<filename>src/volume-1/hacking-dumping.tex
\section{Russian Hacking and Dumping Operations}
\markboth{Russian Hacking and Dumping Operations}{Russian Hacking and Dumping Operations}

Beginning in March 2016, units of the Russian Federation's Main Intelligence Directorate of the General Staff (GRU) hacked the computers and email accounts of organizations, employees, and volunteers supporting the Clinton Campaign, including the email account of campaign chairman <NAME>.
Starting in April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC).
The GRU targeted hundreds of email accounts used by Clinton Campaign employees, advisors, and volunteers.
In total, the GRU stole hundreds of thousands of documents from the compromised email accounts and networks.% 109
\footnote{As discussed in \hyperlink{section.1.5}{Section~V} below, our Office charged 12 GRU officers for crimes arising from the hacking of these computers, principally with conspiring to commit computer intrusions, in violation of
18~U.S.C. \S\S~1030 and~371.
\textit{See} \hyperlink{subsection.1.5.2}{Volume~I, Section V.B}, \textit{infra};
Indictment, \textit{United States~v.\ Netyksho}, No.~1:18-cr-215 (D.D.C. July~13, 2018), Doc.~1 (``\textit{Netyksho} Indictment'').}
The GRU later released stolen Clinton Campaign and DNC documents through online personas, ``DCLeaks'' and ``Guccifer~2.0,'' and later through the organization WikiLeaks.
The release of the documents was designed and timed to interfere with the 2016 U.S. presidential election and undermine the Clinton Campaign.

The Trump Campaign showed interest in the WikiLeaks releases and, in the summer and fall of 2016, \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}
WikiLeaks's first Clinton-related release \blackout{HOM}, the Trump Campaign stayed in contact \blackout{HOM} about WikiLeaks's activities.
The investigation was unable to resolve \blackout{Harm to Ongoing Matter.}
WikiLeaks's release of the stolen Podesta emails on October~7, 2016, the same day a video from years earlier was published of Trump using graphic language about women.

\subsection{GRU Hacking Directed at the Clinton Campaign}

\subsubsection{GRU Units Target the Clinton Campaign}

Two military units of the GRU carried out the computer intrusions into the Clinton Campaign, DNC, and DCCC: Military Units 26165 and~74455.% 110
\footnote{\textit{Netyksho} Indictment \P~1.}
Military Unit 26165 is a GRU cyber unit dedicated to targeting military, political, governmental, and non-governmental organizations outside of Russia, including in the United States.% 111
\footnote{Separate from this Office's indictment of GRU officers, in October 2018 a grand jury sitting in the Western District of Pennsylvania returned an indictment charging certain members of Unit 26165 with hacking the U.S. Anti-Doping Agency, the World Anti-Doping Agency, and other international sport associations.
\textit{United States~v.\ <NAME>}, No.~18-263 (W.D. Pa.).}
The unit was sub-divided into departments with different specialties.
One department, for example, developed specialized malicious software ``malware'', while another department conducted large-scale spearphishing campaigns.% 112
\footnote{A spearphishing email is designed to appear as though it originates from a trusted source, and solicits information to enable the sender to gain access to an account or network, or causes the recipient to download malware that enables the sender to gain access to an account or network.
\textit{Netyksho} Indictment \P~10.}
\blackout{Investigative Technique} a bitcoin mining operation to secure bitcoins used to purchase computer infrastructure used in hacking operations.% 113
\footnote{Bitcoin mining consists of unlocking new bitcoins by solving computational problems.
\blackout{Investigative Technique} kept its newly mined coins in an account on the bitcoin exchange platform \UseVerb{CEX}.
To make purchases, the GRU routed funds into other accounts through transactions designed to obscure the source of funds.
\textit{Netyksho} Indictment \P~62.}

Military Unit 74455 is a related GRU unit with multiple departments that engaged in cyber operations.
Unit 74455 assisted in the release of documents stolen by Unit 26165, the promotion of those releases, and the publication of anti-Clinton content on social media accounts operated by the GRU\null.
Officers from Unit 74455 separately hacked computers belonging to state boards of elections, secretaries of state, and U.S. companies that supplied software and other technology related to the administration of U.S. elections.% 114
\footnote{\textit{Netyksho} Indictment \P~69.}

