by the FBI, Credico stated that the first time he ever spoke with
°
Assange was on or about August 25, 2016, when Credico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between him and another
9
As described above, on or about August 19, 2016, Credi co informed Stone by text message that
Credi co intended to interview Assange the following week. On or about August 25, 2016, Credi co
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."
1
°Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews
Page 18 of 41
member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
information about himself, apparently as a means of introduction.
41. The FBI has not identified any communications between Stone and Credico from
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
42. In contrast, and as described above, the FBI has identified written communications
prior to August 8, 2016 in which Stone directed Corsi-not Credico--to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WikiLeaks emails .. . they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico--sent an email to Stone in which Corsi
wrote that " [w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other
source for information from WikiLeaks. Similarly, Stone also never disclosed his written
communications with Corsi to HPSCI when answering HPSCI' s questioning about the August 8,
2016 and August 12, 2016 statements about being in communication with Assange.
Stone 's Testimony About Communications to Assange
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to
communicate anything else to Assange?" Stone responded, "I did not." Stone was then asked,
"Did you ask [the intermediary] to do anything on your own behalf?" Stone responded, "I did
not."
Page 19 of 41
44. In fact, starting on or about September 18, 2016, Stone directed Credi co to pass on
a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages obtained on or about
September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
u a request to pass on to Assange." On or about the same day, Stone emailed
Credico an article with allegations against then-candidate Clinton related to her
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August IO to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
was obtained through a search of Stone's email account .
b. According to text messages obtained on or about
September 19, 2016, Stone texted Credico again, writing " Pass my message . .. to
Assange." Credico responded, "I did." An email obtained from the account
shows that on or about September 20, 2016, Credico
forwarded the request to an attorney who had the ability to contact Assange;
Credico blind copied Stone on the same email.
Stone's Testimony About Written Communications with Credico
45. During his HPSCI testimony, Stone was asked repeatedly about his
communications with the person he identified as his intermediary. Stone stated that he had never
communicated with his intermediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intermediary telephonically:
Q: [H]ow did you communicate the intermediary?
A: Over the phone.
Page 20 of 41
Q: And did you have any other means of communicating with

the intermediary?
A: No.
Q: No text messages, no - none of the list, right?
A: No.
Later during his testimony, Stone again denied ever communicating with his intermediary in
writing:
Q: So you never communicated with your intermediary in

writing in any way?
A: No.
Q: Never emailed him or texted him?
A: He's not an email guy.
Q: So all your conversations with him were in person or over

the phone.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his intermediary)
engaged in frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
engaged in dozens of communications by email or text message in which they discussed
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
47. Written communications between Stone and Credico continued up until Stone's
HPSCI testimony and afterwards. For example, on or about September 26, 2017- the day that
Stone testified before HPSCI and denied having ever sent or received emails or text messages from
his identified intermediary-Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone denied
Page 21 of 41
ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or around September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you [] said you have a back-channel way back a month before I had Assange on
my show ... I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together .. . so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this emai l was obtained through
a search of Stone's email accoun ).
Stone 's Testimony About Communications with the Trump Campaign
49. During his HPSCI testimony, Stone was asked, "[d]id you discuss your
conversations with the intermediary with anyone involved in the Trump campaign?" Stone
answered, "I did not." As described above, Stone spoke to multiple individuals involved in the
Trump campaign about what he claimed to have learned from his intermediary to Assange,
including the following:
a. As described above, Gates confirmed to investigators that Stone spoke with senior
Trump Campaign officials by telephone to inform them about materials possessed
by Assange and the timing of future releases.
b. According to text messages , on or about October
3, 2016, Stone wrote to , " Spoke to my friend in London last night. The
payload is still coming."
Page 22 of 41
c. As described above, on or about October 4, 2016, after receiving information from
Credico about the delay in WikiLeaks's release of stolen materials, Stone emailed
Bannon that Assange had a " [s]erious security concern" but would release "a load
every week going forward."
G. Stone's Attempts to Influence Credico Regarding HPSCI and the FBI
50. According to an email recovered through a court-authorized search of Stone' s email
accoun on or about October 19, 2017, Stone sent Credico an excerpt of
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his " intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged
effort to prevent Credico from contradicting Stone's false statements to HPSCI.
51. In or around November 2017, Credico received a request from HP SCI to testify
voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted
repeatedly with Stone.
a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to
see him. Stone responded, " ' Stonewall it. Plead the fifth . Anything to save the
plan' . .. Richard Nixon." (A copy of these text messages was recovered through
a court-authorized search of Stone's iCloud account). On or about November 20,
2017, Credico informed HPSCI that he declined HPSCI's request for a voluntary
interview.
Page 23 of 41
b. On or about November 21, 2017, Credico texted Stone, "I was told that the house
committee lawyer told my lawyer that I will be getting a subpoena." Stone
responded, "That was the point at which your lawyers should have told them you
would assert your 5th Amendment rights if compelled to appear." (A copy of these
text messages was recovered through a court-authorized search of Stone's iCloud
account).
c. On or about November 28, 2017, Credico received a subpoena compelling his
testimony before HPSCL Credico informed Stone of the subpoena.
d. According to emails recovered from Stone' s email account
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, "Are you sure you want to make something out of this now? Why
not wait to see what [Credico] does? You may be defending yourself too much -
raising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
let's hold a day."
e. According to text messages recovered from Stone's iCloud account, on multiple
occasions, starting on or about November 17, 2017, Stone and Credico discussed
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part
II, who falsely claims not to know critical information before a congressional
committee that he does in fact know. On or about December 1, 2017, Stone told
Credico in a text message to "Start practicing your Pentagele." When interviewed
by the FBI, Credico confirmed that he understood Stone's references to Frank
Pentangeli to be Stone's way of suggesting Credico withhold relevant information
Page 24 of 41
from investigators.
f. On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool. " Later that day, Credico texted Stone, " You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you' re a fool. Because of tromp I could never get away with a certain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you' re stupid enough to testify." (A copy of these text
messages was recovered through a court-authorized search of Stone's iCloud
account).
52. On or about December 12, 2017, Credico informed HP SCI that he intended to assert
his Fifth Amendment privilege against self-incrimination if required to appear by subpoena.
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
53. Following Credico's invocation of his Fifth Amendment privilege not to testify
before HPSCI, Stone and Credico continued to have discussions about the various investigations
into Russian interference in the 2016 election and what information Credico would provide to
investigators. During these conversations, Stone repeatedly made aggressive statements intended
to prevent Credico from cooperating with the investigations. For example:
a. On or about December 24, 2017, Credico texted Stone, "I met assange for f[i]rst
time this yea[r] sept 7 .. . docs prove that ... You should be honest w fbi . . . there
was no back channel ... be honest." Stone replied approximately two minutes
later, "I'm not talking to the FBI and if your smart you won't either." (A copy of
Page 25 of 41
these text messages was recovered through a court-authorized search of Stone's
iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. You
are a stoolie. You backstab your friends- run your mouth my lawyers are dying
Rip you to shreds." Stone also said he would "take that dog away from you,"
referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
exchange was recovered through a court-authorized search of Stone's email
accoun ).
c. On or about May 21, 2018, Credico wrote in an email to Stone, "You should have
just been honest with the house Intel committee . . . you've opened yourself up to
perjury charges like an idiot." Stone responded, " You are so full of [expletive].
You got nothing. Keep running your mouth and I'll file a bar complaint against
your friend [the attorney who had the ability to contact the head of Assange]." (A
copy of this email exchange was recovered through a court-authorized search of
Stone's email accou ). Credico believed Stone knew that
Credico was sensitive to having this friend 's name publicly disclosed.
H. Missing Electronic Communications and Stone's Use of Encrypted Communications
54. As described above, the government has recovered the content of many of Stone's
electronic communications from summer and fall of 2016 (during the period of the U.S.
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
Page 26 of 41
numerous other relevant electronic communications, the content of which it has not yet been able
to recover.
55. As described above, during his HPSCI testimony, Stone falsely denied having
emailed or exchanged text messages with his " intermediary" (later identified by Stone as Randy
Credico). In fact, emails and text messages recovered in this investigation show the two
communicated frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI' s inquiry, but Stone
never disclosed them.
56. In addition to these emails and text messages in the FBI's possession, the FBI has
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017, and
they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
thousands of text messages (including over 1,500 text messages between the period November
2016 and December 2017) the substance of which the government to date has not recovered or
reviewed. The government has only recently obtained text messages between Stone and Credico
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
Page 27 of 41
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations. As discussed further below, the
government has reason to believe that these messages may be located on the Subject Devices.
57. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed
that Stone has used encrypted applications to communicate with others. Similarly, records
obtained in this investigation indicate Stone uses multiple applications designed for encrypted
communication, including (a) WhatsApp, 11 (b) Signal, 12 (c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
11
According to open sources, WhatsApp is an application that allows the user to send text
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and
stores its messages separately from those text messages used on a mobile device' s default message
application.
12
According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender' s and the receivers' devices.
13
According to open sources, Wickr is an instant messaging application that allows users to
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmitted through the network.
14
According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-
side encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
Page 28 of 41
a. According to records from Stone' s iCloud account, a copy of the WhatsApp
application was downloaded to an iPhone registered to Stone on or about October
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an
email to that they "talk on a secure line" and proposed using WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal application
was downloaded to an iPhone registered to Stone on or about August 18, 2016.
Additionally, text messages recovered from Stone' s iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact
Julian Assange a link to download the Signal application. 15 Approximately fifteen
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
my number." The attorney responded, "I'll call you."
c. According to records from Stone's iCloud account, a copy of the ProtonMail
application was downloaded to an iPad registered to Stone on or about August 18,
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
58. Based on my training and experience, electronic communications using encrypted
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
15
This attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September 20, 2016 to pass along Stone's request to Assange for emails connected to the
allegations against then-candidate Clinton related to her service as Secretary of State.
Page 29 of 41
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
communications, such as call logs and contact lists.
59. The FBI continues to seek evidence of Stone's communications and contacts during
the period of the 2016 U.S. presidential election and through the present. The FBI believes these
communications may contain evidence of additional communications concerning Assange,
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such
communications could constitute additional evidence of Stone's efforts to obstruct HPSCI's
investigation by showing additional contacts and communications about Assange and WikiLeaks
that Stone failed to disclose.
I. The Subject Devices
60. In or around November 2018, media reports began to publish excerpts of text
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
of these text messages subsequently were obtained from Stone ). 16
According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements and described further below, your affiant believes the cell phone referenced in the
article to be the iPhone Ss. 17
16
See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger-
stone-wikileaks-randy-credico-mueller.
a, Stone produced some text messages between Credico and

him; the latest-in-time text message produced by Stone occurred on or about November 14, 2016.
Page 30 of 41
61. On or about February 11, 2019, investigators, with the consent of Roger Stone's
attorneys, spoke with , a certified forensic examiner who stated he had been retained
by Roger Stone's attorneys. had been authorized by Stone's attorneys to provide the
Subject Devices to the FBI, although in providing the devices, Stone did not consent to their search.
Stillman gave the Agents three devices: the iPhone 5s, the iPhone 7, and the external hard drive.
62. produced documentation to investigators indicating that the iPhone 5s was
associated with the phone number ending in Stone's cellular number as discussed above.
The documentation also indicated that had imaged the iPhone 5s on or about November
10, 2018, several days before the article discussed above where Stone claimed to have released
newly-uncovered messages with Credico. Toll records produced by AT&T pursuant to subpoena
indicate that Stone used an iPhone 5s from at least on or about January 1, 20 15 through on or about
November 14, 2016. Therefore, it appears that the iPhone 5s was the device Stone was using
through November 14, 2016 to communicate with individuals including Credico and Corsi.
63. also produced documentation to investigators that the iPhone 7 he
provided to investigators was associated with the same Stone phone number ending in . As
discussed above, toll records produced by AT&T pursuant to subpoena indicate that Stone used an
iPhone 7 from at least on or about November 14, 2016 through on or about February 25, 2018. As
described above, Stone communicated extensively with Credico during this time. Toll records
also indicate Stone continued to communicate with Corsi during this time period using the x3034
number.
The government believes copies of later-in-time text messages from late 2016 and early 2017 could
be located on another device, such as the iPhone 7, or on backup storage media.
Page 31 of 41
64. further told investigators that the external hard drive contained forensic
images of Stone' s computers. stated that the hard drive contained backups created by a
separate company in September 2017 from Stone' s computers in both Florida and New York.
According to the backups were created as "clone copies," which are copies of Stone' s
computer systems. also indicated that the drive contained a separate image
created in March 2018 of Stone' s computer in Florida, as well as backup images of the iPhones
discussed above. As explained further herein, there is reason to believe that these images contain
communications made by Stone with Credico, Corsi, and others made during the relevant time
period, even if such communications had previously been deleted.
COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS
65. As described herein and in Attachment B, this application seeks permission to
search the Subject Devices. One form in which the records might be found is data stored on a
device 's hard drive. Thus, the warrants applied for would authorize the search of electronic storage
media.
66. Probable cause. I submit that there is probable cause to believe those records will
be stored on the Subject Devices (the term "computer" below refers to Subject Devices), for at
least the following reasons:
a. Based on my knowledge, training, and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
Page 32 of 41
computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data.
b. Therefore, deleted files, or remnants of deleted files, may reside in free space or
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer' s operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
c. Wholly apart from user-generated files, computer storage media- in particular,
computers' internal hard drives--contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file system
data structures, and virtual memory "swap" or paging files. Computer users
typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or "cache."
67. Forensic evidence. As further described in Attachment B, this application seeks
permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how computers
were used, the purpose of their use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence will be on the Subject Devices because:
Page 33 of 41
a. Data on the storage medium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file) . Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
programs, and chat programs store configuration information on the storage
medium that can reveal information such as online nicknames and passwords.
Operating systems can record additional information, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. As explained herein, information stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the criminal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent ·
from further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and
movies, transactional information, records of session times and durations, internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for " indicia of occupancy" while executing a
search warrant at a residence. The existence or absence of anti-virus, spyware, and
Page 34 of 41
malware detection programs may indicate whether the computer was remotely
accessed, thus inculpating or exculpating the computer owner. Further, computer
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains information that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
accessed networks and the internet. Such information allows investigators to
understand the chronological context of computer or electronic storage media
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media ( e.g., a thumb drive).
The geographic and timeline information described herein may either inculpate or
exculpate the computer user. Last, information stored within a computer may
provide relevant insight into the computer user's state of mind as it relates to the
offense under investigation. For example, information within the computer may
indicate the owner's motive and intent to commit a crime (e.g., internet searches
indicating criminal planning), or consciousness of guilt (e.g., running a "wiping"
Page 35 of 41
program to destroy evidence on the computer or password protecting/encrypting
such evidence in an effort to conceal it from law enforcement).
c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries, logs, or other
forms of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process. While it is possible to specify in advance
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
on a computer is evidence may depend on other information stored on the computer
and the application of knowledge about how a computer behaves. Therefore,
contextual information necessary to understand other evidence also falls within the
scope of the warrant.
e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when, sometimes it is necessary to establish that a particular thing
is not present on a storage medium. For example, the presence or absence of
counter-forensic programs or anti-virus programs (and associated data) may be
relevant to establishing the user's intent.
Page 36 of 41
Review of the items described in Attachment B will be conducted pursuant to established
procedures designed to collect evidence in a manner consistent with professional responsibility
requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
team, in order to address potential privileges.
CONCLUSION
68. Based on the foregoing, your affiant respectfully requests that this Court issue a
search warrant for the Subject Devices, more particularly described in Attachment A authorizing
the seizure of the items described in Attachment B.
~ ~ d e, 4 . / ~
Special Agent
Sworn and subscribed before me on this / J ~ ay of February, 2019.

Page 37 of 41
ATIACHMENTA
The following devices provided to the FBI by , currently in the District of
Columbia:
Page 38 of 41
ATTACHMENT B
Items to be seized from the Subject Devices
proceeding); (ii) Title 18, United States Code, Section I 00 I (false statements); and (iii) Title 18,
United States Code 1512(b)(l) (witness tampering), those violations involving Roger Stone, for
Assange, and/or Russian interference in the 2016 U.S . presidential election;
f. Records and information relating to the e-mail accounts
and p
telephone number ;
Page 39 of 41
numbe
1. Records and information relating to the Wickr account associated with telephone
numbe
J. Any computers, media storage devices, tablets/iPads, cellular telephones,
above;
k. Records of personal and business activities relating to the operation and ownership
of the computer systems, such as telephone records, notes, notebooks, diaries, and
reference materials, in whatever form ;
I. Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever form ;
2. For all of the devices listed in Attachment A (hereinafter, "COMPUTER"):
a. evidence of who used, owned, or controlled the COMPUTER at the time the things
described in this warrant were created, edited, or deleted, such as logs, registry
entries, configuration files, saved usernames and passwords, documents, browsing
history, user profiles, email, email contacts, "chat," instant messaging logs,
photographs, and correspondence;
software;
Page 40 of 41
d. evidence indicating how and when the computer was accessed or used to determine
the chronological context of computer access, use, and events relating to crime
under investigation and to the computer user;
e. evidence indicating the computer user's state of mind as it relates to the crime under
investigation;
COMPUTER;
attachment.
Page 41 of 41
AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant

for the
Southern District of New York

)
)
].~MAG847
or identify theperson by name and address) ) Case No.
)
the Premises Known and Described as
)
)

of the following person or property located in the Southern District of New York
See Attachment A
The person or property to be searched, described above, is believed to conceal (identify the person or describe the property
to be seized):
See Attachment A
The search and seizure are related to violation(s) of (insert statuto,y citations):
18 U.S.C. §§ 1001, 1505, 1512(b)(1)

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or
property. ·
YOU ARE COMMANDED to execute this warrant on or before February 6, 2019
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10 p.m. 0 at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the wmrnnt and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or l ei3-VC tpfcopy.a~d receipt at the
1
place where the property was taken. . . : , , · . 1 • '. . . • , · •

. . .
The officer executing this warrant, or an officer present during the exeeu.tion.o(the warrant, rfmst prepare an
invento;y as required by law and promptly return this warrant and inventory t.ci..· the .Cf~rk ofth~ Cou.rt. _A,1
./'Upon its return, this warrant and inventory sho11ld be filed under seal by the ;Clerk of the Court~'~ ...,_/·_::._-_-_-_:-_:--
&SM.f Initials
0 I find that immediate notification may have an adverse result listed in 18,HS·'.C. § 2705 (except :for delay
of trial), and authorize the officer executing this warrant to delay notice to the p'ers9ri \\'.hO,: or whose prop(;)rty, will be
searched or seized (check the appropriate box) Ofor days (not to exceed 30). · ' ' , ·
· I J I \
Ountil, the facts justifying, the later specific. •dat,e: of, ·, -------
Date and time issued: / -l-+l//Jo~·

'--1-"IIJ-' I '-1- - 19~L~·:
0/.~ /LA
~- a,1>-J,_ _ _ __~_-
__-_
- _
--
/ 7 Judge 's signature
City and state: New York, NY Hon. Robert W. Lehrburger

-----------
AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant (Page 2)
Return
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant
to the Court.
Date:

ATTACHMENT A
I. Premises to be Searched - Subject Premises
The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described as
II. Items to Be Seized
A. Evidence, Fruits, and Instrumentalities of the Subject Offenses
The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WildLeaks, Julian
1
. '
c. Documents that reflect communications between Roger Stone and Jerome Corsi
that concern the Subject Offenses;
d. Documents reflecting communications between Roger Stone and Randy Credico
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
f. Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;
g. Records and information relating to the use, ownership, or control of e-mail
accounts ;
h. Records and information demonstrating who uses, owns, or controls the WhatsApp
account associated with telephone numbe ;
1. Records and information demonstrating who uses, owns, or controls the Signal
account associated with telephone number ;
J. Records and information demonstrating who uses, owns, or controls the Wickr
k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;
2
1. Computers and media storage devices, including tablets/iPads, and records or
documents demonstrating who operates, owns, or controls such devices, such as
telephone records, notes, notebooks, diaries, and reference materials, in whatever
form; and
m. Cellular telephones, smartphones, or personal data assistant devices, and records or
telephone records, notes, notebooks, _diaries, and reference materials, in whatever
form.
B. Search and Seizure of Electronically Stored Information
The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1. Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2. Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3. Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C. Review of ESI
Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
enforcement officers and agents, attorneys for the government, attorney support staff, agency
personnel assisting the government in this investigation, and outside technical experts under
government control) are authorized to review the ESI contained therein for information
responsive to the warrant.
3
I P \. 'I
In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
• surveying various file "directories" and the individual files they contain (analogous to
looldng at the outside of a file cabinet for the markings it contains and opening a drawer
believed to contain pertinent files);
• opening or cursorily reading the first few "pages" of such files in order to determine
their precise contents;
• scanning storage areas to discover and possibly recover recently deleted files or
.deliberately hidden files;
• performing key word searches through all electronic storage areas to determine whether
occuITences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and
• reviewing metadata, system inf01mation, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.
Law enforcement personnel will make reasonable effo1is to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.
4
AO 106 (SDNY Rev. 01/17) Application for a Search Warrant

for the

)
)
) CaseNl 9 7
See Attachment A )
)
)
APPLICATION FOR A SEARCH AND SEIZURE WARRANT

the Premises Known and Described as

located in the --------
------------
See Attached Affidavit and its Attachment A
~vidence of a crime;
0 contraband, fruits of crime, or other items illegally possessed;
~roperty designed for use, intended for use, or used in committing a crime;
0 a person to be· arrested or a person who is unlawfully restrained.