Beginning in mid-March~2016, Unit 26165 had primary responsibility for hacking the DCCC and DNC, as well as email accounts of individuals affiliated with the Clinton Campaign:% 115
\footnote{\textit{Netyksho} Indictment \P~9.}

\begin{itemize}
    \item Unit 26165 used \blackout{Investigative Technique} to learn about \blackout{Investigative Technique} different Democratic websites, including \UseVerb{democratsorg}, \UseVerb{hillaryclintoncom}, \UseVerb{dncorg}, and \UseVerb{dcccorg}.
    \blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.} began before the GRU had obtained any credentials or gained access to these networks,  indicating that the later DCCC and DNC intrusions were not crimes of opportunity but rather the result of targeting.% 116
    \footnote{\textit{See} SM-2589105, serials 144 \& 495.}
    \item GRU officers also sent hundreds of spearphishing emails to the work and personal email accounts of Clinton Campaign employees and volunteers.
    Between March~10, 2016 and March~15, 2016, Unit 26165 appears to have sent approximately 90 spearphishing emails to email accounts at \UseVerb{hillaryclintoncom}.
    Starting on March~15, 2016, the GRU began targeting Google email accounts used by Clinton Campaign employees, along with a smaller number of \UseVerb{dncorg} email accounts.% 117
    \footnote{\blackout{Investigative Technique}}
\end{itemize}

The GRU spearphishing operation enabled it to gain access to numerous email accounts of Clinton Campaign employees and volunteers, including campaign chairman <NAME>, junior volunteers assigned to the Clinton Campaign's advance team, informal Clinton Campaign advisors, and a DNC employee.% 118
\footnote{\blackout{Investigative Technique}}
GRU officers stole tens of thousands of emails from spearphishing victims, including various Clinton Campaign-related communications.

\subsubsection{Intrusions into the DCCC and DNC Networks}

\paragraph{Initial Access}

By no later than April~12, 2016, the GRU had gained access to the DCCC computer network using the credentials stolen from a DCCC employee who had been successfully spearphished the week before.
Over the ensuing weeks, the GRU traversed the network, identifying different computers connected to the DCCC network.
By stealing network access credentials along the way (including those of IT administrators with unrestricted access to the system), the GRU compromised approximately 29 different computers on the DCCC network.% 119
\footnote{\blackout{Investigative Technique}}

Approximately six days after first hacking into the DCCC network, on April~18, 2016, GRU officers gained access to the DNC network via a virtual private network (VPN) connection% 120
\footnote{A VPN extends a private network, allowing users to send and receive data across public networks (such as the internet) as if the connecting computer was directly connected to the private network.
The VPN in this case had been created to give a small number of DCCC employees access to certain databases housed on the DNC network, Therefore, while the DCCC employees were outside the DNC's private network, they could access parts of the DNC network from their DCCC computers.}
between the DCCC and DNC networks.% 121
\footnote{\blackout{Investigative Technique} SM-2589105-HACK, serial 5.}
Between April~18, 2016 and June~8, 2016, Unit 26165 compromised more than 30 computers on the DNC network, including the DNC mail server and shared file server.% 122
\footnote{\blackout{Investigative Technique} [S]M-2589105-HACK, serial 5.}

\paragraph{Implantation of Malware on DCCC and DNC Networks}

Unit 26165 implanted on the DCCC and DNC networks two types of customized malware,% 123
\footnote{``Malware'' is short for malicious software, and here refers to software designed to allow a third party to infiltrate a computer without the consent or knowledge of the computer's user or operator.}
known as ``X-Agent'' and ``X-Tunnel'';  Mimikatz, a credential-harvesting tool; and \UseVerb{rarexe}, a tool used in these intrusions to compile and compress materials for exfiltration.
X-Agent was a multi-function hacking tool that allowed Unit 26165 to log keystrokes, take screenshots, and gather other data about the infected computers (\textit{e.g.}, file directories,  operating systems).% 124
\footnote{\blackout{Investigative Technique}}
X-Tunnel was a  hacking tool that created an encrypted connection between the victim DCCC/DNC computers and GRU-controlled computers outside the DCCC and DNC networks that was capable of large-scale data transfers.% 125
\footnote{\blackout{Investigative Technique}}
GRU officers then used X-Tunnel to exfiltrate stolen data from the victim computers.

To operate X-Agent and X-Tunnel on the DCCC and DNC networks, Unit 26165 officers set up a group of computers outside those networks to communicate with the implanted malware.% 126
\footnote{In connection with these intrusions, the GRU used computers (virtual private networks, dedicated servers operated by hosting companies, etc.) that it leased from third-party providers located all over the world.
The investigation identified rental agreements and payments for computers located in, \textit{inter alia}, \blackout{Investigative Technique} all of which were used in the operations targeting the U.S. election.}
The first set of GRU-controlled computers, known by the GRU as ``middle servers,'' sent and received messages to and from malware on the DNC/DCCC networks.
The middle servers, in turn, relayed messages to a second set of GRU-controlled computers, labeled internally by the GRU as an ``AMS Panel.''
The AMS Panel \blackout{Investigative Technique} served as a nerve center through which GRU officers monitored and directed the malware's operations on the DNC/DCCC networks.% 127
\footnote{\textit{Netyksho} Indictment \P~25.}

The AMS Panel used to control X-Agent during the DCCC and DNC intrusions was housed on a leased computer located near \blackout{IT: Lorem} Arizona.% 128
\footnote{\textit{Netyksho} Indictment \P~24(c).}
\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 129
\footnote{\textit{Netyksho} Indictment \P~24(b).}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.}

\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.}

The Arizona-based AMS Panel also stored thousands of files containing keylogging sessions captured through X-Agent.
These sessions were captured as GRU officers monitored DCCC and DNC employees' work on infected computers regularly between April 2016 and June 2016.
Data captured in these keylogging sessions included passwords, internal communications between employees, banking information, and sensitive personal information.