Code Section(s) Offense Description(s)
18 U.S.C. §§ 1001, 1505, .False statements, witness tampering, obstruction of proceedings
1512(b)(1) before departments, agencies, and committees
See Attached Affidavit and its Attachment A
i'lf Continued on the attached sheet.

0 Delayed notice of
under I 8 U.S.C. § 3103a, the basis of which is set forth EZ.
days (give exact ending date if more than 30 days: ) is requested
~ C / } 1 f . 's., s/gl1ati~re
) '. ,( / '\ i 11:' '· ( '11 ''}
., '$A rylic~ei_
-------,,--.,, ) ! ,, .
J, 'Robi1?Js0h ~ - - - - - -
-\......--.---,
0
'· f JI!
Prinzed ,iame
'
and titleI J
,
' \ ' ' '
Sworn to before me and signed in my presence. , ;."'J
• I./;; I I '
. I' '
..I
.Yi;'i '.-r'~..--·--···,··
J~r/;/J/2
I.. I •
,··, J ! \ I • r ,
. /'
*'~/\LY< /I ·,, ' ~ , )
Date: - - - - - ~ - ~ - ' , , ·~--.-;..,--'+'~ ·-'------
I .
' .. ' J~dge 's sig,!atuta '
.I I I ) j ' ·,\ '
City and state: New York, NY

-------------
_______H_o_·n~.·'1-~obert
+- yy. 'p&_h.,..,tb_8_r~g_er_ _~ - - -
Prihted,11'nne al,dtitle

FOR THE SOUTHERN DISTRICT OF NEW YORK
----------------------------------------------------------------,
''
In the Matter of the Application of the United TO BE FILED UNDER SEAL
States Of America for a Search and Seizure
Warrant for the Premises Known and Described Agent Affidavit in Support of
a Application for Search and Seizure
Warrant
-----------J'
SOUTHERN DISTRICT OF NEW YORK:
Mickey J. Robinson, being duly sworn, deposes says:
I. Introduction
A. Affiant
been since September 2012. I successfully completed New Agent Training at Quantico, Virginia,
where I received extensive instruction on criminal investigations.
2. I make this affidavit in support of an application pursuant to Rule 41 of the Federal
Rules of Criminal Procedure for a warrant to search the premises specified below (the "Subject
Premises") for, and to seize, the items and informatiQn described in Attachment A. This affidavit
is based upon my personal knowledge; my review of documents and other evidence; my
conversations with other law enforcement personnel; and my training, experience and advice
received concerning the use of computers in criminal activity and the forensic analysis of
electronically stored information ("ESI"). Because this affidavit is being submitted for the limited
purpose of establishing probable cause, it does not include all the facts that I have learned during
the course of my investigation. Where the contents of documents and the actions, statements, and
conversations of others are reported herein, they are reported in substance and in part, except where
otherwise indicated.
1
B. The Subject Premises
3. The Subject Premises are particularly described as
C. The Subject Offenses
4. For the reasons detailed below, I believe that there is probable cause to believe that
the Subject Premises contain evidence, fmits, and instrumentalities of violations of (i) Title 18,
United States Code, Section 1505 (obstruction of proceedings before departments, agencies, and
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18,
United States Code, Section l 512(b)(1) (witness tampering); (collectively the "Subject Offenses").
II. Probable Cause
A. Probable Cause Regarding Commission of the Subject Offenses
contained herein based on my own investigation, as well as my review of documents, records, and
information provided to me by other law enforcement officers and technical experts.
6. This affidavit is intended to show merely that there is sufficient probable cause for
the requested warrant and does not set forth all of my knowledge about this matter. Unless
and part. Where I asse1i that an event took place on a particular date, I am asserting that it took
2
7. For the reasons set forth in this Affidavit, there is probable cause to believe that one
or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., ("Roger Stone")
and others known and unknown to the government. Further, there is probable cause to believe the
Subject Premises have been used to facilitate the commission of one or more of the Subject
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises.
Background on Relevant Individuals
8. Based on publicly available information and information obtained m the
investigation, I know the following:
a. Roger Stone is a political consultant who has worked for decades in U.S. politics
and on U.S. political campaigns. Stone was an official on the U.S. presidential
campaign of Donald J. Trump ("Trump Campaign") until in or around August
2015, and subsequently maintained regular contact with and publicly supported the
Trump Campaign through the 2016 election.
b. Julian Assange is the founder and director of 'YikiLeaks, which is publicly
described as a non-profit organization that disseminates non-public information and
classified media provided by anonymized sources. WikiLeaks has posted numerous
documents stolen from the U.S. government. At all relevant times, Assange was
located at the Ecuadorian Embassy in London, United Kingdom.
c. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi
spoke regularly with Stone throughout the campaign, including about the release of
stolen documents by WikiLeaks.
3
e. ,Randy Credico was a radio host who has lmown Stone for more than a decade. In
testimony before U.S. House of Representatives Permanent Select Committee on
Intelligence ("HPSCI") on or about September 26, 2017, Stone described Credico
(without naming him) as an "intermediary," "go-between," and "mutual friend" to
Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr.
Stone" that Assange, had "' [e] mails related to Hillary Clinton which are pending
publication.'"
f. Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November
2016, Gates served as the deputy campaign chairman of the Trump Campaign. On
February 23, 2018, Gates pled guilty to one count of conspiracy against the United
States and one count of making false statements to federal law enforcement officers.
United States v. Gates, l: 17-cr-201 (D.D.C.).
g. Stephen K. Bannon is a U.S. citizen who serves as a political consultant. Beginning
in or around August 2016 and through the 2016 U.S. presidential election, Bannon
served as the chief executive officer of the Trump Campaign.
4
Hacking Activity During the 2016 Presidential Election
9. John Podesta is a U.S. citizen who served for years as a political consultant. During
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary
Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016, Podesta
received a spearphishing 1 email designed to appear as a security notification (a partial copy of the
email was recovered by the FBI from a subsequent release of stolen emails, described below).
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving
the email, his assistant (who also had access to the account) clicked on a link within the email and
entered the account password when prompted (believing this prompt to be part of a security
protocol). Based on my training and experience, this activity appears to have been a successful
spearphishing operation through which an actor would have gained access to Podesta' s email
account allowing the actor to steal emails and documents from that account.
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal elections.
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special
Counsel's Office, in or around the spring of 2016, the DNC and DCCC became aware that their
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity ·
company CrowdStrike to investigate the intrusions and remediate.
1
In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known ot trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicldng a malicious link or URL.
5
11. On or about June 14, 2016, CrowdStrike issued a public press release announcing
indicated that it had identified "two sophisticated adversaries on the network," which it referred to
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bJoth adversaries
12. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, l:18-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the
Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's military
intelligence agency.
WikiLeaks' Release of Stolen Documents During the 2016 Presidential Campaign
DCCC networks, as well as Podesta' s email account, GRU officers transmitted some of the stolen
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the
transfers using online personas created by the GRU, including "Guccifer 2.0" and "DCLeaks."
(GRU officers separately used these personas to release some of the stolen documents).
14. On or about July 22, 2016, WildLeaks released tens of thousands of documents
stolen from the DNC network. These stolen documents included communications by senior DNC
6
officials about campaign strategy, financial and fundraising data, and other documents related to
the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
documents that had been stolen from. John Podesta, releasing a total of over 50,000 stolen
documents.
Stone's Communications About WikiLeaks During the Campaign

f
16. In April 2018 interviews with the Special Counsel's Office, Gates stated that
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
WildLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed
WikiLeaks and Stone's prediction of the release.
17. According to Gates, Manafort directed Gates to contact Stone about any additional
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates
contacted Stone, who made statements claiming that there would be potential future releases of
damaging material by WikiLeaks. In a separate interview with the Special Counsel's Office in or
around October 2018, Gates recalled that at one point during the campaign he was with then-
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming.
7
2
show that shortly after the July 22, 2016 releas~ of stolen DNC emails
by WikiLeak:s, Stone coffesponded with other associates about contacting WikiLeaks in order to
a. On or about July 25, 20~6, Stone sent an email to Jerome Corsi with the subject
Ecuadorian Embassy in London and get the pending WikiLeaks emails ... they
Stone's email to who lived in the United Kingdom and was a supporter of
the Trump Campaign.
c. On or about August 2, 2016, Corsi emailed Stone and wrote that he was cuffently
in Europe and planned to retum in mid-August. Corsi stated, "Word is friend in
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact
planned to be very damaging." In a law enforcement interview, Corsi stated that
the phrase "friend in embassy" refeffed to Assange. Corsi added in the same email,
"Time to let more than Podesta to be exposed as in bed w enemy if they are not
2
A search of was authorized on or about September 11, 2017 by the U.S.
District Cour umbia. Case No. 1:l 7-mj-661 (D.D.C. Sept. 11, 2017). A
second search o was authorized on or about August 3, 2018 by the U.S.
District Court fo a. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C.
§ 27 03 (d) for records connected to Case No. 1:18-sc-2911 (D .D. C. Sept.
26, 2018). Records provided in r rporation confirmed that the account
was still active and that the relevant emails described in this affidavit were not deleted from the
account.
8
ready to drop HRC. That appears to be the game hackers are now about. Would
not hurt to start suggesting HRC old, memory bad, has stroke - neither he nor she
well. I expect that much of next dump focus, setting stage for Foundation debacle."
a. According to a public video posted to YouTube, on or about August 8, 2016, Stone
attended a public event in Broward County, Florida. During the event, Stone stated,
"I actually have communicated with Assange. I believe the next tranche of his
documents pertain to the Clinton Foundation, but there's no telling what the
October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016, Stone
was interviewed for a video segment on the show Info Wars, hosted by Alex Jones.
During the interview, Stone stated that he was "in communication with Assange"
but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016, Stone
stated during another interview with Alex Jones that "it became known on this
program that I have had some back-channel communication with WikiLeaks and
Assange." In a second interview on or about the same day with Dana Loesch of
the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and that
they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN, during
a C-SPAN teleyision interview on or about August 18, 2016, Stone stated that he
9
had communicated with Assange through an "intermediary, somebody who is a
mutual friend."
the interview, Credico asked Stone, "You've been in touch indirectly with Assange.
Can you give us any kind of insight? Is there an October surprise happening?"
Stone responded, "Well, first of all, I don't want to intimate in any way that I control
or have influence with Assange because I do not. . . . We have a mutual friend,
somebody we both trust and therefore I am a recipient of pretty good information."
20. In or around November 2018 , Stone
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeak~ and Assange planned to
do. Emails recovered through a court-authorized search of Stone's email account
about WikiLeaks in or around September 2016.
a. On or about August 19, 2016, Credico sent a text message to Stone that read in part,
"I'm going to have Julian Assange on my show next Thursday." On or about
August 21, 2016, Credico sent another text message to Stone, writing in part, "I
have Julian Assange on Thursday so I'm completely tied up on that day."
3
As discussed below, Stone had previously released some of these text messages to members of
10
b. On or about August 25, 2016, Assange was a guest on Credico's radio show for the
first time. On or about August 26, 2016, Credico sent a text message to Stone that
stated, "Julian Assange talk[ed] about you last night." Stone replied and asked what
talking about how the Press is trying to make it look like you and he are in cahoots."
c. On or about August 27, 2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in charge"
of the project. In a text message sent later that day, Credico added, "Julian Assange
has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said, "I
am e-mailing u a request to pass on to assange." Credico responded "Ok," and
e. Later on or about September 18, 2016, Stone emailed Credico an article with
State. Stone stated, "Please ask Assange for any State or HRC e-mail from August
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the
article] or confinn this narrative."
message ... to Assange." Credico responded, "I did." On or about September 20,
2016, Credico forwarded the request to a close friend who was an attorney with the
ability to contact the Assange. Credico blind-copied Stone on the forwarded email.
11
g. On or about September 30, 2016, Credico sent Stone via text message a photograph
of Credico standing outside the Ecuadorian Embassy in London where Assange
was located.
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
about Tuesday, October 4, 2016, which was rep01ied to be the 10-year anniversary
of the founding ofWikiLeaks.
1. On or about October 2, 2016, Stone emailed Credico, with the subject line "WTF?"
and a link to an article at the website http://heatst.com/politics/october-surprise-
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to-
security-concerns. Credico responded to Stone, "head fake."
further exchanges with Stone, Credico responded, "I think it['Js on for tomorrow."
Credico added, "Off the Record Hillary and her people are doing a full-court press
they [sic] keep Assange from making the next dump ... That's all I can tell you on
this line ... Please leave my name out of it."
2016, Stone made statements about Assange's future releases, including statements that were
similar to statement that Credico made to him. For example:
12
a. In a court-authorized search of Stone's email accoun the
FBI recovered an email from Stone t sent on or about October 3, 2016,
which stated in part, "Spoke to my friend in London last night. The payload is still
coming."
b. In a comi-authorized search o , the FBI also recovered an
who had connections to Steve Bannon. In the exchange, the reporter asked,
"Assange - what's he got? Hope it's good." Stone responded, "It is. I'd tell
Bannon but he doesn't call me back."
any new materials pertaining to the Clinton Campaign. In a court-authorized search
o the FBI recovered an email exchange between Stone and
Bannon on or about October 4, 2016 that occurred after the press conference. In
the exchange, Bannon asked, "What was that this morning???," referring to
Assange's press conference. Stone responded, "Fear. Serious security concern. He
thinks they are going to kill him and the London police are standing do[wn].
However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account, 5 the FBI recovered text
messages between Stone and from on or about October 4, 2016. In one text
4
A search of was authorized on or about October 17, 2017 by the U.S.
District Court umbia. Case No. l:17-mj-760 (D.D.C. Oct. 17, 2017). A
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018).
5
A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Comi for the District of Columbia. Case No. l:18-sc-662 (D.D.C. Mar. 14, 2018). · The
13
message, asked Stone if he had "hear[d] anymore from London." Stone
replied, "Yes -want to talk on a secure line- got Whatsapp." In an interview with
the Special Counsel's Office in or around May 2018, confirmed that he and
Stone spoke and that Stone had told him WikiLeaks had more material to release,
and that the material was related to senior people associated with Clinton.
22. On or about October 7, 2016, WikiLeaks released the first set of emails stolen from
Podesta. According to text messages recovered from Stone's iCloud account, shortly after the
release, an associate of Bannon sent a text message to Stone that read, "well done." Similarly,
Stone's Communications with the House Permanent Select Committee on Intelligence
individuals associated with political campaigns. 6 During a public HP SCI hearing on or about
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
statements about having communications with Assange (paiiicularly those from August 2016)
6
On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee
associated with political campaigns, as well as Russian cyber activity and other "active
measures" directed against the United States in connection with the 2016 election.
14
24. In or around May 2017, HP SCI ~ent a letter requesting that Stone voluntarily appear
before the committee and produce relevant documents to HP SCI (a copy of the HPSCI letter was
recovered by the FBI from a court-authorized search of Stone's email account
). The letter requested Stone produce:

lead to the discovery of any facts within the investigation's publicly-
announced parameters.
25. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and .
of form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation's publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone's email accoun ).
Stone's Testimony Before HPSCI
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice, 7 Stone
7
On or about December 14, 2018, the U.S. Depaiiment of Justice requested the transcript of
provided the U.S. Depaiiment of Justice a copy of the transcript of the September 26, 2017
interview of Roger Stone, a copy of Stone's written opening statement, and various
correspondence from Stone's counsel to members ofHPSCI.
15
WikiLeaks."
27. Also on or about September 26, 2017, Stone provided testimony in a closed session
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was transcribed, and a
copy of the transcript was obtained by the Department of Justice from HPSCI in or around
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he
would tell the truth. At the beginning of the hearin~, Stone was admonished that "it is unlawful to
deliberately provide false information to Members of Congress or staff' and that "providing false
information to this committee or concealing material information from this committee is a crime
punishable by law."
Stone's Testimony About Documents He Possessed Related to WikiLeaks
28. During his HPSCI testimony, Stone was asked about HPSCI's May 2017 document
request and whether Stone had any documents or written communications that discussed Julian
Assange, Russian interference,_ or other relevant documents:

You wrote back through counsel that you had no documents,
records, or electronically stored information regardless of
form responsive to our requests. Was that a false statement?
A: That is not a false statement. That's what -- I believe that to

be true.
[...]