\paragraph{Theft of Documents from DNC and DCCC Networks}

Officers from Unit 26165 stole thousands of documents from the DCCC and DNC networks, including significant amounts of data pertaining to the 2016 U.S. federal elections.
Stolen documents included internal strategy documents, fundraising data, opposition research, and emails from the work inboxes of DNC employees.% 130
\footnote{\textit{Netyksho} Indictment \P~27--29; \blackout{Investigative Technique}}

The GRU began stealing DCCC data shortly after it gained access to the network.
On April~14, 2016 (approximately three days after the initial intrusion) GRU officers downloaded \UseVerb{rarexe} onto the DCCC's document server.
The following day, the GRU searched one compromised DCCC computer for files containing search terms that included ``Hillary,'' ``DNC,'' ``Cruz,'' and ``Trump.''% 131
\footnote{\blackout{Investigative Technique}}
On April~25, 2016, the GRU collected and compressed PDF and Microsoft documents from folders on the DCCC's shared file server that pertained to the 2016 election.% 132
\footnote{\blackout{Investigative Technique}}
The GRU appears to have compressed and exfiltrated over 70 gigabytes of data from this file server.% 133
\footnote{\blackout{Investigative Technique}}

The GRU also stole documents from the DNC network shortly after gaining access.
On April~22, 2016, the GRU copied files from the DNC network to GRU-controlled computers.
Stolen documents included the DNC's opposition research into candidate Trump.% 134
\footnote{\blackout{Investigative Technique} SM-2589105-HACK, serial 5.
\blackout{Investigative Technique}}
Between approximately May~25, 2016 and June~1, 2016, GRU officers accessed the DNC's mail server from a  GRU-controlled computer leased inside the United States.% 135
\footnote{\blackout{Investigative Technique}
\textit{See} SM-2589105-GJ, serial 649. As part of its investigation, the FBI later received images of DNC servers and copies of relevant traffic logs.
\textit{Netyksho} Indictment \P\P~28--29.}
During these connections, Unit 26165 officers appear to have stolen thousands of emails and attachments, which were later released by WikiLeaks in July~2016.% 136
\footnote{\textit{Netyksho} Indictment \P~29.
The last-in-time DNC email released by WikiLeaks was dated May~25, 2016, the same period of time during which the GRU gained access to the DNC's email server.
\textit{Netyksho} Indictment \P~45.}

\subsection{Dissemination of the Hacked Materials}

The GRU's operations extended beyond stealing materials, and included releasing documents stolen from the Clinton Campaign and its supporters.
The GRU carried out the anonymous release through two fictitious online personas that it created---DCLeaks and Guccifer~2.0---and later through the organization WikiLeaks.

\subsubsection{DCLeaks}

The GRU began planning the releases at least as early as April~19, 2016, when Unit 26165 registered the domain \UseVerb{dcleaks} through a service that anonymized the registrant.% 137
\footnote{\textit{Netyksho} Indictment \P~35.
Approximately a week before the registration of \UseVerb{dcleaks}, the same actors attempted to register the website \UseVerb{electionleaks} using the same domain registration service.
\blackout{Investigative Technique}}
Unit 26165 paid for the registration using a pool of bitcoin that it had mined.% 138
\footnote{\textit{See} SM-2589105, serial 181;
\textit{Netyksho} Indictment \P~21(a).}
The \UseVerb{dcleaks} landing page pointed to different tranches of stolen documents, arranged by victim or subject matter.
Other \UseVerb{dcleaks} pages contained indexes of the stolen emails that were being released (bearing the sender, recipient, and date of the email).
To control access and the timing of releases, pages were sometimes password-protected for a period of time and later made unrestricted to the public.

Starting in June 2016, the GRU posted stolen documents onto the website \UseVerb{dcleaks}, including documents stolen from a number of individuals associated with the Clinton Campaign.
These documents appeared to have originated from personal email accounts (in particular, Google and Microsoft accounts), rather than the DNC and DCCC computer networks.
DCLeaks victims included an advisor to the Clinton Campaign, a former DNC employee and Clinton Campaign employee, and four other campaign volunteers.% 139
\footnote{\blackout{Investigative Technique}}
The GRU released through \UseVerb{dcleaks} thousands of documents, including personal identifying and financial information, internal correspondence related to the Clinton Campaign and prior political jobs, and fundraising files and information.% 140
\footnote{\textit{See, e.g.}, Internet Archive, ``\url{https://dcleaks.com/}'' (archive date Nov.~10, 2016).
Additionally, DCLeaks released documents relating to \blackout{Personal Privacy}, emails belonging to \blackout{Personal Privacy}, and emails from 2015 relating to Republican Party employees (under the portfolio name ``The United States Republican Party'').
``The United States Republican Party'' portfolio contained approximately 300 emails from a variety of GOP members, PACs, campaigns, state parties, and businesses dated between May and October 2015.
According to open-source reporting, these victims shared the same Tennessee-based web-hosting company, called Smartech Corporation.
<NAME>, \textit{RNC E-Mail Was, In Fact, Hacked By Russians}, The Smoking Gun (Dec.~13, 2016).}