Guccifer 2[.0J or any discussions you have had with third
16
A: That is correct. Not· to my knowledge. I think we met, again,

the precise criteria of your request, and we complied. Again,
if you have a more specific request, I'm happy to go back and
look. ...
Q: I just want to ask you under oath -

my attorneys, and we found nothing that met the criteria that
you asked for.

no emails, no texts, no tweets that refer to Julian Assange or
Guccifer 2[.0] or Paul Manafort or the allegations
have had no discussions in any written form. You've written
no documents yourself.

text messages during the 2016 campaign in which he discussed WildLeaks, Assange, and
WildLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
(including ) and his iCloud account show that,
at the time of his testimony, Stone was still in possession of many of these emails and text messages
at the time he testified on or about September 22, 2017. 8 These written communications included
(a) Stone's email to Corsi on or about July 25, 2016, that read in part, "Get to Assange [a]t
Ecuadorian Embassy in London and get the pending WildLeaks emails . . . they deal with
8
The warrant for Stone's email account was obtained on or about
2018 in response to acourtorderissued pursuant to 18 U.S.C. § 2703(d) confrrmed that the account
was active and the emails in question were not deleted from the account. The warrant for Stone's
email account was obtained on or about October 17, 2017 and executed
shortly thereaf tone's iCloud account (which contained the text messages
described above) was obtained on or about March 14, 2018 and executed shortly thereafter.
17
Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that "should
see Assange"; (c) Corsi' s email to Stone on or about August 2, 2016 that stated in part, "Word is
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned
to be very damaging."; (d) dozens of text messages and emails between Stone and Credico,
beginning on or about August 19, 2016 and continuing through duration of the election, in which
they discussed WikiLeaks and Assange; (e) Stone's email to on or about October 3, 2016
that read in part "Spoke to my friend in London last night. The payload is still coming."; and (f)
Stone's email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release "a
load every week going forward."
Stone's TestimonyAbout His Early August 2016 Statements
"in communication with Assange" but was "not at libe1iy to discuss what I have."
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentlem:an who confirmed for Mr. Stone" that
Assange had "'[e]mails related to Hillary Clinton which are pending publication."').
32. In fact, documents recovered during the investigation
18
a) show that Stone did not begin communicating
with Credico about Assange or WikiLeaks until on or about August 19, 2016 9-approximately
eleven days after Stone first claimed on or about August 8, 2016 to "actually have communicated
with Assange" and a week after to his August 12, 2016 statements of being "in communication
with Assange" and "not at liberty to discuss what I have."
33. When interviewed by the FBI, Credico stated that the first time he ever spoke with
°
Assange was on or about August 25, 2016, when ~redico interviewed Assange. 1 Credico also
provided the FBI with partially redacted emails that he claimed were between lie and another
member of WildLeaks from on or about August 25, 2016, in which the two discuss the technical
logistics for the interview later that day. During the exchange, Credico offered biographical
info1mation about himself, apparently as a means of introduction.
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks.
35. In contrast, and as described above, the FBI has identified written communications
prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact Assange. On or
about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [a]t Ecuadorian Embassy
in London and get the pending WildLeaks emails ... they deal with Foundation, allegedly."
Similarly, on or about August 2, 2016, Corsi-not Credico-sent an email to Stone in which Corsi
9
As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted
Stone that "Assange has kryptonite on Hillary."
°
1
Credico was first interviewed by the FBI in or around August 2018. He has subsequently
paiiicipated in multiple voluntary interviews.
19
wrote that "[w]ord is friend in embassy plans 2 more dumps," including one in October. These
communications occurred days before Stone's first public statement on or about August 8, 2016
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to
HPSCI as another individual Stone contacted to serve as a "go-between," "intermediary," or other
source for information from WikiLeaks. Stone also.never disclosed his written communications
with Corsi to HPSCI when answering HPSCI's questioning about the August 8, 2016_ and August
12, 2016 statements about being in communication with Assange.
Stone 's Testimony About Communications to Assange
36. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary] to
not."
37. In fact, starting on or.about September 18, 2016, Stone directed Credico to pass on
a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages , on or about
September 18, 2016, Stone sent a text message to Credico that said, "I am e-mailing
u a request to pass on to Assange." On or about the same day, Stone emailed
Credico an article with allegations against then-candidate Clinton related to her
service as Secretary of State. Stone added, "Please ask Assange for any State or
HRC e-mail from August 10 to August 30 - particularly on August 20, 2011 that
mention [the subject of the article] or confirm this narrative." (A copy of this email
was obtained through a search of Stone's email account ).
20
b. According to text messages , on or about
September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
38. During his HPSCI testimony, Stone was asked repeatedly about· his
A: Over the phone.

the intermediary?
A: No.
Q: No text messages, no-none of the list, right?
A: No.
writing:
Q: So you never communicated with your intermediary in

writing in any way?
A: No.
21

the phone.
A: Correct.
39. As described above, Stone and Credico (who Stone identified as his intermediary)
engaged in :frequent written communication by email and text message. Beginning on or about
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico
engaged in dozens of communications by email or text message in which they discussed
WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton
Campaign.
HPSCI testimony and afterwards. For example, on or about September 26, 2017-the day that
Stone testified before HP SCI and denied having ever sent or received emails or text messages :from
his identified intermediary, Stone and Credico exchanged over thirty text messages.
41. Certain of the electronic messages between Stone and Credico (which Stone denied
ever taking place or possessing) would have been material to HPSCI, including Stone's messages
in or a!ound September 2016 directing Credico to pass a request for documents to Assange, and
other relevant written communications with Credico. For example, on or about January 6, 2017,
Credico sent Stone an email, which Stone had in his possession at the time of his HP SCI testimony,
that had the subject line "Back channel bs." In the email, Credico wrote, "Well I have put together
timelines[] and you[] said you have a back-channel way back a month before I had Assange on
my show . . . I have never had a conversation with Julian Assange other than my radio show ... I
have pieced it all together ... so you may as well tell the truth that you had no back-channel or
there's the guy you were talking about early August." (A copy of this email was obtained through.
a search of Stone's email account .
22
Stone 's Testimony About Communications with the Trump Campaign
conversations with the inteimediary with anyone involved in the Trump campaign?" Stone
Trump Campaign officials to infmm them about materials possessed by Assange
and the timing of future releases.
b. , on or about October
3, 2016, Stone wrote to , "Spoke to my friend in London last night. The
payload is still coming."
c. As described above, on or about October 4, 2016, after receiving information from
Credi co about the delay in WikiLeaks' s release of stolen materials, Stone emailed
Bannon that Assange had a "[sJerious security concern" but would release "a load
every week going forward."
Stone's Attempts to Influence Credico RegardingHPSCI and the FBI
4 3. According to an email recovered through a court-authorized search of Stone's email
account on or about October 19, 2017, Stone sent Credico an excerpt of
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his "intermediary" to
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he
should correct his statement to HP SCI, but Stone did not do so. Stone then engaged in a prolonged
effort to prevent Credico from contradicting Stone's false statements to HPSCI.
23
44. In or around November 2017, Credico received a request from HPSCI to testify
see him. Stone responded, "' Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
interview.
would assert your 5th Amendment rights if compelled to appear." (A copy of these
account).
c. On or about November 28, 2017, ,Credico received a subpoena compelling his
testimony before HPSCI. Credico informed Stone of the subpoena.
d. According to emails recovered from Stone's email accoun
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico.
Corsi responded, ''Are you sure you want to make something out of this now? Why
24
not wait to see what [Credico] does? You may be defending yourself too much-
raising new questions that will fuel new inquiries. This may be a time to say less,
not more." Stone responded by telling Corsi that Credico "will take the 5th-but
let's hold a day."
11, who falsely claims not to lmow critical information before a congressional
committee that he does in fact lmow. On or about December 1, 2017, Stone told
from investigators.
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You need
to amend your testimony before I testify on the 15th." Stone responded, "If you
testify you're a fool. Because of tromp I could never get away with a ce1iain [sic]
my Fifth Amendment rights but you can. I guarantee you you are the one who gets
indicted for perjury if you're stupid enough to testify." (A copy of these text
messages was recovered through a court-authorized search of Stone's iCloud
account).
45. On or about December 12, 2017, Credico informed HPS CI that he intended to assert
his Fifth Amendment privilege against self-incrimination if required to appear by subpoena.
25
According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing
evidence that would show Stone's previous testimony to Congress was false.
investigators. During these conversations, Stone repeatedly made statements intended to prevent
Credico from cooperating with the investigations. For example:
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi . . .
there was no back channel ... be honest." Stone replied approximately two
minutes later, "I'm not talking to the FBI and if your smart you won't either." (A
copy of these text messages was recovered through a court-authorized search of

I
Stone's iCloud account).
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip you
to shreds." Stone also said he would "take that dog away from you," referring to
Credico's dog. On or about the same day, Stone wrote to Credico, "I am so ready.
Let's get it on. Prepare to die [expletive]." (A copy ofthis email exchange was
recovered through a court-authorized search of Stone's email account
).
just been honest with the house Intel committee ... you've opened yourself up to
pe1jury charges like an idiot." Stone responded, "You are so full of [expletive].
26
your friend [the attorney who had the ability to contact Assange]." (A copy of this
email exchange was recovered through a court-authorized search of Stone's email
accoun ). Credico believed Stone knew that Credico was
sensitive to having this friend's name publicly disclosed.
Missing Electronic Communications and Stone's Use of Encrypted Communications
presidential election) and afterward (during the period of pending congressional investigations into
Russian interference in the U.S. election). However, the government is aware of the existence of
numerous other relevant electronic communications that it has not yet been able to recover the
content.
emailed or exchanged text messages with his "intermediary" (later identified by Stone as Randy
communicated :frequently by email and text messages; court-authorized searches of Stone's email
and iCloud accounts confirm that Stone still had those communications at the time he testified in
or around September 2017. In numerous communications, Stone and Credico discussed Julian
Assange and WikiLeaks, as well as Stone's suggestion that Credico was his intermediary to
Assange. These communications appear relevant and responsive to HPSCI's inquiry, but Stone
never disclosed them.
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017 and
27
they show text message communications whose content that the government to date has not been
able to obtain. For example, these records indicate that Stone and Credico alone exchanged
during some period of the campaign in 2016 from Stone's subpoena production, issued after media
reports in November 2018 stated that Stone's attorneys were able to extract text messages between
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have,
;
for the same time period, many of Stone's other text messages. The government seeks these text
messages believing they may show additional evidence of (1) the falsity of Stone's HPSCI
testimony concerning his communications with his "intermediary" and (2) efforts to corruptly
persuade Credico not to cooperate with pending investigations.
50. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed
that Stone has used encrypted applications to communicate with others. Similarly, records
obtained in this investigation indicate Stone uses multiple applications designed for encrypted
28
communic~tion, including (a) WhatsApp, 11 (b) Signal, 12 ( c) Wickr, 13 and (d) ProtonMail. 14 To
date, the FBI has not obtained any of Stone's communications conducted through these
applications.
a. According to records from Stone's iCloud account, a copy of the WhatsApp
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an
email to that they "talk on a secure line" and proposed using WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal application
Additionally, text messages recovered from Stone's iCloud account revealed that
on or about November 15, 2016, Stone sent an attorney with the ability to contact
11
According to open sources, WhatsApp is an application that allows the user to send text
stores its messages separately from those text messages used on a mobile device's default message
application.
12
According to open sources, Signal is an encrypted communications application allowing the user
to send one-to-one and group messages, which can include files, voice notes, images and videos,
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as
identifiers, and uses end-to-end encryption to secure all communications to other Signal users.
Signal also allows users to set timers to messages, after which the messages will be deleted from
both the sender's and the receivers' devices.
13
According to open sources, Wicla is an instant messaging application that allows users to
users to set an expiration time for their encrypted communications. In addition to encrypting user
data and conversations, Wickr claims that its application strips metadata from all content
transmi_tted through the network.
14
According to open sources, ProtonMail is an end-to-end encrypted email service that uses client-
side encryption to protect email contents and user data before they are sent to ProtonMail servers.
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and
EU jurisdiction.
29
Julian Assange a link to download the Signal application. 15 Approximately fifteen
minutes after sending the link, Stone texted the attorney, "I'm on signal just dial
my number." The attorney responded, "I'll call you."
2016.
d. According to records from Stone's iCloud account, a copy of the Wickr application
51. Based on my training and experience, electronic communications using encrypted
applications such as WhatsApp, Signal, ProtonMail, and Wicla are sometimes maintained on the
device used to send and receive those communications. Communications from those applications
can be obtained by law enforcement by searching the device either manually or via a data
extraction device (such as Cellebrite). Searches of the physical device can reveal messages,
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wicla,
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review
of the device and the downloaded application can reveal other evidence of encrypted
communications, such as call logs and contact lists.
52. The FBI continues to seek evidence of Stone's communications and contacts dming
the period of the 2016 U.S. presidential election and through the present. The FBI believes these
communications may contain evidence of additional communications concerning Assange,
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such
15
This attorney was a close friend of Credico' s and was the same friend Credico emailed on or
·30
communications could constitute additional evidence of Stone's efforts to obstruct HPSCI's
investigation by showing additional contacts and communications about Assange and WikiLeaks
that Stone failed to disclose.
Other Relevant Communications
53. On May 8, 2018, a law enforcement interview o was
conducted. was an employee of Stone's from approximately June 2016 through
approximately December 2016 and resided in Stone's previous New York apartment for a period
of time. provided information technology support for Stone, but was not f01mally trained to
do so. was aware that Stone communicated with Trump during the 2016 presidential
campaign, and afterward, both in person and by telephone. provided information about c\.
meeting at Trump Tower between Trump and Stone during the time worked for him, to which
Sterne carried a "file booklet" with him. Stone tol the file booklet was important and that
no one should touch it. also said Stone maintained the file booklet in his closet.
54. On December 3, 2018, law enforcement conducted an interview of an individual
("Person 1") who previously had a professional relationship with a reporter who provided Person
1 with info1mation about Stone. The reporter relayed to Person 1 that in or around January and
February 2016, Stone and Trump were in constant communication and that Stone kept
contemporaneous notes of the conversations. Stone's purpose in keeping notes was to later provide
a "post mortem of what went wrong."
31
B. Probable Cause Justifying Search of the Subject Premises
55. Your affiant is aware through the investigation that Stone maintains the Subject
Premises as his secondary residence. 16 Associates of Stone's have confirmed that Stone maintains
the Subject Premises as his residence when he visits New York, New York. 17
56. Billing records provided by Charter Com.munications
determined that the subscriber of services at the Subject Premises i
In a law enforcement interview, stated he worked as Stone's assistant. The interview of
in addition to a review of public source records, determined lives in Florida.
Your affiant believes established the Charter Com.munications account at the Subject
Premises on behalf of Stone.
58. Stone participated in an on camera interview that was aired on or about November
2018 at the Subject Prem.ises 18 . Your affiant observed an Apple MacBook Pro computer and an
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the
apartment building that houses the Subject Premises.
16
Stone's primary residence is
17
Public real estate listing indicates the Subject Premises has been listed since December 5, 2018
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing
stated it was not available for viewing until February 1, 2019 because it was still occupied by the
tenant.
18
https://www.washingtonpost.com./p~litics/2018/11/08/roger-stone-has-rule-deny-everything-
he-does/?utm. term=.5ab41ac5df22
32
59. A review of records produced by Uber Technologies, Inc.,
determined that on or about December 2018, the user of the account associated with
Stone's telephone number and email address used Uber services at addresses at or close to the
Subject Premises. Your affiant is aware that users of Uber's services do not always use their
precise address when arranging for transportation, and believes the addresses close to the Subject
Premises are consistent with an individual whose destination is the Subject Premises.
60. Based on law enforcement interviews, your affiant is aware that Stone has used and
uses cellular telephones, desktop, and laptop computers to conduct electronic communications.
Stone also configures his computers to create regulars backups of his computers and maintains one
of these devices at the Subject Premises, which preserves documents and communications.
61. In or around May 2018, the FBI interviewed an individual ("Person 2") who
provided information technology services to Stone. According to Person 2, Stone maintains at
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
computer at one point in time. Person 2 revealed billing receipts
and invoices issued to Nydia Bertran-Stone for information technology ("IT") services dated
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for
IT services in connection with three different Apple computers. Specifically, the billing receipts
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name
"Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number D25TC077GQ17) configured
with the name "Stone-Roger-iMac-NYC"; and (3) an Apple MacBookPro 10 (serial number
C02KL05EFFT4) configured with the name "Stone-Nydia-MBPR." According to publicly
available information, the iMac is one of Apple's desktop models (i.e., a computer designed to be
stationary). The naming convention of the computer "Stone-Roger-iMac-NYC" therefore
33
suggests it is a stationary computer used by Stone and located at the Subject Premises. 19 According
to the billing records, Person 2 was requested to perfo1m remote support services on or about
March 21, 2018 on the computer named "Stone-Roger-iMac-NYC."
62. In the aforementioned Washington Post interview of Stone, at least two electronic
devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop
computer.
63. Person 2 also told law enforcement that Stone used the Apple Time Machine
("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences. According to publicly available information,
Time Machine is the built-in backup feature of Apple computers and can create copies of files on
a computer, including applications, music, photos, email, documents, and system files. A Time
Machine backup allows users to restore files from a specific point in time if the original files are
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time
Machine, a user connects an external storage device to the computer and selects that external
storage device as the backup disk. 20
64. Records produced by AT&T show that, since
2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone
number (ending in According to AT&T, as of January 1, 2015 through approximately
November 14, 2016, Stone's telephone number was registered to an Apple iPhone model 5s
19
According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
20
When the external is plugged in, 'the Time Machine will automatically make hourly backups for
the past 24 hours, daily backups for the past month, and weekly backups for all previous months.
The oldest backups are deleted when the external storage device selected as the backup disk is full.
The external device can be as small as a USB thumb drive.
34
("iPhone 5s") (IMSI 310410657061814). On or about November 14, 2016, Stone's cellular
telephone number was transferred to an Apple iPhone model 7 ("iPhone T') (IMSI
310410930460769). On or about September 28, 2018, Stone's cellular telephone number was
transferred to an Apple iPhone model XS ("iPhone XS") (IMSI 310410155529814).
65. Records produced by Uber Technologies, Inc.,
show that the account associated with Stone's telephone number and email address has the Uber
~pplic_~ti(?ll on multiple d~vic~s~ including a_device ide1!-tified as iPha.nel 1/, UDID - 668EDC?6-
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier
"iPhonell,2" con-elates to an Apple iPhone model XS. Additionally, the subpoena returns
identified a device identified as iPhone9,4, UDID - 716JCF59-6Fl0-41C8-984B-
DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 correlates
to an Apple iPhone model iPhone 7 Plus.
35
67. Statements attributed to Stone in recent media articles also indicate that Stone
retains computer devices that he no longer uses and keeps relevant electronic communications on
those devices. In or around November 2018, media repo1is began to publish excerpts of text
messages between Stone and Randy Credico that occuned during the 2016 U.S. election (copies
23
o_f these tex_t 11?-~s.s~ges su~sequ~11tly ~~re obtained from Sto!_l~ ).
According to these news articles, Stone released these messages to the media outlets, which Stone
claimed were extracted by his lawyers from "a cell phone he stopped using in 2016." Based on
these statements, your affiant believes the cellular telephone referenced in the article to be the
iPhone 5s documented in the aforementioned AT&T records (which records indicate he stopped
using on or about November 14, 2016).24 Further, your affiant believes Stone maintains other
devices he is no longer actively using.
C. Probable Cause Justifying Search of ESI

68. I submit that if a computer or storage medium is found on the Subject Premises,
there is probable cause to believe those records will be stored on that computer or storage medium,
for at least the following reasons:
23 See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger-
stone-wildleaks-randy-credico-mueller.
24 Stone produced some text messages between he and
Credico; the latest-in-time text message produced by Stone occuned on or about November 14,
201 6. The government believes copies of later-in-time text messages from late 2016 and early
2017 could be located on another device, such as the iPhone 7 described above, or on backup
storage media.
36
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost.
Even when files have been deleted, they can be recovered months or years later
computer, the data contained in the file does not actually disappear; rather, that data
remains on the storage medium until it is overwritten by new data.
slack space-that is, in space on the storage medium that is not currently being used
by an active file-for long periods of time before they are overwritten. In addition,
a computer's operating system may also keep a record of deleted data in a "swap"
or "recovery" file.
c. Wholly apart from user-generated files, computer storage media-in particular,
computers' internal hard drives-contain electronic evidence of how a computer
configurations, artifacts from operating system or application operation, file system
data structures, and viliual memory "swap" or paging files. Computer users
typically do not erase or delete this evidence, because special software is typically
required for that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes automatically
downloaded into a temporary Internet directory or "cache."
37
69. As further described in Attachment A, this application seeks permission to locate
not only computer files that might serve as direct evidence of the crimes described on the warrant,
but also for forensic electronic evidence that establishes how computers were used, the purpose of
their use, who used them, and when. There is probable cause to believe that this forensic electronic
evidence will be on any storage medium in the Subject Premises because:
storage medium but has since been deleted or edited, or. of a deleted portion of a
file (such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces of information on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
programs, and chat programs store configuration information on the storage
medium that can reveal inf01mation such as online nicknames and passwords.
Operating systems can record additional info1mation, such as the attachment of
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. As explained herein, info1mation stored within a computer and other electronic
storage media may provide crucial evidence of the "who, what, why, when, where,
and how" of the crilninal conduct under investigation, thus enabling the United
States to establish and prove each element or alternatively, to exclude the innocent
from further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and
38
movies, transactional information, records of session times and durations, internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media. This "user attribution"
evidence is analogous to the search for "indicia of occupancy" while executing a
search wanant at a residence. The existence or absence of anti-virus, spyware, and
malware detection programs may indicate whether the computer was remotely
accessed, thus inculpating or exculpating the computer owner. Further, computer
and storage media activity can indicate how and when the computer or storage
media was accessed or used. For example, as described herein, computers typically
contains infmmation that log: computer user account session times and durations,
computer activity associated with user accounts, electronic storage media that
connected with the computer, and the IP addresses through which the computer
accessed networks and the internet. Such information allows investigators to
understand the chronological context of computer or electronic storage media
access, use, and events relating to the crime under investigation. Additionally,
some information stored within a computer or electronic storage media may provide
crucial evidence relating to the physical location of other evidence and the suspect.
For example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data typically
also contains information indicating when the file or image was created. The
existence of such image files, along with external device connection logs, may also
indicate the presence of additional electronic storage media (e.g., a digital camera
or cellular phone with an incorporated camera). The geographic and timeline
39
information described herein may either inculpate or exculpate the computer user.
Last, information stored within a computer may provide relevant insight into the
computer user's state of mind as it relates to the offense under investigation. For
example, information within the computer may indicate the owner's motive and
intent to commit a crime (e.g., internet searches indicating criminal planning), or
consciousness of guilt (e.g., running a "wiping" program to destroy evidence on the
computer or password protecting/encrypting such evidence in an effort to conceal
it from law enforcement).
examining this forensic evidence in its proper context, draw conclusions about how
computers were used, the purpose of their use, who used them, and when.
accurate conclusion is a dynamic process. While it is possible to specify in advance
the records to be sought, computer evidence is not always data that can be merely
reviewed by a review team and passed along to investigators. Whether data stored
on a computer is evidence may depend on other inf01mation stored on the computer
and the application of knowledge about how a computer behaves. Therefore,
contextual information necessary to understand other evidence also falls within the
scope of the warrant.
who used it, and when, sometimes it is necessary to establish that a paiiicular thing·
is not present on a storage medium. For example, the presence or absence of
40
counter-forensic programs or anti-virus programs (and associated data) may be
III. Procedures for Searching ESI
A. Execution of Warrant for ESI
70. Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search
for and seize property "may authorize the seizure of electronic storage media or the seizure or
copying of electronically stored information ... for later review." Consistent with Rule 41, this
application requests authorization to seize any computer devices and storage media and transport
them to an appropriate law enforcement facility for review. This is typically necessary for a number
of reasons:
• First, the volume of data on computer devices and storage media is often impractical
for law enforcement personnel to review in its entirety at the search location.
• Second, because computer data is particularly vulnerable to inadvertent or intentional

modification or destruction, computer devices are ideally examined in a controlled
environment, such as a law enforcement laboratory, where trained personnel, using
specialized software, can make a forensic copy of the storage media that can be
subsequently reviewed in a manner that does not change the underlying data.
• Third, there are so many types of computer hardware and software in use today that it
can be impossible to bring to the search site all of the necessary technical manuals and
specialized personnel and equipment potentially required to safely access the
underlying computer data.
• Fourth, many factors can complicate and prolong recovery of data from a computer
device, including the increasingly common use of passwords, encryption, or other
features.or configurations designed to protect or conceal data on the computer, which
often take considerable time and resources for forensic personnel to detect and resolve.
71. In most cases, a thorough search of a premises for information that might be stored
on storage media often requires the seizure of the physical storage media and later off-site review
consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a
41
'
(
complete electronic picture of the computer's data, including all hidden sectors and deleted files.
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data
recorded on the storage media, and to prevent the loss of the data either from accidental or
intentional destruction. This is true because of the following:
a. The time required for an examination. As noted above, not all evidence takes the
form of documents and files that can be easily viewed on site. Analyzing evidence
of how a computer has been used, what it has been used for, and who has used it
requires considerable time, and taking that much time on premises could be
unreasonable. As explained above, because the warrant calls for forensic electronic
evidence, it is exceedingly likely that it will be necessary to thoroughly examine
storage media to obtain evidence. Storage media can store a large volume of
information. Reviewing that information for things described in the warrant can
take weeks or months, depending on the volume of data stored, and would be
impractical and invasive to attempt on-site.
b. Technical requirements. Computers can be configured in several different ways,
featuring a variety of different operating systems, application software, and
configurations. Therefore, searching them sometimes requires tools or knowledge
that might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know before a search what tools or
knowledge will be required to analyze the system and its data on the Premises.
However, taking the storage media off-site and reviewing it in a controlled
environment will allow its examination with the proper tools and lmowledge.
42
, '
c. Variety of forms of electronic media. Records sought under this warrant could be
stored in a variety of storage media formats that may require off-site reviewing with
specialized forensic tools.
72. Because multiple people share the Subject Premises as a residence, it is possible
that the Subject Premises will contain storage media that are predominantly used, and perhaps
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is
possible that the things described in this warrant could be found on any of those computers or
storage media, the warrant applied for would permit the seizure and review of those items as well.
· B. Review of ESI
73. Following seizure of any computer devices and storage media and/or the creation
of forensic image copies, law enforcement personnel (who may include, in addition to law
government control) will review the ESI contained therein for information responsive to the
warrant.
74. In conducting this review, law enforcement personnel may use various techniques
to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such
techniques may include, for example:
• surveying directories or folders and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
• conducting a file-by-file review by "opening" or reading the first few "pages" of such
files in order to determine their precise contents (analogous to performing a cursory
examination of each document in a file cabinet to detennine its relevance);
• "scanning" storage areas to discover and possibly recover recently deleted data or
deliberately hidden files; and
43
I '
• performing electronic keyword searches through all electronic storage areas to

determine the existence and location of data potentially related to the subject matter of
the investigation25 ; and
• reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, wl).en, and by whom the computer was used.
75. Law enforcement personnel will make reasonable efforts to restrict their search to
data falling within the cate~ories of evidence specified in the warrant. Depending on the
circumstances, however, law enforcement personnel may need to conduct a complete review of all
the ESI from seized devices or storage media to evaluate its contents and to locate all data
76. Review of the items described in Attachment A will be conducted pursuant to
established procedures designed to collect evidence in a manner consistent with professional
responsibility requirements concerning the maintenance of attorney-client and ot.p.er operative
privileges. The procedures include use of a designated "filter team," separate and apart from the
investigative team, in order to address potential privileges.
C. Return of ESI
77. If the Government determines that the electronic devices are no longer necessary
to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request.
Computer data that is encrypted or unreadable will not be returned unless law enforcement
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of
25
Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover,
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword
search because the information does not contain the keywords being searched.
44
the ·criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the
Subject Offenses.
IV. Conclusion and Ancillary Provisions
78. Based on the foregoing, I respectfully request the court to issue a warrant to seize
the items and information specified in Attachment A to this affidavit and to the Search and Seizure
Warrant.
79. In light of the confidential nature of the continuing investigation, I respectfully
request that this affidavit and all papers submitted herewith be maintained under seal until the
Court orders otherwise. Sealing is necessary because items and information to be seized are
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and
related documents may have a negative impact on this continuing investigation and may jeopardize
its effectiveness.
Special Agent
i) I \ I \ , ,.1/
Subscribed and sworn to before me q1\ tbis~Y'fl.:day,;f faJ?-uary, 2019.

) ) ,.
I \
1' , ' ~
'
iYU_;f~· '
I
J
,, . /
/ ' - -..............
• . . . ; . _ , . . . . ._ _ __
' 1.' \II - ' - - - -
THE HONORABI.:E, ;R.OBERT W. LEHRBURGER

! '••I • •
United States Magistrate Judge
45
I '
ATTACHMENT A
I. Premises to be Searched - Subject Premises
The premises to be searched (the "Subject Premises") are described as follows, and
include all locked and closed containers found therein:
The Subject Premises are particularly described a
II. Items to Be Seized
A. Evidence, Fruits, and Instrumentalities of the Subject Offenses
The items to be seized from the Subject Premises include the following evidence, fruits,
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code,
Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(l) (witness
tampering); (collectively the "Subject Offenses"), for the period June 2015 to the present,
described as follows:
a. Evidence concerning who occupies or owns the Subject Premises, including
without limitation, utility and telephone bills, mail envelopes, addressed
correspondence, diaries, statements, identification documents, address books,
telephone directories, and keys;
b. Documents and communications that discuss or are related to WikiLeaks, Julian
1
/ '
c. Documents that reflect communications between Roger Stone and Jerome Corsi
d. Documents reflecting communications between Roger Stone and Randy Credico
e. Documents reflecting communications between Roger Stone and members of the
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon,
, Paul Manafort, Richard Gates, and Donald J. Trump, that concern the
Subject Offenses;
f. Documents related to or discussing investigations into Russian interference in the
2016 U.S. presidential election and related matters by the U.S. House of
Representatives Permanent Select Committee on Intelligence; the U.S. Senate
Select Committee on Intelligence; and/or the Federal Bureau oflnvestigation;
g. Records and information relating to the use, ownership, or control of e-mail
accounts ;
h. Records and information demonstrating who uses, owns, or controls the WhatsApp
i. Records and information demonstrating who uses, owns, or controls the Signal
J. Records and information demonstrating who uses, owns, or controls the Wickr
k. Records pertaining to accounts held with Internet Service Providers providing
service at or to the Subject Premises;
2
1. Computers and media storage devices, including tablets/iPads, and records or
form; and
m. Cellular telephones, smartphones, or personal data assistant devices, and records or
form.
B. Search and Seizure of Electronically Stored Information
The items to be seized from the Subject Premises also include any computer devices and
storage media that may contain any electronically stored information falling within the categories
set forth in Section II.A.a-le of this Attachment above, including, but not limited to, desktop and
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones·,
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this
warrant also authorizes the copying of such devices or media for later review.
The items to be seized from the Subject Premises also include:
1. Any items or records needed to access the data stored on any seized or copied
computer devices or storage media, including but not limited to any physical keys, encryption
devices, or records oflogin credentials, passwords, private encryption keys, or similar information.
2. Any items or records that may facilitate a forensic examination of the computer
devices or storage media, including any hardware or software manuals or other information
concerning the configuration of the seized or copied computer devices or storage media.
3. Any evidence concerning the identities or locations of those persons with access to,
control over, or ownership of the seized or copied computer devices or storage media.
C. Review of ESI
Following seizure of any computer devices and storage media and/or the creation of
forensic image copies, law enforcement personnel (who may include, in addition to law
government control) are authorized to review the ESI contained therein for information
3
In conducting this review, law enforcement personnel may use various techniques to
locate information responsive to the warrant, including, for example:
• surveying various file "directories" and the individual files they contain (analogous to
looking at the outside of a file cabinet for the markings it contains and opening a drawer
• op-ening or cursorily reading the first few "pages" of such files in order to determine
their precise contents; ·
• scanning storage areas to discover and possibly recover recently deleted files or
deliberately hidden files;
• performing key word searches through all electronic storage areas to determine whether
occunences oflanguage contained in such storage areas exist that are intimately related
to the subject matter of the investigation; and
• reviewing metadata, system information, configuration files, registry data, and any
other information reflecting how, when, and by whom the computer was used.
Law enforcement personnel will make reasonable efforts to search only for files,
documents, or other electronically stored information within the categories identified in Sections
II.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to
conduct a complete review of all the ESI from seized devices or storage media if necessary to
evaluate its contents and to locate all data responsive to the warrant.
4
... , .- .
AO 93 (Rev 12/09) Search and Seizure Warrant

for the
Southern District of Florida

or identify the person by name and address) ) Case No. 19-6033-SNOW
)
, Fort Lauderdale, Florida (further
described in Attachment "A") )
)

Fort Lauderdale, Florida (further described in Allachmenl nAn)
The person or property to be searched, described above, is believed to conceal (identify the person or describe the
property to be seized):
See Attachment "8."
property.
YOU ARE COMMANDED to execute this warrant on or before F~ . l ~f1

(nottJ exceed f 4 days)
~ in the daytime 6:00 a.m. to 10 p.m. o at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken .
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)
o I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay
of trial), and authorize the officer executing this warran~ to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for days (not to exceed 30).
J,.SS 0 until, the facts justifying, the later specific date of
Date and time issued: j,jf}.yl fCj 1~· d.6

Ph ~
~.JJ ~ Judge's signatllre
City and state: Fort Lauderdale, Florida Lurana S . Snow, United States Magistrate Judge
. .
ATTACHMENT A
The address of the , Fort Lauderdale, Florida
Two photographs of the exterior of the Subject Premises are attached below.
Page 1 of1
.'
ATTACHMENT B
Property to be seized from the Subject Premises
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for
Campaign or Trump Campaign associates, including Steve Bannon, ,
the Federal Bureau ofInvestigation;
and
telephone number ;
number ;
Page 1 of3
. . ...
, Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 4 of 53
1. Records and infonnation relating to the Wic1er account associated with telephone
number ;
above;
k. Records of personal and business activities relating to the operation and
ownership of the computer systems, such as telephone records, notes, notebooks,
diaries, and reference materials, in whatever fonn;
1. Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever fonn;
2. For any computer or storage medium whose seizure is otherwise authorized by
this warrant, and any computer or storage medium that contains or in which is stored records or
infonnation that is otherwise called for by this warrant (hereinafter, "COMPUTER"):
a. evidence of who used, owned, or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted, such as logs,
registry entries, configuration files, saved usernames and passwords, documents,
browsing history, user profiles, email, email contacts, "chat," instant messaging
logs, photographs, and correspondence;
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
software;
Page 2 of3
.. . . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 5 of 53
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events relating
to crime under investigation and to the computer user;
e. evidence indicating the computer user's state of mind as it relates to the crime
COMPUTER;
attachment.
Page 3 of3
· "
AO 93 (Rev. 12/ 09) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with:
19-6033-SNOW
InventOlY made in the presence of:
Inventory ofthe property taken and name ofany person(s) seized:
Certification
I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designated judge.
Date:

... Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 7 of 53
AD 106 (R ev 04 / 10) Application for a Search Warrant

for the

or identify the person by name and address) Case No. 19-6033-SNOW
)
. , Fort Lauderdale, Florida (further described in )
Attachment nAn) )
APPLICATlON FOR A SEARCH WARRANT

Fort Lauderdale, Florida (further described in Attachment nAn)
Southern
located in the --------------- District of Florida , there is now concealed (identify the
- -----------------------
See Attachment "B."
The basis for the search under Fed . R. Crim. P. 41 (c) is (check one or more):
~ contraband, fruits of crime, or other items illegally possessed ;
f'i property designed for use, intended for use, or used in committing a crime;
o a person to be arrested or a person who is unlawfully restrained.
18U.S.C.1505 Obstruction of Proceeding
18 U.S.C. 1001 False Statements
18 U.S.C. 1512(b)(1) Witness Tampering
see attached affidavit.
Ii Continued on the attached sheet.

o Delayed notice of days (give exact ending date if more than 30 days : ) is requested
under 18 U.S.c. § 3103a, the basis of which is set forth on the attached sheet.
&, ~p:fL ,;;::!:'~

Curtis A. Heide, Special Agent, FBI
Date I ji9-'1}/j ~.~.A. ~ Judge 's signature
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge
ATTACHMENT A
The address of the Subject Premises is Fort Lauderdale, Florida
Two photographs of the exterior of the Subject Premises are attached below.
Page 1 of 1
t '>t' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 9 of 53
ATTACHMENT B
f. Records and information relating to the e~mail accounts
and ;
telephone number ;
number ;
Page 1 of3
f .. I
1. Records and information relating to the Wickr account associated with telephone
number ;
above;
diaries, and reference materials, in whatever form;
things described in this wan'ant were created, edited, or deleted, such as logs,
software;
Page 2 of3
I. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
1. records of or information about the COMPUTER's Internet activity, including
attachment.
Page 3 of3
premises known and described as Fort Lauderdale, Florida, described in
the following paragraphs and further in Attachment A.
cybersecurity.
3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger
Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(1 ) (collectively the "Specified Federal
Offenses") .
contained herein based on my own investigation, as well as my review of documents, records,
and information provided to me by other law enforcement officers and technical experts.
5. This affidavit is intended to show merely that there is sufficient probable cause
for the requested warrant and does not set forth all of my knowledge about this matter. Unless
Page 1 of 42
and part. Where I assert that an event took place on a particular date, I am asserting it took place
on or about the date specified.
6. I make this affidavit In support of an application for a warrant to search the
premises located at , Fort Lauderdale, FL (the "Subject Premises," as is more
particularly described in Attachment A), in connection with the Specified Federal Offenses, for
the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and
instrumentalities of the Specified Federal Offenses.
7. For the reasons set forth in this Affidavit, there is probable cause to believe that
one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S. politics
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
election.
9. Julian Assange is the founder and director of WikiLeaks, which is publicly
described as a non-profit organization that disseminates non-pUblic information and classified
Page 2 of42
,. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 14 of 53
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in
10. Jerome Corsi is a political commentator who worked with an online media
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke
regularly with Stone throughout the campaign, including about the release of stolen documents
by WikiLeaks.
12. Based on the investigation to date, Randy Credico was a radio host who has
known Stone for more than a decade. In testimony before the U.S. House of Representatives
Permanent Selection Committee on Intelligence (" HPSCI") on or about September 26, 2017,
Stone described Credico (without naming him) as an "intermediary," "go-between," and "mutual
friend" to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified
Credico by name and claimed Credico was the "gentleman who confirmed for Mr. Stone" that
Assange, had '" [e ]mails related to Hillary Clinton which are pending publication. '"
13 . Richard Gates is a U.S. citizen who served for years as a political consultant and
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates
pled guilty to one count of conspiracy against the United States and one count of making false
statements to federal law enforcement officers. United States v. Gales, 1: 17-cr-20 1 (D .D.C.).
Page 3 of42
•
14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in
or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the
chief executive officer of the Trump Campaign.
B. Hacking Activity During the 2016 Presidential Election
16. John Podesta is a U.S. citizen who served for years as a political consultant.
During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the
Hillary Clinton presidential campaign ("Clinton Campaign"). On or about March 24, 2016,
Podesta received a spearphishingl email designed to appear as a security notification (a partial
copy of the email was recovered by the FBI from a subsequent release of stolen emails,
described below). During an interview with the FBI in or around May 2018, Podesta indicated
that after receiving the email, his assistant (who also had access to the account) clicked on a link
within the email and entered the account password when prompted (believing this prompt to be
part of a security protocol). Based on my training and experience, this activity appears to have
been a successful spearphishing operation through which an actor would have gained access to
Podesta's email account allowing the actor to steal emails and documents from that account.
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal
I In my training and experience, spearphishing in this context refers to the fraudulent practice of
sending an email that purports to be from a known or trusted sender in order to induce the
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL.
Page 4 of 42
,
< Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 16 of 53
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by
the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
the cybersecurity company CrowdS trike to investigate the intrusions and remediate.
IS. On or about June 14,2016, CrowdStrike issued a public press release announcing
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[bloth adversaries
19. On or about July 13, 20 IS, a federal grand jury sitting in the District of Columbia
conspiracy to hack into, among other things, the email account of Jolm Podesta, as well as the
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1: IS-cr-215
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
military intelligence agency.
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the
Page 5 of 42
f. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 17 of 53
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks." CGRU officers separately used these personas to release some of the stolen
documents).
stolen from the DNC network. These stolen documents included communications by senior
DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
23. In April 2018 interviews with the Special Counsel's Office, Gates stated that
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed
WikiLeaks and Stone's prediction of the release.
24. According to Gates, Manafort directed Gates to contact Stone about any
additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's
Page 6 of42
., ~
Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
line, "Get to Assange." The body of the message read: "Get to Assange [a]t
Stone's email to , who lived in the United Kingdom and was a supporter
of the Trump Campaign.
MON." The body of the email read in part that " should see Assange."
2 A search of was authorized on or about September 11, 2017 by the