GRU officers operated a Facebook page under the DCLeaks moniker, which they primarily used to promote releases of materials.% 141
\footnote{\textit{Netyksho} Indictment \P~38.}
The Facebook page was administered through a small number of preexisting GRU-controlled Facebook accounts.% 142
\footnote{\textit{See, e.g.}, Facebook Account 100008825623541 (<NAME>).}

GRU officers also used the DCLeaks Facebook account, the Twitter account \UseVerb{atdcleaks}, and the email account \UseVerb{dcleaksproject} to communicate privately with reporters and other U.S. persons.
GRU officers using the DCLeaks persona gave certain reporters early access to archives of leaked files by sending them links and passwords to pages on the \UseVerb{dcleaks} website that had not yet become public.
For example, on July~14, 2016, GRU officers operating under the DCLeaks persona sent a link and password for a non-public DCLeaks webpage to a U.S. reporter via the Facebook account.% 143
\footnote{7/14/16 Facebook Message, ID 793058100795341 (DC Leaks) to ID\blackout{Personal Privacyr}}
Similarly, on September~14, 2016, GRU officers sent reporters Twitter direct messages from \UseVerb{atdcleaks}, with a password to another non-public part of the \UseVerb{dcleaks} website.% 144
\footnote{\textit{See, e.g.}, 9/14/16 Twitter DM, \UseVerb{atdcleaks} to \blackout{Personal Privacy};
9/14/16 Twitter DM, \UseVerb{atdcleaks} to \blackout{Personal Privacy}.
The messages read: ``Hi \UseVerb{tco} pass: \UseVerb{pass} enjoy \UseVerb{smiley}.''}

The \UseVerb{DCLeaks} website remained operational and public until March~2017.

\subsubsection{Guccifer 2.0}

On June~14, 2016, the DNC and its cyber-response team announced the breach of the DNC network and suspected theft of DNC documents.
In the statements, the cyber-response team alleged that Russian state-sponsored actors (which they referred to as ``Fancy Bear'') were responsible for the breach.% 145
\footnote{<NAME>, \textit{Bears in the Midst: Intrusion into the Democratic National Committee}, CrowdStrike Blog (June~14, 2016).
CrowdStrike updated its post after the June~15, 2016 post by Guccifer~2.0 claiming responsibility for the intrusion.}
Apparently in response to that announcement, on June~15, 2016, GRU officers using the persona Guccifer~2.0 created a WordPress blog.
In the hours leading up to the launch of that WordPress blog, GRU officers logged into a Moscow-based server used and managed by Unit 74455 and searched for a number of specific words and phrases in English, including ``some hundred sheets,'' ``illuminati,'' and ``worldwide known.''
Approximately two hours after the last of those searches, Guccifer~2.0 published its first post, attributing the DNC server hack to a lone Romanian hacker and using several of the unique English words and phrases that the GRU officers had searched for that day.% 146
\footnote{\textit{Netyksho} Indictment \P\P~41--42.}

That same day, June~15, 2016, the GRU also used the Guccifer~2.0 WordPress blog to begin releasing to the public documents stolen from the DNC and DCCC computer networks.
The Guccifer~2.0 persona ultimately released thousands of documents stolen from the DNC and DCCC in a series of blog posts between June~15, 2016 and October~18, 2016.% 147
\footnote{Releases of documents on the Guccifer~2.0 blog occurred on June~15, 2016;
June~20, 2016;
June~21, 2016;
July~6, 2016;
July~14, 2016;
August~12, 2016;
August~15, 2016;
August~21, 2016;
August~31, 2016;
September~15, 2016;
September~23, 2016;
October~4, 2016;
and October~18, 2016.}
Released documents included opposition research performed by the DNC (including a memorandum analyzing potential criticisms of candidate Trump), internal policy documents (such as recommendations on how to address politically sensitive issues), analyses of specific congressional races, and fundraising documents.
Releases were organized around thematic issues, such as specific states (\textit{e.g.}, Florida and Pennsylvania) that were perceived as competitive in the 2016 U.S. presidential election.