U.s. District Court for the District of Columbia. Case No.1 :17-mj-661 (D.D.C. Sept. 11,2017).
A second search of was authorized on or about August 3, 2018 by the
U.S. District Court for the District of Columbia. Case No.1: 18-sc-2582 (D.D.C . Aug. 3,2018).
On or about September 26, 2018, the government obtained and executed an order pursuant to 18
U.S .c. § 2703(d) for records connected to . Case No.1 : 18-sc-2911
(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that
the account was still active and that the relevant emails described in this affidavit were not
deleted from the account.
Page 7 of 42
• Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 19 of 53
Impact planned to be very damaging." In a law enforcement interview, Corsi
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
a. According to a public video posted to YouTube, on or about August 8, 2016,
Stone attended a public event in Broward County, Florida. During the event,
Stone stated, "I actually have communicated with Assange. I believe the next
tranche of his documents pertain to the Clinton Foundation, but there's no telling
what the October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016,
Stone was interviewed for a video segment on the show Info Wars, hosted by Alex
Jones. During the interview, Stone stated that he was "in communication with
Assange" but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016,
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-channel communication with WikiLeaks
Page 8 of 42
., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 20 of 53
and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
that they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN,
during a C-SP AN television interview on or about August 18, 2016, Stone stated
that he had communicated with Assange through an "intermediary, somebody
who is a mutual friend ."
the interview, Credico asked Stone, "You ' ve been in touch indirectly with
Assange. Can you give us any kind of insight? Is there an October surprise
happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
a mutual friend , somebody we both trust and therefore I am a recipient of pretty
good information."
campaign. 3 These text messages show that beginning on or about August 19, 2016, Stone
exchanged written communications with Credico about what WikiLeaks and Assange planned to
do. Emails recovered through a court-authorized search of Stone' s email account
3 As discussed below, Stone had previously released some of these text messages to members of
Page 9 of 42
'.
about WikiLeaks in or around September 2016,
a. On or about August 19, 2016, Credico sent a text message to Stone that read in
part, "I'm going to have Julian Assange on my show next Thursday." On or
about August 21, 2016, Credico sent another text message to Stone, writing in
part, "I have Julian Assange on Thursday so I'm completely tied up on that day."
b. On or about August 25, 2016, Assange was a guest on Credico's radio show for
the first time. On or about August 26,2016, Credico sent a text message to Stone
that stated, "Assange talk[ed] about you last night." Stone replied and asked what
talking about how the Press is trying to make it look like you and he are in
cahoots."
c. On or about August 27,2016, Credico sent text messages to Stone that said, "We
are working on a Julian Assange radio show," and that he (Credico) was "in
charge" of the project. In a text message sent later that day, Credico added,
"Julian Assange has kryptonite on Hillary."
d. On or about September 18, 2016, Stone sent a text message to Credico that said,
"I am e-mailing u a request to pass on to assange." Credico responded "Ok," and
State. Stone stated, "Please ask Assange for any State or HRC e-mail from
Page 10 of 42
"j Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 22 of 53
August 10 to August 30 -- particularly on August 20, 2011 that mention
subject of the article] or this "
f. On or about September 19, 2016, texted Credico my
" responded, "1 did." or about
20,2016,
forwarded request to a close who was an attorney
with the ability to contact Stone on the
forwarded email.
g. On or about 30, 201 Credico sent Stone via text a
photograph of Credico standing outside the Embassy In London
where Assange was located.
h. On or October 1, 2016, which was a Credico sent text
messages stated, "big news Wednesday ... now pretend u don't know me ...
will die this " In the preceding these the
had reported that Assange planned to a public announcement on or
about October 4, 16, which was reported to be the 1
anniversary of the of WikiLeaks.
1. On or about October 2, 16, Stone emailed Credico, with the subject line
and a link to an article at the website http://heatst.com/politics/october
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement
due-to-security-concerns. responded to Stone, "head fake."
J. On or about Monday, October 2016, wrote Credico and ac""""u, "Did
further exchanges with Stone, Credico responded, think on
II 42
, I
", Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 23 of 53
tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
2016, Stone made statements about Assange's future releases that were similar to prior
statements Credico made to him. For example:
a. In a court-authorized search of Stone's email account the
which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
b. In a court-authorized search of , the FBI also recovered an
who had connections to Bannon. In the exchange, the reporter asked, "Assange
what's he got? Hope it's good." Stone responded, "It is. I'd tell Bannon but he
any new materials pertaining to the Clinton Campaign. In a court-authorized
search of , the FBI recovered an email exchange between
Stone and Steve Bannon on or about October 4, 2016 that occurred after the press
conference. In the exchange, Bannon asked, "What was that this morning???,"
referring to Assange's press conference. Stone responded, "Fear. Serious security
4 A search of was authorized on or about October 17, 2017 by the U.S.

District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3,2018).
Page 12 of 42
concern. He thinks they are going to kill him and the London police are standing
do[wn]. However - a load every week going forward."
d. In a court-authorized search of Stone's iCloud account,S the FBI recovered text
messages between Stone and from on or about October 4, 2016. In one
text message, asked Stone if he had "hear[d] anymore from London."
Stone replied, "Yes - want to talk on a secure line - got Whatsapp." In an
interview with the Special Counsel's Office in or around May 2018,
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had
more material to release, and that the material was related to senior people
associated with Clinton.
29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen
from Podesta. According to text messages recovered from Stone's iCloud account, shortly after
the release, an associate of Bannon sent a text message to Stone that read, "well done."
Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016
WikiLeaks release, Stone said, "I told you this was coming."
E. Stone's Communications with the House Permanent Select Committee on

Intelligence
S A search of Stone's iCloud account was authorized on or about March 14, 2018 by the U.S.
District Court for the District of Columbia. Case No.1: 18-sc-662 (D.D.C. Mar. 14, 2018). The
6On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
Page 13 of 42
., .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 25 of 53
March 20, 2017, multiple HPSCI committee members indicated that Stone's pnor public
31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account

lead to the discovery of any facts within the investigation's
publicly-announced parameters.
stated, "Mr. Stone has no documents, records, or electronically stored information, regardless of
form, other than those widely available that reasonably could lead to the discovery of any facts
within the investigation'S publicly-announced parameters." (A copy of the letter was recovered
from a court-authorized search of Stone's email accountp ).
measures" directed against the United States in connection wi ththe 2016 election.
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
Page 14 of 42
, I
" , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 26 of 53
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony In a closed
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was
transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI
in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the
record that he would tell the truth. At the beginning of the hearing, Stone was admonished that
"it is unlawful to deliberately provide false information to Members of Congress or staff' and
that "providing false information to this committee or concealing material information from this
committee is a crime punishable by law."
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017
document request and whether Stone had any documents or written communications that
discussed Julian Assange, Russian interference, or other relevant documents:

You wrote back through counsel that you had no
documents, records, or electronically stored information
regardless of form responsive to our requests. Was that a
false statement?
A: That is not a false statement. That's what -- I believe that

to be true.
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 42
, i Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 27 of 53
[... ]
Q: So you no to anyone the

hacked documents or your conversations with the
Guccifer 2[.0] or any discussions you have with third
about Julian You no emails.no
A: That is correct. Not to my knowledge. I think we met,

again, the precise criteria of your request, and we complied.
if you have a more specific I'm happy to
back and look ....
Q: I just want to ask you under oath-
A: We did an with direction of

my attorneys, nothing that met criteria
that you asked for.
Q: I just want to be because you are under oath, where

your letter was not under that you have no
no no texts, no tweets that to Julian
or Guccifer 2[.0] or Paul Manafort or the allegations
have had no discussions in any written form. You've
written no documents yourself.
In connection with Russian collusion, consistent with your

exact and precise request,
36. In fact, as described sent and numerous and
text messages during the 2016 campaign In he WikiLeaks, Assange, and
possession of 11"',,,,,,,,, emails. Court-authorized of email accounts
(including ) and his iCloud account show
that, at the time of his testimony, Stone was still in vv,",,,,,-,,, many these and text
at the he on or about September 2017. 8 These written
8
warrant for Stone's email account was obtained on or about
September 11, 17 and executed shortly Records provided in or around September
18 in response to a court order issued pursuant to 18 § 2703(d) confinned that the
account was and emails question were not from account. The warrant
Page 16 42
" . , . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 28 of 53
communications included (a) Stone's email to Corsi on or about July 25, 2016, that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails ...
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
Malloch "should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part: "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or
about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
WikiLeaks would release "a load every week going forward."
for Stone's email account was obtained on or about October 17,2017 and
executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text
messages described above) was obtained on or about March 14, 2018 and executed shortly
thereafter.
Page 17 of42
, I ., Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 29 of 53
consistent with Credico. (On or about October I 2017, Stone caused a letter to be to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. that
had '" [e] mails to Hillary Clinton which are pending publication. ''').
39. In fact, documents recovered during the investigation (including those obtained
via search warrant returns show that Stone did not
communicating with Credico about .~~.~u ..,~ or WikiLeaks until on or about August 19, 2016 9
approximately days Stone first claimed on or about August 8, 2016 to "actually have
communicated with a week after his 6 statements of "in
communication Assange" and "not at liberty to discuss what I "
40. When interviewed by the FBI, Credico stated that the time he ever spoke
with Assange was on or about 2016, when interviewed 10 Credico
also provided the FBI with partially redacted emails that were between he
another member WikiLeaks from on or about August 25, which the two discuss the
technical for the that day. During Credico
biographical information about himself, apparently as a means
41. The FBI not identified Credico
2016 in which Stone to contact or WikiLeaks. When
interviewed by the Credico claimed he was never Stone in August 16 to
contact WikiLeaks.
9
described on or about August 19, Stone by text message that
Credico intended to interview Assange the or about August 25, 2016,
Credico interviewed Julian the first time, on or about 1
"Assange has kryptonite on Hillary."
10 Credico was first interviewed by in or around August 18. He has subsequently

participated in multiple voluntary interviews.
18 of 42
'. , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 30 of 53
42. In and as described above, the identified written
communications prior to 8, 2016 which Stone Corsi-not Credico--to contact
Assange. On or about July Stone wrote to Corsi, to Assange
Ecuadorian In London the WikiLeaks with
Foundation, allegedly." Similarly, on or about August 2, 2016, co--sem an
email to in which wrote that "[w lord is friend in embassy plans 2 more dumps,"
including one in October. communications days before first public
statement on or about August 2016 claiming to in communication with However,
at no time did identify to HPSCI as another individual Stone contacted to serve as a
"go-between," "intermediary," or other source for information WikiLeaks. Similarly,
Stone also never disclosed written communications with Corsi to when answering
HPSCI's about the August 2016 and August 12, 2016 statements about
communication with
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intennediaryJ to
communicate anything to Stone did not." Stone was then asked,
"Did you [the intermediary] to do on your own behalf?" Stone responded, did
not."
44. In fact, on or about 18, 201 Stone directed Credico to
on a to .~~,~.. ,.,~ for documents that believed would be to Clinton
a. According to text , on or about
September 18, 2016, Stone sent a text v"''''''''~v to Credico said, "I am e-
Page 19 of 42
" . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 31 of 53
mailing u a request to pass on to Assange." On or about the same day, Stone
emailed Credico an article with allegations against then-candidate Clinton related
to her service as Secretary of State. Stone added, "Please ask Assange for any
State or HRC e-mail from August 10 to August 30 - particularly on August 20,
2011 that mention [the subject of the article] or confinn this narrative." (A copy
of this email was obtained through a search of Stone's email account
).
September 19,2016, Stone texted Credico again, writing "Pass my message ... to
Stone's Testimonv About Written Communications with Credico
communications with the person he identified as his intennediary. Stone stated that he had never
communicated with his intennediary in writing in any way. During one exchange, Stone claimed
only to have spoken with the intennediary telephonically:
Q: [H]ow did you communicate the intennediary?
A: Over the phone.

the intennediary?
A: No.
Page 20 of 42
'. .
A: No.
writing:
Q: So you never communicated with your intermediary In

writing in any way?
A: No.

the phone.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his
intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19,2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.
Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary, Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone
denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
Page 21 of 42
'. . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 33 of 53
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
email was obtained through a search of Stone's email account ).
Stone's Testimony About Communications with the Trump Campaign
Trump Campaign officials to inform them about materials possessed by Assange
and the timing of future releases.
October 3,2016, Stone wrote to "Spoke to my friend in London last night.
The payload is still coming."
c. As described above, on or about October 4, 2016, after receiving information
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
release "a load every week going forward."
Page 22 of 42
,, Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 34 of 53
50. According to an email recovered through a court-authorized search of Stone's
email accountp . on or about October 19, 2017, Stone sent Credico an
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' ... Richard Nixon." (A copy of these text messages was recovered through
interview.
Page 23 of 42
, . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 35 of 53
would assert your 5th Amendment rights if compelled to appear." (A copy of
iCloud account).
d. According to emails recovered from Stone's email account
, on or about November 30, 2017, Stone asked Corsi to
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."
e. According to text messages recovered from Stone' s iCloud account, on multiple
committee that he does in fact know. On or about December 1,2017, Stone told
from investigators.
f On or about December 1, 2017, Stone texted Credico, "And if you turned over
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You
Page 24 of 42
, , Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 36 of 53
need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
account).
52. On or about December 12, 2017, Credico informed HPSCI that he intended to
assert his Fifth Amendment privilege against self-incrimination if required to appear by
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
time this yea[ r] sept 7 ... docs prove that ... You should be honest w fbi ...
b. On or about April 9, 2018, Stone wrote in an email to Credico, "You are a rat. A
stoolie. You backstab your friends-run your mouth my lawyers are dying Rip
Page 25 of 42
you to shreds." Stone also said he would "take that dog away from you,"
referring to Credico's dog. On or about the same day, Stone wrote to Credico, "I
am so ready. Let's get it on. Prepare to die [expletive]." (A copy of this email
exchange was recovered through a court-authorized search of Stone's email
account ).
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
your friend [the attorney who had the ability to contact Assange]." (A copy of
this email exchange was recovered through a court-authorized search of Stone's
email accountp ). Credico believed Stone knew that Credico
was sensitive to having this friend's name publicly disclosed.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election). However, the government is aware of the
existence of numerous other relevant electronic communications, the content of which it has not
yet been able to recover.
Page 26 of 42
"
communicated frequently by email and text messages; court-authorized searches of Stone's
email and iCloud accounts confirm that Stone still had those communications at the time he
testified in or around September 2017. In numerous communications, Stone and Credico
discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
intermediary to Assange. These communications appear relevant and responsive to HPSCI's
inquiry, but Stone never disclosed them.
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
corruptly persuade Credico not to cooperate with pending investigations.
57. Additionally, the FBI has interviewed multiple associates of Stone, who
confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses mUltiple applications designed for
Page 27 of 42
encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)
14
ProtonMail. To date, the FBI has not obtained any of Stone's communications conducted
through these applications.
5,2016. As described above, on or about October 4,2016, Stone suggested in an
email to that they "talk on a secure line" and proposed using
WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal
application was downloaded to an iPhone registered to Stone on or about August
18, 2016. Additionally, text messages recovered from Stone's iCloud account
II According to open sources, WhatsApp is an application that allows the user to send text
stores its messages separately from those text messages used on a mobile device's default
message application.
12 According to open sources, Signal is an encrypted communications application allowing the

user to send one-to-one and group messages, which can include files, voice notes, images and
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile
numbers as identifiers, and uses end-to-end encryption to secure all communications to other
Signal users. Signal also allows users to set timers to messages, after which the messages will be
deleted from both the sender's and the receivers' devices.
13 According to open sources, Wickr is an instant messaging application that allows users to
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.
Page 28 of42
revealed that on or about November 15, 2016, Stone sent an attorney with the
ability to contact Julian Assange a link to download the Signal application. ls
Approximately fifteen minutes sending the link, Stone texted the attorney,
"I'm on signal just dial my number." attorney responded, "I'll call you."
c. According to records Stone's iCloud account, a of the ProtonMail
2016.
d. According to from iCloud account, a copy the Wickr
5, 17.
58. Based on my training and electronic communications encrypted
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the
device used to and receive communications. Communications from those
applications can be obtained by law enforcement by the manually or a
data extraction device (such as Cellebrite). of the physical device can reveal messages,
including text and messages exchanged over WhatsApp, Signal, ProtonMail, and
Wickr, that have not backed to cloud accounts (such as an iCloud account).
Additionally, review of the device and the downloaded application can reveal other evidence
encrypted communications, such as call logs and contact lists.
continues to seek evidence of Stone's communications and contacts
during period of the 2016 U.S. presidential election through The
15
attorney was a close friend of Credico's and was the same friend Credico emailed on or
about September 2016 to Stone's request to emails connected to the
against then-candidate Clinton to of
Page 29 of 42
believes communications may contain evidence of additional communications concerning
WikiLeaks, and the of stolen documents damaging to the Clinton
Such communications could constitute additional evidence Stone's to obstruct
HPSCI's by showing additional contacts and about and
that Stone failed to
I. Other Relevant
60. On or about May 8, 2018, a law enforcement interview
was conducted. was an employee Stone's approximately June 2016
through approximately .lJ"-"v'-'H 2016 resided in Stone's previous York apartment for
a of time. provided information technology support for Stone but was not formally
trained to so. was aware that Stone communicated Trump the 2016
presidential campaign, and afterward, both in person by telephone. provided
information about a at Tower UI..,'VVI..,,,,, Trump Stone time
worked for to which carried a "file booklet" with him. told the file
booklet was important and that no one should it. said maintained file
booklet in closet.
61. or about 2018, law conducted an interview an
individual ("Person who had a relationship with a reporter who
provided IJ""'<'A~ 2 with information about Stone. reporter to Person 2 that in or
around January and February 2016, Stone and Trump were constant communication that
Stone notes of conversations. Stone's m notes was to
later provide a mortem of what went "
300f42
J. The Subject Premises
Premises as his primary residence. 16 During physical surveillance of the Subject Premises on or
about January 14, 2019, the FBI observed Stone at the residence.
63. Records produced by Comcast on August 23, 2018
show that the subscriber of high-speed internet service and digital voice services at the
Subject Premises was Nydia Stone. According to public reporting and law enforcement
interviews, Nydia Stone is the spouse of Stone.
64. According to emails obtained through a court-authorized search of Stone's email
account , Stone sent an email on or about January 2, 2018 requesting the
recipient "update your files with my new address"; Stone identified the Subject Premises as his
new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the
Subject Premises as his shipping address.
K. Computer Devices at the Subject Residence
65. Based on law enforcement interviews, your affiant is aware that Stone has used
and uses cellular telephones, desktop, and laptop computers to conduct electronic
communications. Stone also configures his computers to create regulars backups of his
computers and maintains one of these devices at the Subject Premises, which preserves
documents and communications.
16Stone also maintains a residence at New York, New

York.
Page 31 of 42
66. In or around May 2018, the FBI interviewed an individual ("Person 2") who
provided infonnation technology services to Stone. According to Person 2, Stone maintains at
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop
computer at one point in time. Person 2 revealed billing
receipts and invoices issued to Nydia Bertran-Stone for infonnation technology ("IT") services
dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was
billed for IT services in connection with three different Apple computers. Specifically, the
billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQ 17)
configured with the name "Stone-Roger-iMac-FL"; (2) a second Apple iMac (serial number
D25TC077GQ 17) configured with the name "Stone-Roger-iMac-NYC"; and (3) an Apple
MacBookPro 10 (serial number C02KL05EFFT4) configured with the name "Stone-Nydia-
MBPR." According to publicly available infonnation, the iMac is one of Apple's desktop
models (i.e., a computer designed to be stationary). The naming convention of the computer
"Stone-Roger-iMac-FL" therefore suggests it is a stationary computer used by Stone and located
at the Subject Premises. I7 According to the billing records, the computer was serviced on or
about May 26,2018.
67. Person 2 also told law enforcement that Stone used the Apple Time Machine
("Time Machine") application to facilitate backups of his computers and that he believed Stone
used Time Machine on computers in his residences. According to publicly available
information, Time Machine is the built-in backup feature of Apple computers and can create
copies of files on a computer, including applications, music, photos, email, documents, and
system files. A Time Machine backup allows users to restore files from a specific point in time
17 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in
the Subject Residence and conducts most of his work from the office when he is in Florida.
Page 32 of42
if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create
backups with Time Machine, a user connects an external storage device to the computer and
selects that external storage device as the backup disk.18
68. Records produced by AT&T show that,
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
telephone number (ending in ). According to AT&T, between approximately January 1,
2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
69. Records produced by Uber Teclmologies, Inc.,
application on multiple devices, including a device identified as iPhonell ,2, UDID - 668EDC66
"iPhone 11,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
identified a device identified as iPhone9,4, UDID 7161 CF59-6Fl 0-41 C8-984B
DE0840 1EOA 74. Publicly available information indicates that the identifier iPhone9,4
correlates to an Apple iPhone model iPhone 7 Plus.
70. Records obtained from a court-authorized pen register/trap & trace ("PRTT")
monitoring of Stone's personal cellular telephone number 19 shows recent activity
18 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 33 of42
indicating Stone continues to use the number and its associated device. For example, these
records show that between January 1, 2019 and January 10, 2019, telephone number was
used to make or receive over 150 telephone calls and send or receive over 750 text messages.
Likewise, a court-authorized PRTT of Stone's WhatsApp account (which is registered to Stone's
telephone number 20 showed the WhatsApp account was used to send or receive
approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about
January 1,2019 and January 10,2019.
71. Statements attributed to Stone in recent media articles also indicate that Stone
those devices. In or around November 2018, media reports began to publish excerpts of text
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies
of these text messages subsequently were obtained from Stone 21
According to these news articles, Stone released these messages to the media outlets, which
Stone claimed were extracted by his lawyers from "a cell phone he stopped using in 2016."
Based on these statements, your affiant believes the cellular telephone referenced in the article to
be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he
19 Installation and use of PRTT devices for was authorized by the U.S. District Court for
the District of Columbia on or about November 28, 2018. Case No.1: 18-pr-l72 (D.D.C. Nov.
28,2018).
20 Installation and use of PRTT devices for Stone's WhatsApp account was authorized by the
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No.1: 18
pr-250 (D.D.C. Dec. 11,2018).
21 See, e.g., "Bombshell Text Messages Support Roger Stone's Claims About WikiLeaks
Backchannel," Daily Caller, Nov. 14, 2018, available at
https:lldailycaller.coml20 18/11 I 14/roger-stone-wikileaks-randy-credico-mueller.
Page 34 of 42
stopped using on or about November 14, 2016)?2 Further, your affiant believes Stone maintains
other devices he is no longer actively using.
72. As described above and in Attachment B, this application seeks permission to
search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule
41 (e )(2)(B).
73. Probable cause. I submit that if a computer or storage medium is found on the
Subject Premises, there is probable cause to believe those records will be stored on that computer
or storage medium, for at least the following reasons:
downloaded onto a storage medium, deleted, or viewed via the Internet.
Electronic files downloaded to a storage medium can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.
22 Stone produced some text messages between he and

Credico; the latest-in-time text message produced by Stone occurred on or about November 14,
2016. The govenunent believes copies of later-in-time text messages from late 2016 and early
storage media.
Page 35 of 42
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
a "swap" or "recovery" file.
configurations, artifacts from operating system or application operation, file
system data structures, and virtual memory "swap" or paging files. Computer
users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d. Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache."
74. Forensic evidence. As further described in Attaclunent B, this application seeks
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Subject Premises because:
Page 36 of 42
.
,
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
e-mail programs, and chat programs store configuration information on the
storage mediwn that can reveal information such as online nicknames and
passwords. Operating systems can record additional information, such as the
attaclunent of peripherals, the attachment of USB flash storage devices or other
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
innocent from further suspicion. In my training and experience, information
stored within a computer or storage media (e.g., registry information,
communications, images and movies, transactional information, records of
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
computer or storage media. This "user attribution" evidence is analogous to the
Page 37 of 42
I
\
•
search for "indicia of occupancy" while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and mal ware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
For example, as described herein, computers typically contains information that
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
and the internet. Such information allows investigators to understand the
chronological context of computer or electronic storage media access, use, and
events relating to the crime under investigation. Additionally, some information
stored within a computer or electronic storage media may provide crucial
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data
typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
digital camera or cellular phone with an incorporated camera). The geographic
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under
Page 38 of 42
.
r' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 50 of 53
investigation. For example, infonnation within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
criminal plaIll1ing), or consciousness of guilt (e.g., ruIll1ing a "wiping" program to
destroy evidence on the computer or password protecting/encrypting such
evidence in an effort to conceal it from law enforcement).
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
fonns of forensic evidence on a storage medium that are necessary to draw an
accurate conclusion is a dynamic process. While it is possible to specify in
advance the records to be sought, computer evidence is not always data that can
be merely reviewed by a review team and passed along to investigators. Whether
data stored on a computer is evidence may depend on other infonnation stored on
the computer and the application of knowledge about how a computer behaves.
Therefore, contextual infonnation necessary to understand other evidence also
falls within the scope of the warrant.
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
of counter-forensic programs or anti-virus programs (and associated data) may be
Page 39 of42
• r
• ,
I' Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 51 of 53
75. Necessity ofseizing or copying entire computers or storage media. In most cases,
a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media. Generally speaking, imaging is the taking of a complete
electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
destruction. This is true because of the following:
form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
examine storage media to obtain evidence. Storage media can store a large
volume of information. Reviewing that information for things described in the
warrant can take weeks or months, depending on the volume of data stored, and
would be impractical and invasive to attempt on-site.
Page 40 of 42
environment will allow its examination with the proper tools and knowledge.
stored in a variety of storage media formats that may require off-site reviewing
with specialized forensic tools.
76. Nature of examination. Based on the foregoing, and consistent with Rule
41 (e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
order to determine whether it is evidence described by the warrant.
storage media, the warrant applied for would permit the seizure and review of those items as
well.
Review of the items described in Attachment B will be conducted pursuant to established
procedures designed to collect evidence in a manner consistent with professional responsibility
Page 41 of 42
.. .. Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 53 of 53
requirements concerning the maintenance of attorney-client and other operative privileges. The
procedures include use of a designated "filter team," separate and apart from the investigative
team, in order to address potential privileges.
SEALING ORDER REQUESTED
78. It is further respectfully requested that this Court issue an Order sealing, until
further order of this Court, all papers submitted in support of this application, including the
application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary
because items and information to be seized are relevant to an ongoing investigation, and
premature disclosure of the contents of this affidavit and related documents may have a negative
impact on this continuing investigation and may jeopardize its effectiveness.
CONCLUSION
search warrant for the Subject Premises, more particularly described in Attachment A,
authorizing the seizure of the items described in Attachment B.
Respectfl By submitted,
v/I~ ') . ~~
Curtis A. Heide
pecial Agent
Sworn to and subscribed before me on this ;Zy day of January, 2019.
1~~A-J_~~~_ J. ~
~
UNITED STATES MAGISTRATE JUDGE
Page 42 of 42

for the
or identifY the person by name and address) ) Case No. 19-6034-SNOW
)
Oakland Park, Florida
(further described in Attachment "A") )
)

(identifY the person or describe the property to be searched and give its location):
Oakland Park, Florida (further described in Attachment "A")
The person or property to be searched, described above, is believed to conceal (identifY the person or describe the
property to be seized):
See Attachment "8"
property.
YOU ARE COMMANDED to execute this warrant on or before
(not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10 p.m. o at any time in the day or night as I find reasonable cause has been
established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge
Lurana S. Snow
(name)
o I find that immediate notification may have an adverse result listed in 18 U.S.c. § 2705 (except for delay
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be
searched or seized (check the appropriate box) 0 for days (not to exceed 30).
o until, the facts justifying, the later specific date of
Date and time issued: I : :;).6
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Jud~
ATTACHMENT A
Oakland Park, Florida 33334.
The Subject Premises is a commercial space with a glass front door and glass windows covered
with a black fabric; a green awning bearing the letters "JVR" is above the door. A photograph of
the exterior of the Subject Premises is attached below.
Page 1 of1
- .,
ATTACHMENT B
I. The items to be seized are fruits, evidence, information relating to, contraband, or
United States Code l512(b)(I) (witness tampering), those violations involving Roger Stone, for
e. Documents related to or discussing the U.S . House of Representatives Permanent
and ;
telephone number ;
number ;
Page 1 of3
1. Records and infonnation relating to the Wickr account associated with telephone
number ;
smruiphones, personal data assistant devices, or other electronic devices used to
above;
diaries, and reference materials, in whatever fonn;
I. Records pertaining to accounts held with Internet Service Providers or of Internet
use, in whatever fonn;
viruses, Trojan horses, and other fonns of malicious software, as well as evidence
software;
Page 2 of3
COMPUTER;
I. records of or information about the COMPUTER's Internet activity, including
firewall logs, caches, browser history and cookies, "bookrnarked" or "favorite"
attachment.
Page 3 of3
, . . Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 6 of 57
AO 93 (ReI'. /2/09) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy ofwarrant and inventory left with:
19-6034-SNOW
Inventory ofthe property taken and name ofany person(s) seized:
Certification
I declare under penalty ofperjury that this inventory is correct and was returned along with the original
warrant to the designatedjudge.
Date:

AO 106 (Rev 04110) Application for a Search Warrant

for the
Jn the Matter of the Search of

)
or identify the person by name and address) Case No. 19-6034-SNOW
)
Oakland Park. Florida (further described )
in Attachment "A") )

J, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that J have reason to bel ieve that on the following person or property (identify the person or describe the
Oakland Park. Florida (further described in Attachment "A")
located in the Southern District of Florida , there is now concealed (identify the
------------------------
person or describe the property /0 be seized):
See Attachment "B"
o a person to be arrested or a person who is unlawfully restrained.
18 U.S.C. 1505 Obstruction of Proceeding
18U.S.C.1001 False Statements
18 U.S.C. 1512(b)(1) Witness Tampering

ri C ontinued on the attached sheet.

o Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.c. § 31 03a, the basis of which is set forth on the a ached sheet.
Curtis A. Heide, Special Agent, FBI

Printed name and ti/le
Date rt it1'-I
City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge
Printed name and /itle
ATTACHMENT A
Oakland Park, Florida .
Page 1 of1
ATTACHMENT B
and
telephone number ;
number ;
Page 1 of3
I. Records and information relating to the Wickr account associated with telephone
number ;
J. Any computers, media storage devices, tabletsliPads, cellular telephones,
above;
diaries, and reference materials, in whatever form;
software;
Page 2 of3
I. passwords, encryption keys, and other access devices that may be necessary to
COMPUTER;
I. records of or information about the COMPUTER's Internet activity, including
attachment.
Page 3 of3
fNTRODUCTION AND AGENT BACKGROUND
premises known and described as Oakland Park, Florida described
in the following paragraphs and further in Attachment A.
cy bersecuri ty.
3. I am currently involved in the investigation into Roger Jason Stone, Jr., ("Roger
Stone") and others known and unknown to the government, for the commission of unlawful
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i)
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering,
in violation of Title 18, United States Code 1512(b)(l) (collectively the "Specified Federal
Offenses").
contained herein based on my own investigation, as well as my review of documents, records,
and information provided to me by other law enforcement officers and technical experts.
5. This affidavit is intended to show merely that there is sufficient probable cause
for the requested warrant and does not set forth all of my knowledge about this matter. Unless
Page 1 of 46
and part. Where I assert that an event took place on a particular date, I am asserting that it took
6. I make this affidavit in support of an application for a warrant to search the
premises located at , Oakland Park, Florida (the "Subject Premises,"
as is more particularly described in Attachment A), in connection with the Specified Federal
Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband,
fruits, and instrumentalities of the Specified Federal Offenses.
7. For the reasons set forth in this Affidavit, there is probable cause to believe that
one or more of the Specified Federal Offenses have been committed by Roger Stone and others
known and unknown to the government. Further, there is probable cause to believe the Subject
Premises have been used to facilitate the commission of one or more of the Specified Federal
instrumentalities of violations of the Specified Federal Offense may be present in the Subject
Premises.
PROBABLE CAUSE
8. Roger Stone is a political consultant who has worked for decades in U.S . politics
Donald 1. Trump ("Trump Campaign") until in or around August 2015, and subsequently
election.
Page 2 of 46
9. Julian is the founder and director of WikiLeaks, which is publicly
as a non-profit organization that disseminates non-public and classified
provided by sources. posted numerous
government. At relevant times, was located at the Embassy in
10. Jerome is a political commentator who worked with an online media
publication during 2016 presidential As set forth Corsi spoke
with Stone throughout the campaign, including about the stolen documents
by WikiLeaks.
Based on investigation to Randy Credico was a radio host who has
known Stone for more than a decade. In testimony before the U.S. Representatives
Selection on Intelligence on or about 26, 201
Credico naming him) as an "intennediary," " and "mutual
to Assange. In a follow-up letter to HPSCI dated October 13, 201 identified
name and was the who confirmed for Stone" that
.~_ ....,...,_, had '" [e]mails to Hillary Clinton which are pending publication.'"
13. Richard citizen as a political and
along with Paul From in or around June 2016 until November 16, Gates
as the deputy campaign chainnan of the Trump Campaign. On February 2018, Gates
Page 3 of 46
guilty to one count conspiracy against States and one count making false
statements to federal law officers. States v. Gates, 1: 1 1 (D.D.C.).
14. Steve is a U.S. citizen who serves as a political consultant. Beginning in
or around August the 2016 presidential election, served as the
chief executive officer Campaign.
B. Hacking During the 2016 Election
16. John is a U.S. citizen served for years as a political consultant.
the 2016 presidential campaign, served as the chairman of the
Hillary Clinton campaign ("Clinton Campaign"). On or about March 24, 2016,
t'O(leS'ra received a C',",,,.<>rr,h email to appear as a (a partial
copy of the email was recovered by the a subsequent stolen emails,
described below). an interview with in or around May Podesta indicated
that receiving his assistant (who had access to the account) clicked on a link
within the email andpMl.pr~.r1 account when prompted prompt to be
a security Based on my this aotJears to
been a successful spearphishing operation, which an actor would gained access to
Podesta's email account, allowing the actor to emails and documents that account.
spearphishing context refers to

to be from a or trusted sender in
in a desired manner, typically by clicking a
4 46
Campaign Committee ("DCCC") are U.S. political committees focusing on U.S. federal
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by
the Special Counsel's Office, in or around the spring of 2016, the DNC and DCCC became
aware that their computer systems had been compromised by unauthorized intrusions and hired
the cybersecurity company CrowdStrike to investigate the intrusions and remediate.
IS. On or about June 14, 2016, CrowdStrike issued a public press release announcing
that the DNC's computer network had been compromised. In the public statement, CrowdS trike
indicated that it had identified "two sophisticated adversaries on the network," which it referred
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously
seen these actors target other customers and that, based on their experience, "[b]oth adversaries
19. On or about July 13, 201S, a federal grand jury sitting in the District of Columbia
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, I: lS-cr-21S
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in
the Main Intelligence Directorate of the General Staff ("GRU"), the Russian Federation's
military intelligence agency.
Page 5 of46
DCCC networks, as well as Podesta's email account, GRU officers transmitted some of the
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about
the transfers using online personas created by the GRU, including "Guccifer 2.0" and
"DCLeaks." (GRU officers separately used these personas to release some of the stolen
documents).
stolen from the DNC network. These stolen documents included communications by senior
DNC officials about campaign strategy, financial and fundraising data, and other documents
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election.
23. In April 2018 interviews with the Special Counsel's Office, Richard Gates stated
that starting in or around May 2016, when Gates was a senior official on the Trump campaign,
Stone informed members of the Trump Campaign that WikiLeaks had emails from then
candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC
emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they
discussed WikiLeaks and Stone's prediction of the release.
Page 6 of 46
24. According to Gates, Manafort directed Gates to contact Stone about any
additional releases and what other information WikiLeaks had regarding the Clinton Campaign.
Gates contacted Stone, who made statements claiming that there would be potential future
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel's
Office in or around October 2018, Gates recalled that at one point during the campaign he was
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were
coming.
Stone's email to , who lived in the United Kingdom and who was a
supporter of the Trump Campaign.
2 A search of was authorized on or about September II, 2017 by the