Beginning in late June 2016, the GRU also used the Guccifer~2.0 persona to release documents directly to reporters and other interested individuals.
Specifically, on June~27, 2016, Guccifer~2.0 sent an email to the news outlet The Smoking Gun offering to provide ``exclusive access to some leaked emails linked [to] Hillary Clinton's staff.''% 148
\footnote{6/27/16 Email, \UseVerb{guccifer20} to \blackout{Personal Privacy} (subject ``leaked emails''); \blackout{Investigative Technique}}
The GRU later sent the reporter a password and link to a locked portion of the \UseVerb{dcleaks} website that contained an archive of emails stolen by Unit 26165 from a Clinton Campaign volunteer in March 2016.% 149
\footnote{6/27/16 Email, \UseVerb{guccifer20} to \blackout{Personal Privacy} (subject ``leaked emails''); \blackout{Investigative Technique};
\textit{see also} 6/27/16 Email, \UseVerb{guccifer20} to \blackout{Personal Privacy} (subject ``leaked emails''); \blackout{Investigative Technique} (claiming DCLeaks was a ``Wikileaks sub project'').}
That the Guccifer~2.0 persona provided reporters access to a restricted portion of the DCLeaks website tends to indicate that both personas were operated by the same or a  closely-related group of people.% 150
\footnote{Before sending the reporter the link and password to the closed DCLeaks website, and in an apparent effort to deflect attention from the fact that DCLeaks and Guccifer~2.0 were operated by the same organization, the Guccifer~2.0 persona sent the reporter an email stating that DCLeaks was a ``Wikileaks sub project'' and that Guccifer~2.0 had asked DCLeaks to release the leaked emails with ``closed access'' to give reporters a preview of them.
}

The GRU continued its release efforts through Guccifer~2.0 into August 2016.
For example, on August~15, 2016, the Guccifer~2.0 persona sent a candidate for the U.S. Congress documents related to the candidate's opponent.% 151
\footnote{\textit{Netyksho} Indictment \P~43(a).}
On August~22, 2016, the Guccifer~2.0 persona transferred approximately 2.5 gigabytes of Florida-related data stolen from the DCCC to a U.S. blogger covering Florida politics.% 152
\footnote{\textit{Netyksho} Indictment \P~43(b).}
On August~22, 2016, the Guccifer~2.0 persona sent a U.S. reporter documents stolen from the DCCC pertaining to the Black Lives Matter movement.% 153
\footnote{\textit{Netyksho} Indictment \P~43(c).}

The GRU was also in contact through the Guccifer~2.0 persona with \blackout{HOM: Lorem} a former Trump Campaign member \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 154
\footnote{\blackout{Harm to Ongoing Investigation}}
In early August 2016, \blackout{Harm to Ongoing Matter} Twitter's suspension of the Guccifer~2.0 Twitter account.
After it was reinstated, GRU officers posing as Guccifer~2.0 wrote \blackout{HOM} a private message, ``thank u for writing back \dots\ do u find anyt[h]ing interesting in the docs i posted?''
On August~17, 2016, the GRU added, ``please tell me if i can help u anyhow \dots\ it would be a great pleasure to me.''
On September~9, 2016, the GRU---again posing as Guccifer~2.0---referred to a stolen DCCC document posted online and asked \blackout{HOM} ``what do u think of the info on the turnout model for the democrats entire presidential campaign.''
\blackout{HOM} responded, ``pretty standard.''% 155
\footnote{\blackout{Harm to Ongoing Investigation}}
The investigation did not identify evidence of other communications between \blackout{HOM} and Guccifer~2.0.

\subsubsection{Use of WikiLeaks}

In order to expand its interference in the 2016 U.S. presidential election, the GRU units transferred many of the documents they stole from the DNC and the chairman of the Clinton Campaign to WikiLeaks.
GRU officers used both the DCLeaks and Guccifer~2.0 personas to communicate with WikiLeaks through Twitter private messaging and through encrypted channels, including possibly through WikiLeaks's private communication system.

\paragraph{WikiLeaks's Expressed Opposition Toward the Clinton Campaign}

WikiLeaks, and particularly its founder Julian Assange, privately expressed opposition to candidate Clinton well before the first release of stolen documents.
In November 2015, Assange wrote to other members and associates of WikiLeaks that ``[w]e believe it would be much better for GOP to win\dots.
Dems+Media+liberals woudl [sic] then form a block to reign in their worst qualities\dots.
With Hillary in charge, GOP will be pushing for her worst qualities., dems+media+neoliberals will be mute\dots.
She's a bright, well connected, sadisitic [sic] sociopath.''% 156
\footnote{11/19/15 Twitter Group Chat, Group ID 594242937858486276, \UseVerb{atWikiLeaks} et~al.
Assange also wrote that, ``GOP will generate a lot oposition [sic], including through dumb moves.
Hillary will do the same thing, but co-opt the liberal opposition and the GOP opposition.
Hence hillary has greater freedom to start wars than the GOP and has the will to do so.'' \textit{Id.}}

In March 2016, WikiLeaks released a searchable archive of approximately 30,000 Clinton emails that had been obtained through FOIA litigation.% 157
\footnote{WikiLeaks, ``Hillary Clinton Email Archive,'' \textit{available at} \url{https://wikileaks.org/clinton-emails/}.}
While designing the archive, one WikiLeaks member explained the reason for building the archive to another associate:

\begin{quote}
[W]e want this repository to become ``the place'' to search for background on hillary's plotting at the state department during 2009--2013\dots.
Firstly because its useful and will annoy Hillary, but secondly because we want to be seen to be a resource/player in the US election, because eit [sic] may en[]courage people to send us even more important leaks.% 158
\footnote{3/14/16 Twitter DM, \UseVerb{atWikiLeaks} to \blackout{Personal Privacy}
Less than two weeks earlier, the same account had been used to send a private message opposing the idea of Clinton ``in whitehouse with her bloodlutt and amitions [sic] of empire with hawkish liberal-interventionist appointees.'' 11/19/15 Twitter Group Chat, Group ID 594242937858486276, \UseVerb{atWikiLeaks} et~al.}
\end{quote}

\paragraph{WikiLeaks's First Contact with Guccifer 2.0 and DCLeaks}

Shortly after the GRU's first release of stolen documents through \UseVerb{dcleaks} in June 2016, GRU officers also used the DCLeaks persona to contact WikiLeaks about possible coordination in the future release of stolen emails.
On June~14, 2016, \UseVerb{atdcleaks} sent a direct message to \UseVerb{atWikiLeaks}, noting, ``You announced your organization was preparing to publish more Hillary's emails.
We are ready to support you.
We have some sensitive information too, in particular, her financial documents.
Let's do it together.
What do you think about publishing our info at the same moment?
Thank you.''% 159
\footnote{6/14/16 Twitter DM, \UseVerb{atdcleaks} to \UseVerb{atWikiLeaks}.}
\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit.}

Around the same time, WikiLeaks initiated communications with the GRU persona Guccifer~2.0 shortly after it was used to release documents stolen from the DNC\null.
On June~22, 2016, seven days after Guccifer~2.0's first releases of stolen DNC documents, WikiLeaks used Twitter's direct message function to contact the Guccifer~2.0 Twitter account and suggest that Guccifer~2.0 ``[s]end any new material [stolen from the DNC] here for us to review and it will have a much higher impact than what you are doing.''% 160
\footnote{\textit{Netyksho} Indictment \P~47(a).}

On July~6, 2016, WikiLeaks again contacted Guccifer~2.0 through Twitter's private messaging function, writing, ``if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC is approaching and she will solidify bernie supporters behind her after.''
The Guccifer~2.0 persona responded, ``ok \dots\ i see.''
WikiLeaks also explained, ``we think trump has only a 25\% chance of winning against hillary \dots\ so conflict between bernie and hillary is interesting.''% 161
\footnote{7/6/16 Twitter DMs, \UseVerb{atWikiLeaks} \& \UseVerb{guccifer2}.}

\paragraph{The GRU's Transfer of Stolen Materials to WikiLeaks}

Both the GRU and WikiLeaks sought to hide their communications, which has limited the Office's ability to collect all of the communications between them.
Thus, although it is clear that the stolen DNC and Podesta documents were transferred from the GRU to WikiLeaks, \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit.}

The Office was able to identify when the GRU (operating through its personas Guccifer~2.0 and DCLeaks) transferred some of the stolen documents to WikiLeaks through online archives set up by the GRU\null.
Assange had access to the internet from the Ecuadorian Embassy in London, England.
\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation}% 162
\footnote{\blackout{Investigative Technique}}

On July~14, 2016, GRU officers used a Guccifer~2.0 email account to send WikiLeaks an email bearing the subject ``big archive'' and the message ``a new attempt.''% 163
\footnote{This was not the GRU's first attempt at transferring data to WikiLeaks.
On June~29, 2016, the GRU used a Guccifer~2.0 email account to send a large encrypted file to a WikiLeaks email account.
6/29/16 Email, \UseVerb{guccifer20mailcom}
\blackout{Investigative Technique}
(The email appears to have been undelivered.)}
The email contained an encrypted attachment with the name ``\UseVerb{wkdnclink1}.''% 164
\footnote{\textit{See} SM-2589105-DCLEAKS, serial 28 (analysis).}
Using the Guccifer~2.0 Twitter account, GRU officers sent WikiLeaks an encrypted file and instructions on how to open it.% 165
\footnote{6/27/16 Twitter DM, \UseVerb{Guccifer2} to \UseVerb{atWikiLeaks}.}
On July~18, 2016, WikiLeaks confirmed in a direct message to the Guccifer~2.0 account that it had ``the 1 Gb or so archive'' and would make a release of the stolen documents ``this week.''% 166
\footnote{7/18/16 Twitter DM, \UseVerb{Guccifer2} \& \UseVerb{atWikiLeaks}.}
On July~22, 2016, WikiLeaks released over 20,000 emails and other documents stolen from the DNC computer networks.% 167
\footnote{``DNC Email Archive,'' WikiLeaks (Jul.~22, 2016), \textit{available at} \url{https://wikileaks.org/dnc-emails}.}
The Democratic National Convention began three days later.