U.S. District Court for the District of Columbia. Case No.1 :17-mj-661 CD.D.C. Sept. 11,2017).
A second search of was authorized on or about August 3, 2018 by the
U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 CD.D.C. Aug. 3, 2018).
On or about September 26, 2018, the government obtained and executed an order pursuant to 18
U.S.c. § 2703Cd) for records connected to . Case No. 1:18-sc-2911
CD.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that
the account was still active and that the relevant emails described in this affidavit were not
deleted from the account.
Page 7 of 46
Impact planned to be very damaging." In a law enforcement interview, Corsi
stated that the phrase "friend in embassy" referred to Assange. Corsi added in the
same email, "Time to let more than Podesta to be exposed as in bed w enemy if
they are not ready to drop HRC. That appears to be the game hackers are now
about. Would not hurt to start suggesting HRC old, memory bad, has stroke
neither he nor she well. I expect that much of next dump focus, setting stage for
Foundation debacle."
a. According to a public video posted to YouTube, on or about August 8, 2016,
Stone attended a public event in Broward County, Florida. During the event,
Stone stated, "I actually have communicated with Assange. I believe the next
tranche of his documents pertain to the Clinton Foundation, but there's no telling
what the October surprise may be."
b. According to a public video posted to YouTube, on or about August 12, 2016,
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex
Page 8 of46
Jones. During the interview, Stone stated that he was "in communication with
Assange" but was "not at liberty to discuss what I have."
c. According to a public video posted to YouTube, on or about August 16, 2016,
Stone stated during another interview with Alex Jones that "it became known on
this program that I have had some back-chatmel communications with WikiLeaks
and Assange." In a second interview on or about the same day with Dana Loesch
of the TheBlaze TV, Stone stated that he "communicated with Mr. Assange" and
that they had a "mutual acquaintance who is a fine gentleman."
d. According to a video posted to the public website of the TV station C-SPAN,
during a C-SP AN television interview on or about August 18, 2016, Stone stated
that he had communicated with Assange through an "intermediary, somebody
who is a mutual friend."
the interview, Credico asked Stone, "You've been in touch indirectly with
Assange. Can you give us any kind of insight? Is there an October surprise
happening?" Stone responded, "Well, first of all, I don't want to intimate in any
way that I control or have influence with Assange because I do not. ... We have
a mutual friend, somebody we both trust and therefore I am a recipient of pretty
good information."
Page 9 of 46
campaign. 3 text on or about 19, 6, Stone
WikiLeaks planned to
do. recovered through a court-authorized search of Stone's email account
show written communications between and Credico
about WikiLeaks in or around 2016.
a. or about Credico sent a text message to that read in
part, "I'm going to have Julian on my show next Thursday." On or
about August 21, 16, Credico sent text message to writing in
part, "I have Julian on Thursday so completely on that day."
b. On or about 2016, Assange was a on radio show for
the first time. On or about August 26, 2016, Credico sent a text
that stated, 'UU~.",",_ talk[ed] about you " Stone replied and asked what
Assange said, to which Credico responded, didn't say we were
about how is trying to it look like you and he are in
cahoots."
c. On or about August 2016, Credico sent text messages to that said, "We
are working on a Assange " and that he was "in
of the In a text sent later that Credico added,
"Julian Assange has kryptonite on Hillary."
d. On or about 18, 2016, Stone sent a text message to that said,
"I am e-mailing u a to pass on to " Credico "Ok," and
3 As below, Stone had previously released some these text "''''''''''F>'''''' to members of
the media, who had written about and published them in part.
10 46
State. Stone stated, "Please ask Assange for any State or HRC e-mail from
August 10 to August 30 -- particularly on August 20, 2011 that mention [the
subject of the article] or confirm this narrative."
message ... to Assange." Credico responded, "I did." On or about September
20, 2016, Credico forwarded the request to a close friend who was an attorney
with the ability to contact the Assange. Credico blind-copied Stone on the
forwarded email.
g. On or about September 30, 2016, Credico sent Stone via text message a
photograph of Credico standing outside the Ecuadorian Embassy in London
where Assange was located.
h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text
messages that stated, "big news Wednesday ... now pretend u don't know me ...
about Tuesday, October 4, 2016, which was reported to be the lO-year
anniversary of the founding of WikiLeaks.
Page 11 of 46
1. On or about October 2, 2016, Stone emailed Credico, with the subject line
"WTF?" and a link to an article at the website http://heatst.com/politics/october
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement
due-to-security-concerns. Credico responded to Stone, "head fake."
further exchanges with Stone, Credico responded, "I think it[']s on for
tomorrow." Credico added, "Off the Record Hillary and her people are doing a
full-court press they [sic] keep Assange from making the next dump ... That's all
I can tell you on this line ... Please leave my name out of it."
2016, Stone made statements about Assange's future releases that were similar to prior
statements made by Credico to him. For example:
a. In a court-authorized search of Stone's email accountp the
which stated in part, "Spoke to my friend in London last night. The payload is
still coming."
b. In a court-authorized search of , the FBI also recovered an
who had connections to Bannon. In the exchange, the reporter asked, "Assange
4 A search of was authorized on or about October 17, 2017 by the U.S.

District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17,2017). A
District Court for the District of Columbia. Case No.1: 18-sc-2583 (D.D.C. Aug. 3,2018).
Page 12 of 46
what's he got? it's good," responded, I'd tell Bannon but he
c. On or about 4,2016, held a conference but not release
new materials pertaining to the Clinton Campaign. In a court-authorized
search , the FBI an email
and Steve JJUl'HV on or about October 4,2016 that occurred press
In Bannon "What was that this morning???"
referring to .~~~...~_ s press conference. responded, Serious security
concern. He thinks are going to London police are standing
do[wn]. However - a load week forward."
d. In a court-authorized search of Stone's iCloud account,S the recovered text
and on or about October 4, 201 In one
text asked if he had "hear[d] anymore from London."
replied, - want to talk on a secure line Whatsapp." In an
interview with the Counsel's in or around May 2018,
confirmed that and Stone and that told him WikiLeaks had
more material to and material was related to people
associated with Clinton.
29. or about 7, 201 WikiLeaks 1..""""";)""\..1 the first set stolen
Podesta. According to text messages recovered Stone's iCloud account, shortly after
the an associate Bannon sent a text message to that read done." Similarly,
iCloud account was authorized on or about March 14, 2018 by the U.S.
District Columbia. Case 1: 18-sc-662 Mar. 1 18). The
r"'''ArC1<' for Stone's iCloud account contained some, but not all, of Stone's communications
the period.
Page 13 46
E. Stone's Communications with the House Permanent Select Committee on

Intelligence
March 20, 2017, multiple HPSCI committee members indicated that Stone's prior public
31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI
letter was recovered by the FBI from a court-authorized search of Stone's email account

lead to the discovery of any facts within the investigation's
publicly-announced parameters.
of form, other than those widely available that reasonably could lead to the discovery of any
6 On or about January 13,2017, the chairman and vice chairman of the Senate Select Committee
measures" directed against the United States in connection with the 2016 election.
Page 14 of 46
facts within the investigation's publicly-arulOunced parameters." (A copy of the letter was
recovered from a court-authorized search of Stone's email account ).
WikiLeaks."
34. Also on or about September 26, 2017, Stone provided testimony in a closed
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone's testimony was
transcribed, and a copy of the transcript was obtained by the Special Counsel ' s Office from
HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for
the record that he would tell the truth. At the beginning of the hearing, Stone was admonished
that "it is unlawful to deliberately provide false information to Members of Congress or staff'
and that "providing false information to this committee or concealing material information from
this committee is a crime punishable by law."
35. During his HPSCI testimony, Stone was asked about HPSCI's May 2017
document request and whether Stone had any documents or written communications that
7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of
correspondence from Stone's counsel to members of HPSCI.
Page 15 of 46
discussed Julian Assange, Russian interference, or other relevant documents:

You wrote back through counsel that you had no
documents, records, or electronically stored information
regardless of form responsive to our requests. Was that a
false statement?
A: That is not a false statement. That's what -- I believe that

to be true.
[ ... ]

Guccifer 2[.0] or any discussions you have had with third
A: That is correct. Not to my knowledge. I think we met,

again, the precise criteria of your request, and we complied.
Again, if you have a more specific request, I'm happy to go
back and look ....
Q: I just want to ask you under oath-

my attorneys, and we found nothing that met the criteria
that you asked for.

no emails, no texts, no tweets that refer to Julian Assange
or Guccifer 2[.0] or Paul Manafort or the allegations
have had no discussions in any written form. You've
written no documents yourself.

text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and
Page 16 of 46
WikiLeaks possession of hacked emails. Court-authorized searches of Stone's email accounts
and his iCloud account show
that, at the time of his testimony, Stone was still in possession of many of these emails and text
messages at the time he testified on or about September 22, 2017. 8 These written
communications included (a) Stone's email to Corsi on or about July 25, 2016 that read in part,
"Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails . ..
they deal with Foundation, allegedly."; (b) Stone's email to Corsi on or about July 31, 2016 that
"should see Assange"; (c) Corsi's email to Stone on or about August 2, 2016 that stated
in part, "Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in
Oct. Impact planned to be very damaging."; (d) dozens of text messages and emails between
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of
the election, in which they discussed WikiLeaks and Assange; (e) Stone's email to on or
about October 3, 2016 that read in part "Spoke to my friend in London last night. The payload is
still coming."; and (f) Stone's email to Bannon on or about October 4, 2016 that claimed
WikiLeaks would release "a load every week going forward."
37. During his HPSCI testimony on or about September 26,2017, Stone was asked to
8 The warrant for Stone's email account was obtained on or about

2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the
account was active and the emails in question were not deleted from the account. The warrant
for Stone's email account was obtained on or about October 17,2017 and
executed shortly thereafter. The warrant for Stone's iCloud account (which contained the text
messages described above) was obtained on or about March 14, 2018 and executed shortly
thereafter.
Page 17 of 46
consistent with Credico. (On or about October 13,2017, Stone caused a letter to be submitted to
HPSCI that identified Credico by name as the "gentleman who confirmed for Mr. Stone" that
Assange had '" [e]mails related to Hillary Clinton which are pending pUblication. "').
39. In fact, documents recovered during the investigation (including those obtained
via search warrant returns ) show that Stone did not begin
communicating with Credico about Assange or WikiLeaks until on or about August 19,2016 9
approximately eleven days after Stone first claimed on or about August 8, 2016 to "actually have
communicated with Assange" and a week after his August 12, 2016 statements of being "in
communication with Assange" and "not at liberty to discuss what I have."
40. When interviewed by the FBI, Credico stated that the first time he ever spoke
with Assange was on or about August 25, 2016, when Credico interviewed Assange. 10 Credico
also provided the FBI with partially redacted emails that he claimed were between he and
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the
9 As described above, on or about August 19, 2016, Credico informed Stone by text message that
Credico intended to interview Assange the following week. On or about August 25, 2016,
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico
texted Stone that "Assange has kryptonite on Hillary."
10Credico was first interviewed by the FBI in or around August 2018. He has subsequently
participated in multiple voluntary interviews.
Page 18 of 46
technical logistics for the interview later that day. During the exchange, Credico offered
biographical information about himself, apparently as a means of introduction.
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to
contact WikiLeaks.
42. In contrast, and as described above, the FBI has identified written
communications prior to August 8, 2016 in which Stone directed Corsi-not Credico-to contact
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, "Get to Assange [aJt
Foundation, allegedly." Similarly, on or about August 2, 2016, Corsi-not Credico-sent an
email to Stone in which Corsi wrote that "[w Jord is friend in embassy plans 2 more dumps,"
including one in October. These communications occurred days before Stone's first public
statement on or about August 8, 2016 claiming to be in communication with Assange. However,
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a
"go-between," "intermediary," or other source for information from WikiLeaks. Similarly,
Stone also never disclosed his written communications with Corsi to HPSCI when answering
HPSCI's questioning about the August 8, 2016 and August 12, 2016 statements about being in
communication with Assange.
Stone's Testimony About Communications to Assange
43. During his HPSCI testimony, Stone was asked, "Did you ask [the intermediary J to
Page 19 of 46
not."
44. In fact, starting on or about September 18, 2016, Stone directed Credico to pass
on a request to Assange for documents that Stone believed would be damaging to the Clinton
Campaign.
a. According to text messages , on or about
September 18, 2016, Stone sent a text message to Credico that said, "I am e
mailing u a request to pass on to Assange." On or about the same day, Stone
emailed Credico an article with allegations against then-candidate Clinton related
to her service as Secretary of State. Stone added, "Please ask Assange for any
State or HRC e-mail from August 10 to August 30 - particularly on August 20,
2011 that mention [the subject of the article] or confirm this narrative." (A copy
of this email was obtained through a search of Stone's email account
).
September 19, 2016, Stone texted Credico again, writing "Pass my message ... to
Page 20 of 46
A: Over the phone.

the intermediary?
A: No.
A: No.
writing:
Q: So you never communicated with your intermediary In

writing in any way?
A: No.

the phone.
A: Correct.
46. As described above, Stone and Credico (whom Stone identified as his
intermediary) engaged in frequent written communication by email and text message. Beginning
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone
and Credico engaged in dozens of communications by email or text message in which they
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the
Clinton Campaign.
Page 21 of 46
Stone testified before HPSCI and denied having ever sent or received emails or text messages
from his identified intermediary-Stone and Credico exchanged over thirty text messages.
48. Certain of the electronic messages between Stone and Credico (which Stone
denied ever taking place or possessing) would have been material to HPSCI, including Stone's
messages in or around September 2016 directing Credico to pass a request for documents to
Assange, and other relevant written communications with Credico. For example, on or about
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of
his HPSCI testimony, that had the subject line "Back channel bs." In the email, Credico wrote,
"Well I have put together timelines[] and you [] said you have a back-channel way back a month
before I had Assange on my show ... I have never had a conversation with Julian Assange other
than my radio show ... I have pieced it all together ... so you may as well tell the truth that you
had no back-channel or there's the guy you were talking about early August." (A copy of this
email was obtained through a search of Stone's email account ).
Stone's Testimonv About Communications with the Trump Campaign
Page 22 of 46
Trump Campaign officials by telephone to inform them about materials possessed
by Assange and the timing of future releases.
October 3, 2016, Stone wrote to , "Spoke to my friend in London last night.
The payload is still coming."
c. As described above, on or about October 4, 2016, after receiving information
from Credico about the delay in WikiLeaks's release of stolen materials, Stone
emailed Bannon that Assange had a "[s]erious security concern" but would
release "a load every week going forward."
50. According to an email recovered through a court-authorized search of Stone's
email accountp . on or about October 19, 2017, Stone sent Credico an
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his
"intermediary" to Assange. As described below, Credico repeatedly told Stone that his letter was
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then
engaged in a prolonged effort to prevent Credico from contradicting Stone's false statements to
HPSCI.
Page 23 of 46
see him. Stone responded, '''Stonewall it. Plead the fifth. Anything to save the
plan' .. . Richard Nixon." (A copy of these text messages was recovered through
2017, Credico informed HPSCI that he declined HPSCl's request for a voluntary
interview.
b. On or about November 21, 2017, Credico texted Stone, "1 was told that the house
would assert your 5th Amendment rights if compelled to appear." (A copy of
iCloud account).
d. According to emails recovered from Stone's email account
, on or about November 30, 2017, Stone asked Corsi to
write publicly about Credico. Corsi responded, "Are you sure you want to make
something out of this now? Why not wait to see what [Credico] does? You may
be defending yourself too much - raising new questions that will fuel new
inquiries. This may be a time to say less, not more." Stone responded by telling
Corsi that Credico "will take the 5th-but let's hold a day."
Page 24 of 46
committee that he does in fact know. On or about December 1, 2017, Stone told
from investigators.
anything to the FBI you're a fool." Later that day, Credico texted Stone, "You
need to amend your testimony before I testify on the 15th." Stone responded, "If
you testify you're a fool. Because of tromp I could never get away with a certain
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one
who gets indicted for perjury if you're stupid enough to testify." (A copy of these
account).
52. On or about December 12, 2017, Credico informed HPSCI that he intended to
assert his Fifth Amendment privilege against self-incrimination if required to appear by
sUbpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid
providing evidence that would show Stone's previous testimony to Congress was false.
Page 25 of46
into Russian interference in the 2016 election and what infonnation Credico would provide to
time this yea[r] sept 7 ... docs prove that ... You should be honest w fbi ...
b. On or about April 9,2018, Stone wrote in an email to Credico, "You are a rat.
You are a stoolie. You backstab your friends-run your mouth my lawyers are
dying Rip you to shreds." Stone also said he would "take that dog away from
you," referring to Credico's dog. On or about the same day, Stone wrote to
Credico, "I am so ready. Let's get it on. Prepare to die [expletive]." (A copy of
this email exchange was recovered through a court-authorized search of Stone's
email account ).
perjury charges like an idiot." Stone responded, "You are so full of [expletive].
your friend [the attorney who had the ability to contact the head of Assange]."
(A copy of this email exchange was recovered through a court-authorized search
of Stone's email account ). Credico believed Stone knew
Page 26 of 46
that Credico was sensitive to having this friend's name publicly disclosed.
presidential election) and afterward (during the period of pending congressional investigations
into Russian interference in the U.S. election). However, the government is aware of the
existence of numerous other relevant electronic communications, the content of which it has not
yet been able to recover.
communicated frequently by email and text messages; court-authorized searches of Stone's
email and iCloud accounts confirm that Stone still had those communications at the time he
testified in or around September 2017. In numerous communications, Stone and Credico
discussed Julian Assange and WikiLeaks, as well as Stone's suggestion that Credico was his
intermediary to Assange. These communications appear relevant and responsive to HPSCI's
inquiry, but Stone never disclosed them.
reviewed telephone billing records for Stone's cellular telephone for the years 2016 and 2017,
and they show text message communications whose content that the government to date has not
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged
Page 27 of 46
during some period of the campaign in 2016 from Stone's subpoena production, issued after
media reports in November 2018 stated that Stone's attorneys were able to extract text messages
between Stone and Credico from a phone Stone stopped using in 2016. But the government does
not have, for the same time period, many of Stone's other text messages. The government seeks
these text messages believing they may show additional evidence of (1) the falsity of Stone's
HPSCI testimony concerning his communications with his "intermediary" and (2) efforts to
corruptly persuade Credico not to cooperate with pending investigations.
57. Additionally, the FBI has interviewed mUltiple associates of Stone, who
confirmed that Stone has used encrypted applications to communicate with others. Similarly,
records obtained in this investigation indicate Stone uses multiple applications designed for
encrypted communication, including (a) WhatsApp, II (b) Signal,12 (c) Wickr,13 and (d)
II According to open sources, WhatsApp is an application that allows the user to send text
stores its messages separately from those text messages used on a mobile device's default
message application.
12 According to open sources, Signal is an encrypted communications application allowing the