Similar communications occurred between WikiLeaks and the GRU-operated persona DCLeaks.
On September~15, 2016, \UseVerb{atdcleaks} wrote to \UseVerb{atWikiLeaks}, ``hi there!
I'm from DC Leaks.
How could we discuss some submission-related issues?
Am trying to reach out to you via your secured chat but getting no response.
I've got something that might interest you.
You won't be disappointed, I promise.''% 168
\footnote{9/15/16 Twitter DM, \UseVerb{atdcleaks} to \UseVerb{atWikiLeaks}.}
The WikiLeaks account responded, ``Hi there,'' without further elaboration.
The \UseVerb{atdcleaks} account did not respond immediately.

The same day, the Twitter account \UseVerb{guccifer2} sent \UseVerb{atdcleaks} a direct message, which is the first known contact between the personas.% 169
\footnote{9/15/16 Twitter DM, \UseVerb{guccifer2} to \UseVerb{atdcleaks}.}
During subsequent communications, the Guccifer~2.0 persona informed DCLeaks that WikiLeaks was trying to contact DCLeaks and arrange for a way to speak through encrypted emails.% 170
\footnote{\textit{See} SM-2589105-DCLEAKS, serial 28;
9/15/16 Twitter DM, \UseVerb{Guccifer2} \& \UseVerb{atWikiLeaks}.}

An analysis of the metadata collected from the WikiLeaks site revealed that the stolen Podesta emails show a  creation date of September~19, 2016.% 171
\footnote{\textit{See} SM-2284941, serials 63 \& 64 \blackout{Investigative Technique}}
Based on information about Assange's computer and its possible operating system, this date may be when the GRU staged the stolen Podesta emails for transfer to WikiLeaks (as the GRU had previously done in July 2016 for the DNC emails).% 172
\footnote{\blackout{Investigative Technique}. At the time, certain Apple operating systems used a setting that left a downloaded file's creation date the same as the creation date shown on the host computer.
This would explain why the creation date on WikiLeaks's version of the files was still September~19, 2016.
\textit{See} SM-2284941, serial 62 \blackout{Investigative Technique}}
The WikiLeaks site also released PDFs and other documents taken from Podesta that were attachments to emails in his account; these documents had a creation date of October~2, 2016, which appears to be the date the attachments were separately staged by WikiLeaks on its site.% 173
\footnote{When WikiLeaks saved attachments separately from the stolen emails, its computer system appears to have treated each attachment as a new file and given it a new creation date.
\textit{See} SM-2284941, serials 63 \& 64.}

Beginning on September~20, 2016, WikiLeaks and DCLeaks resumed communications in a brief exchange.
On September~22, 2016, a DCLeaks email account \UseVerb{dcleaksproject} sent an email to a WikiLeaks account with the subject ``Submission'' and the message ``Hi from DCLeaks.''
The email contained a PGP-encrypted message with the filename ``\UseVerb{wikimail}.''% 174
\footnote{\textit{See} 9/22/16 Email, \UseVerb{dcleaksproject} \blackout{Investigative Technique}}
\blackout{Investigative Technique}
The email, however, bears a number of similarities to the July~14, 2016 email in which GRU officers used the Guccifer~2.0 persona to give WikiLeaks access to the archive of DNC files.
On September~22, 2016 (the same day of DCLeaks' email to WikiLeaks), the Twitter account \UseVerb{atdcleaks} sent a single message to \UseVerb{atWikiLeaks} with the string of characters \blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}

The Office cannot rule out that stolen documents were transferred to WikiLeaks through intermediaries who visited during the summer of 2016.
For example, public reporting identified <NAME>{\"u}ller-Maguhn as a WikiLeaks associate who may have assisted with the transfer of these stolen documents to WikiLeaks.% 175
\footnote{Ellen Nakashima et~al., \textit{A German Hacker Offers a Rare Look Inside the Secretive World of Julian Assange and WikiLeaks}, Washington Post (Jan.~17, 2018).}
\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 176
\footnote{\blackout{Investigative Technique}}

On October~7, 2016, WikiLeaks released the first emails stolen from the Podesta email account.
In total, WikiLeaks released 33 tranches of stolen emails between October~7, 2016 and November~7, 2016.
The releases included private speeches given by Clinton;% 177
\footnote{\blackout{Personal Privacy}}
internal communications between Podesta and other high-ranking members of the Clinton Campaign;% 178
\footnote{\blackout{Personal Privacy}}
and correspondence related to the Clinton Foundation.% 179
\footnote{\textit{Netyksho} Indictment \P~43.}
In total, WikiLeaks released over 50,000 documents stolen from Podesta's  personal email account.
The last-in-time email released from Podesta's account was dated March~21, 2016, two days after Podesta received a spearphishing email sent by the GRU\null.