user to send one-to-one and group messages, which can include files, voice notes, images and
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile
numbers as identifiers, and uses end-to-end encryption to secure all communications to other
Signal users. Signal also allows users to set timers to messages, after which the messages will be
deleted from both the sender's and the receivers' devices.
13 According to open sources, Wickr is an instant messaging application that allows users to
users to set an expiration time for their encrypted communications. In addition to encrypting
user data and conversations, Wickr claims that its application strips metadata from all content
Page 28 of 46
14
ProtonMail. To date, the FBI has not obtained any of Stone's communications conducted
through these applications.
5,2016. As described above, on or about October 4,2016, Stone suggested in an
email to that they "talk on a secure line" and proposed using
WhatsApp.
b. According to records from Stone's iCloud account, a copy of the Signal
18,2016. Additionally, text messages recovered from Stone's iCloud account
revealed that on or about November 15, 2016, Stone sent an attorney with the
ability to contact Julian Assange a link to download the Signal application. IS
Approximately fifteen minutes after sending the link, Stone texted the attorney,
"I'm on signal just dial my number." The attorney responded, "I'll call you."
2016.
14 According to open sources, ProtonMail is an end-to-end encrypted email service that uses
client-side encryption to protect email contents and user data before they are sent to ProtonMail
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company
based in the Canton of Geneva, and its servers are located at two locations in Switzerland,
outside of US and EU jurisdiction.
IS This attorney was a close friend of Credico's and was the same friend Credico em ailed on or
Page 29 of 46
d. According to records from Stone's iCloud account, a copy of the Wickr
application was downloaded to an iPhone to Stone on or about August
201
58. Based on training electronic using encrypted
applications such as WhatsApp, ProtonMail, and Wickr are sometimes maintained on the
used to send and receive communications. Communications from
applications can be obtained by law enforcement by searching the device either manually or via a
data extraction device (such as Cellebrite). of physical device can messages,
including text messages messages exchanged over WhatsApp, Signal, ProtonMail,
Wickr, that have not been up to cloud accounts (such as an iCloud account).
Additionally, of the downloaded application can reveal evidence
encrypted communications, such as logs and contact lists.
The to seek 1...,.""1",, of communications and contacts
during the period of the 2016 U.S. presidential and through the The
believes communications may contain evidence of additional communications concerning
"",,,,11""''-', WikiLeaks, and the of documents damaging to the Clinton Campaign.
Such communications could constitute additional evidence of Stone's to obstruct
HPSCI's investigation showing additional contacts and communications and
WikiLeaks that Stone failed to disclose.
I. Other Relevant Records
60. On or about May 8, 2018, a law interview of
was conducted. was an employee of Stone's from approximately June 2016
through approximately December 16 and resided Stone's New York apartment for
30
a period of time. provided infonnation technology support for Stone but was not fonnally
trained to do so. was aware that Stone communicated with Trump during the 2016
presidential campaign, and afterward, both in person and by telephone. provided
infonnation about a meeting at Trump Tower between Trump and Stone during the time
worked for him, to which Stone carried a "file booklet" with him. Stone told the file
booklet was important and that no one should touch it. also said Stone maintained the file
booklet in his closet.
61. On or about December 3,2018, law enforcement conducted an interview of an
individual ("Person 2") who previously had a professional relationship with a reporter who
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or
around January and February 2016, Stone and Trump were in constant communication and that
Stone kept contemporaneous notes of the conversations. Stone's purpose in keeping notes was to
later provide a "post mortem of what went wrong."
J. The Subject Premises
Premises as his personal office and has done so since at least the 2016 Campaign. Public
reporting indicates that Stone occupied SUbject Premises as his office during the 2016
Campaign. 16 An April 17,2017 news article also described Stone's "personal office" at a
location matching the description of the Subject Premises. 17
16 See Roger Stone.' Inside The World Of A Political Hitman, CBS Miami, April 17, 2016,
available at https:llmiami.cbslocal.comJ20 16/04117lroger-stone-inside-the-world-of-a-political
hitmanl ("CBS4's Jim DeFede has known Stone for years and visited him recently at his office in
a nondescript building in an industrial section of Oakland Park that houses his collection of
Nixon memorabilia.").
17 See Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,
Washington Post, April 19, 2017, available at https:llwww.washingtonpost.comJlifestyle/style/
Page 31 of 46
63. to recovered court-authorized search
iCloud above), on or about 31, 2014 with the
lease for your signature," address of Subject
(The recovered contained no further content). On or about November 27, 2017, Stone
sent another individual address of the Subject Premises while arranging a meeting.
64. text show that has repeatedly identified the
Premises as office.
a. On or March 30, 201 Stone directed another individual to send a reporter
"to office." When the other individual asked , Stone ..",<,,,,,,,,,,1'1,:.1'1
in "Oakland " which corresponds to the address of the
Premises.
b. On or about April 8,2017, Stone exchanged with an individual who
identified as " a freelance photographer Washington
In the exchange, the photographer wrote he "would like to photograph you
first thing morning ... April 11 if that is convenient." Stone responded,
"Yes - let me figure out " The photographer then wrote that "[t]he
your that would a good location me." replied,
which is ofthe Subject Premises.
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth ("The
next part of the directions to his personal and broadcast studio calls for locating a "door
marked ' " which helpful, the crucial that there is no
discreetly "A" at the new next to a supplies There is,
a blacked-out door with no markings, and the man who emerges behind it, shorts,
loafers with no socks, a loosened tie and an untucked dress shirt, is unmistakably
").
Page 46
In text from Stone's refers to the Subject
Premises as a "warehouse." or about July 25, 15, wrote another individual,
"Warehouse has very high cable if u want to use ' office. '" On or about
November 10,2017, Stone wrote an individual, "U don't need an speed [inter] net at
our warehouse avail "
66. On or about May 18, 2018, investigators interviewed an individual ("Person 1")
described himself as m summer 1 stated that
as of May 2018, he worked at hours a week for Stone. Communications recovered
from Stone's account communicated with duration of the
Campaign and afterwards through May 18. Those communications included matters related to
the 2016 Campaign and media presence.
67. Person 1 told that as of May 2018, he out of Stone's
home in Florida or at Fort Lauderdale (the ....p ..,"£'on 1 further
that Stone in the Subject
68. During of the Subject on or about January 17,
2019, the FBI observed enter the Subject Premises. Stone was accompanied by two
individuals believed to host a The following photographs (wearing a light
button-down shirt and tie) Subject Premises was taken on
33 of 46
K. Computer Devices at the Subject Premises
69. Based on law enforcement interviews, your affiant is aware that Stone has used
and uses cellular telephones, desktop, and laptop computers to conduct electronic
communications. Stone also configures his computers to create regulars backups.
70. As described above, in text messages recovered from Stone's iCloud account,
Stone indicated the Subject Premises has high-speed internet service (referred to as having "very
high speed cable" and "high speed net").
71. As described above, on or about April 8, 2017, Stone and a photographer hired by
the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order
Page 34 of46
for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post
published a lengthy article about Stone that featured the following two photographs 18:
18"Roger Stone Helped Donald Trump Get Elected President - Now He's Helping Himself,"
Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.comllifestyle/style/
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worthl2017/
041l81l518184e-236f-lle7-b503-9d616bd5a305 _story.html?utm_term=. 7576648d5cel.
Page 35 of46
Both photographs were credited to the photographer with the first name " ," and the
caption of the latter photograph read in part, "Stone in his memorabilia-overrun office." The
photographs depict, among other things, multiple computer accessories, including a monitor,
microphone, and printer.
72. In addition, messages recovered from the court-authorized search of Stone's
iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from
his office, further indicating he likely has a computer present there. 19 For example, on or about
December 13, 2017, Stone coordinated an upcoming interview with another individual by text
message. Stone confirmed the interview, writing that he would participate via "Skype from our
Florida studio with green screen."
73. In or around May 2018, as discussed above, the FBI interviewed Person 1, who
worked for Stone. Person 1 told the FBI that Stone maintained a computer at the Subject
Premises.
74. In or around May 2018, the FBI interviewed an individual (Person 2) who
provided information technology services to Stone. Person 2 stated that Stone used the Apple
Time Machine ("Time Machine") application to facilitate backups of his computers. According
to publicly available information, Time Machine is the built-in backup feature of Apple
computers and can create copies of files on a computer, including applications, music, photos,
email,documents, and system files. A Time Machine backup allows users to restore files from a
specific point in time if the original files are ever deleted, or if the hard drive is erased or
19 According to publicly available information, Skype is a telecommunications application

software that specializes in providing video chat and voice calls between computers, tablets,
mobile devices, and similar devices via the internet.
Page 36 of 46
replaced. In order to create backups with Time Machine, a user connects an external storage
device to the computer and selects that external storage device as the backup disk,zo
75. Records produced by AT&T show that,
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular
telephone number (ending in . According to AT&T, between approximately January 1,
2015 and November 14, 2016, Stone's telephone number was registered to an Apple iPhone
model 5s ("iPhone 5s") (IMSI 310410657061814). On or about November 14,2016, Stone's
cellular telephone number was transferred to an Apple iPhone model 7 ("iPhone 7") (IMSI
76. Records produced by Uber Technologies, Inc.,
application on multiple devices, including a device identified as iPhone11,2, UDID - 668EDC66
"iPhonel1,2" correlates to an Apple iPhone model XS. Additionally, the subpoena returns
identified a device identified as iPhone9,4, UDID - 7161 CF59-6Fl 0-41 C8-984B
DE08401 EDA 74. Publicly available information indicates that the identifier iPhone9,4
correlates to an Apple iPhone model iPhone 7 Plus.
77. Records obtained from a court-authorized pen register/trap & trace ("PRTT")
monitoring of Stone's personal cellular telephone number 21 shows recent activity
20 When the external is plugged in, the Time Machine will automatically make hourly backups
for the past 24 hours, daily backups for the past month, and weekly backups for all previous
months. The oldest backups are deleted when the external storage device selected as the backup
disk is full. The external device can be as small as a USB thumb drive.
Page 37 of 46
indicating Stone continues to use the number and its associated device. For
records show that between January 1, 19 January 10, 2019, telephone number was
to make or receive over 150 calls and send or receive over text
Likewise, a court-authorized WhatsApp account (which is to
number 2 WhatsApp account was or
13 WhatsApp two WhatsApp voice calls on or
January 1,2019 and January 10,2019.
78. Statements attributed to in recent media articles also indicate that
those devices. In or around November 18, media reports began to publish excerpts text
messages between Stone and Randy that occurred during the 2016 U.S.
23
text messages subsequently were from Stone
According to these news messages to the
were "a cell phone he stopped using in 16."
on these statements, your the cellular telephone referenced in to
the iPhone 5s documented AT &T records (which records indicate
21 Installation and use of PRTT was authorized by the U.S. District Court
District of Columbia on or about 18. Case No.1: 18-pr-l
2018).
22 Installation and use of PRTT devices WhatsApp account was authorized

District Court for the District on or about December 11, 2018.
(D.D.C. Dec. 11,2018).
23
e.g., "Bombshell Stone's Claims About
Backchannel," Daily 14, 2018, available at
https:lldailycaller.coml20 18/11 114/roger-stone-wikileaks-randy-credico-mueller.
38
stopped using on or about November 14, 2016).24 Further, your affiant believes Stone maintains
other devices he is no longer actively using.
79. As described above and in Attachment B, this application seeks permission to
search for records that might be found in the Subject Premises, in whatever form they are found.
One form in which the records might be found is data stored on a computer device's hard drive
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic
storage media or, potentially, the copying of electronically stored information, all under Rule
41 (e)(2)(B).
80. Probable cause. I submit that if a computer or storage medium is found on the
Subject Premises, there is probable cause to believe those records will be stored on that computer
or storage medium, for at least the following reasons:
downloaded onto a storage medium, deleted, or viewed via the Internet.
Electronic files downloaded to a storage mediwn can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or
years later using forensic tools. This is so because when a person "deletes" a file
on a computer, the data contained in the file does not actually disappear; rather,
that data remains on the storage medium until it is overwritten by new data.
24 , Stone produced some text messages between he and

Credico; the latest-in-time text message produced by Stone occurred on or about November 14,
2016. The government believes copies of later-in-time text messages from late 2016 and early
storage media.
Page 39 of46
slack space-that is, in space on the storage medium that is not currently being
used by an active file-for long periods of time before they are overwritten. In
addition, a computer's operating system may also keep a record of deleted data in
a "swap" or "recovery" file.
configurations, artifacts from operating system or application operation, file
system data structures, and virtual memory "swap" or paging files. Computer
users typically do not erase or delete this evidence, because special software is
typically required for that task. However, it is technically possible to delete this
information.
d. Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a temporary Internet directory or "cache."
81. Forensic evidence. As further described in Attaclunent B, this application seeks
described on the warrant, but also for forensic electronic evidence that establishes how
computers were used, the purpose of their use, who used them, and when. There is probable
cause to believe that this forensic electronic evidence will be on any storage medium in the
Subject Premises because:
Page 40 of46
file (such as a paragraph that has been deleted from a word processing file).
Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
e-mail programs, and chat programs store configuration information on the
storage medium that can reveal information such as online nicknames and
passwords. Operating systems can record additional information, such as the
attachment of peripherals, the attachment of USB flash storage devices or other
external storage media, and the times the computer was in use. Computer file
systems can record information about the dates files were created and the
sequence in which they were created, although this information can later be
falsified.
storage media may provide crucial evidence of the "who, what, why, when,
where, and how" of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the
innocent from further suspicion. In my training and experience, information
stored within a computer or storage media (e.g., registry information,
communications, images and movies, transactional information, records of
session times and durations, internet history, and anti-virus, spyware, and
malware detection programs) can indicate who has used or controlled the
computer or storage media. This "user attribution" evidence is analogous to the
Page 41 of 46
search for "indicia of occupancy" while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and malware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or
exculpating the computer owner. Further, computer and storage media activity
can indicate how and when the computer or storage media was accessed or used.
For example, as described herein, computers typically contains information that
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
and the internet. Such information allows investigators to understand the
chronological context of computer or electronic storage media access, use, and
events relating to the crime under investigation. Additionally, some information
stored within a computer or electronic storage media may provide crucial
evidence relating to the physical location of other evidence and the suspect. For
example, images stored on a computer may both show a particular location and
have geolocation information incorporated into its file data. Such file data
typically also contains information indicating when the file or image was created.
The existence of such image files, along with external device connection logs,
may also indicate the presence of additional electronic storage media (e.g., a
digital camera or cellular phone with an incorporated camera). The geographic
and timeline information described herein may either inculpate or exculpate the
computer user. Last, information stored within a computer may provide relevant
insight into the computer user's state of mind as it relates to the offense under
Page 42 of 46
investigation. For example, information within the computer may indicate the
owner's motive and intent to commit a crime (e.g., internet searches indicating
criminal planning), or consciousness of guilt (e.g., running a "wiping" program to
destroy evidence on the computer or password protecting/encrypting such
evidence in an effort to conceal it from law enforcement).
examining this forensic evidence in its proper context, draw conclusions about
how computers were used, the purpose of their use, who used them, and when.
accurate conclusion is a dynamic process. While it is possible to specify in
advance the records to be sought, computer evidence is not always data that can
be merely reviewed by a review team and passed along to investigators. Whether
data stored on a computer is evidence may depend on other information stored on
the computer and the application of knowledge about how a computer behaves.
Therefore, contextual information necessary to understand other evidence also
falls within the scope of the warrant.
who used it, and when, sometimes it is necessary to establish that a particular
thing is not present on a storage medium. For example, the presence or absence
of counter-forensic programs or anti-virus programs (and associated data) may be
Page 43 of 46
82. Necessity ofseizing or copying entire computers or storage media. In most cases,
a thorough search of a premises for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make
an image copy of storage media. Generally speaking, imaging is the taking of a complete
electronic picture of the computer's data, including all hidden sectors and deleted files. Either
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss of the data either from accidental or intentional
destruction. This is true because of the following:
form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who
has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
examine storage media to obtain evidence. Storage media can store a large
volume of information. Reviewing that information for things described in the
warrant can take weeks or months, depending on the volume of data stored, and
would be impractical and invasive to attempt on-site.
Page 44 of 46
9 I' Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 56 of 57
environment will allow its examination with the proper tools and knowledge.
stored in a variety of storage media formats that may require off-site reviewing
with specialized forensic tools.
83. Nature of examination. Based on the foregoing, and consistent with Rule
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying
storage media that reasonably appear to contain some or all of the evidence described in the
warrant, and would authorize a later review of the media or information consistent with the
warrant. The later review may require techniques, including but not limited to computer-assisted
scans of the entire medium, that might expose many parts of a hard drive to human inspection in
order to determine whether it is evidence described by the warrant.
storage media, the warrant applied for would permit the seizure and review of those items as
well.
Page 45 of 46
85. Review of the items described in Attachment B will be conducted pursuant to
established procedures designed to collect evidence in a manner consistent with professional
responsibility requirements concerning the maintenance of attorney-client and other operative
privileges. The procedures include use of a designated "filter team," separate and apart from the
investigative team, in order to address potential privileges.
CONCLUSION
search warrant for the Subject Premises, more particularly described in Attachment A,
authorizing the seizure of the items described in Attachment B.
. A. Heide
Special Agent
Sworn and subscribed before me on thisJ.-Y day of January, 2019.
)f~J, ~
L.4tfRANA S. SNOW
UNITED STATES MAGISTRATE JUDGE
Page 46 of46

Roger Stone Search Warrants - Compressed

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Roger Stone Search Warrants - Compressed

Uploaded by

Copyright:

Available Formats

Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 1 of 21

AO 93 (Rev. 11/13) Search and Seizure Warrant

UNITED STATES DISTRICT COURT

In the Matter of the Search of )

SEARCH AND SEIZURE WARRANT

Date and time issued:

that is stored at premises owned, maintained, controlled, or operated by Twitter, a company

headquartered in San Francisco, California.

Particular Things to be Seized

I. Information to be disclosed by Twitter

government for each account listed in Attachment A:

occupation, and other personal identifiers;

Internet Protocol ("IP") address at the time of sign-up;

login to the account;

"bios," and profile backgrounds and themes;

(i.e., "mentions" or "replies");

by the "Tweet With Location" service;

account was clicked;

m. A list of all users that the account has "unfollowed" or blocked;

n. All "lists" created by the account;

o. All information on the "Who to Follow" list for the account;

p. All privacy and account settings;

searches saved by the account;

s. All records pertaining to communications between Twitter and any person

II. Information to be seized by the government

instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection

Attachment A, information pertaining to the following matters:

a. Any correspondence regarding hacked emails or other data from the

Democratic National Committee (DNC) and the email belonging to John

Podesta ("the email hack");

b. Any communications between the Target Accounts and individuals

associated with the email hack;

c. Any communications indicating any advance knowledge or direction,

planning, or control of the email hack;

to determine the chronological and geographic context of account access, use,

e. Evidence indicating the Twitt~r account owner's state of mind as it relates to

the crime under investigation;

records that help reveal the whereabouts of such person(s).

UNITED STATES DISTRICT COURT

APPLICATION FOR A SEARCH WARRANT

The application is based on these facts:

See attached Affidavit.

'J Continued on the attached sheet.

Reviewed by AUSA/SAUSA: ~ p p U r o n t ' , ,ignatu,e

IAaron Zelinsky (ASC) ] Mickey Robinson, Special Agent, FBI

Sworn to before me and signed in my presence.

IN THE UNITED STATES DISTRICT COURT

Filed Under Seal

INTRODUCTION AND AGENT BACKGROUND

1. I make this affidavit in support of an application for a search warrant for

information associated with the Twitter Accounts (hereafter "Target Account

maintained, controlled, or operated by Twitter, a social-networking company headquartered in

2. I am a Special Agent with Federal Bureau oflnvestigation ("FBI") assigned to

experience related to foreign intelligence services national security investigations, as well as

forth all of my knowledge about this matter.

in paragraphs 6, 20, and 28.

6. According to the public and unclassified intelligence report conducted by the

B. Roger Stone's Interactions with Guccifer 2.0 and Wikileaks.

8. Roger Stone is a self-employed political strategist/consultant and has been

continued to make media appearances in support of Trump's presidential campaign.

9. As discussed further below, Stone made a number of public references to

Twitter with Guccifer 2.0.