\paragraph{WikiLeaks Statements Dissembling About the Source of Stolen Materials}

As reports attributing the DNC and DCCC hacks to the Russian government emerged, WikiLeaks and Assange made several public statements apparently designed to obscure the source of the materials that WikiLeaks was  releasing.
The file-transfer evidence described above and other information uncovered during the investigation discredit WikiLeaks's claims about the source of material that it posted.

Beginning in the summer of 2016, Assange and WikiLeaks made a number of statements about <NAME>, a former DNC staff member who was killed in July 2016.
The statements about Rich implied falsely that he had been the source of the stolen DNC emails.
On August~9, 2016, the \UseVerb{atWikiLeaks} Twitter account posted: ``ANNOUNCE: WikiLeaks has decided to issue a US\$20k reward for information leading to conviction for the murder of DNC staffer Seth Rich.''% 180
\footnote{\UseVerb{atWikiLeaks} 8/9/16 Tweet.}
Likewise, on August~25, 2016, Assange was asked in an interview, ``Why are you so interested in <NAME>'s killer?'' and responded, ``We're very interested in anything that might be a threat to alleged Wikileaks sources.''
The interviewer responded to Assange's statement by commenting, ``I know you don't want to reveal your source, but it certainly sounds like you're suggesting a man who leaked information to WikiLeaks was then murdered.''
Assange replied, ``If there's someone who's potentially connected to our publication, and that person has been murdered in suspicious circumstances, it doesn't necessarily mean that the two are connected.
But it is a very serious matter \dots\ that type of allegation is very serious, as it's taken very seriously by us.''% 181
\footnote{\textit{See Assange: ``Murdered DNC Staffer Was `Potential' WikiLeaks Source,''} Fox News (Aug.~25, 2016) (containing video of Assange interview by <NAME>).}

After the U.S. intelligence community publicly announced its assessment that Russia was behind the hacking operation, Assange continued to deny that the Clinton materials released by WikiLeaks had come from Russian hacking.
According to media reports, Assange told a U.S. congressman that the DNC hack was an ``inside job,'' and purported to have ``physical proof\thinspace'' that Russians did not give materials to Assange.% 182
\footnote{M.~Raju \& Z.~Cohen, \textit{A GOP Congressman's Lonely Quest Defending Julian Assange}, CNN (May~23, 2018).}

\subsection{Additional GRU Cyber Operations}

While releasing the stolen emails and documents through DCLeaks, Guccifer~2.0, and WikiLeaks, GRU officers continued to target and hack victims linked to the Democratic campaign and, eventually, to target entities responsible for election administration in several states.

\subsubsection{Summer and Fall 2016 Operations Targeting Democrat-Linked Victims}

On July~27, 2016, Unit 26165 targeted email accounts connected to candidate Clinton's personal office \blackout{Personal Privacy}.
Earlier that day, candidate Trump made public statements that included the following: ``Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing.
I think you will probably be rewarded mightily by our press.''% 183
\footnote{``Donald Trump on Russian \& Missing Hillary Clinton Emails,'' YouTube Channel C-SPAN, Posted 7/27/16, \textit{available at} \url{https://www.youtube.com/watch?v=3kxG8uJUsWU} (starting at~0:41).}
The ``30,000 emails'' were apparently a reference to emails described in media accounts as having been stored on a personal server that candidate Clinton had used while serving as Secretary of State.

Within approximately five hours of Trump's statement, GRU officers targeted for the first time Clinton's personal office.
After candidate Trump's remarks, Unit 26165 created and sent malicious links targeting 15 email accounts at the domain \blackout{Personal Privacy} including an email account belonging to Clinton aide \blackout{Personal Privacy.}
The investigation did not find evidence of earlier GRU attempts to compromise accounts hosted on this domain.
It is unclear how the GRU was able to identify these email accounts, which were not public.% 184
\footnote{\blackout{Investigative Technique}}

Unit 26165 officers also hacked into a DNC account hosted on a cloud-computing service \blackout{Personal Privacy.}
On September~20, 2016, the GRU began to generate copies of the DNC data \blackout{Personal Privacy} function designed to allow users to produce backups of databases (referred to \blackout{Personal Privacy} as ``snapshots'').
The GRU then stole those snapshots by moving them to \blackout{Personal Privacy} account that they controlled; from there, the copies were moved to GRU-controlled computers.
The GRU stole approximately 300 gigabytes of data from the DNC cloud-based account.% 185
\footnote{\textit{Netyksho} Indictment \P~34;
\textit{see also} SM-2589105-HACK, serial 29 \blackout{Investigative Technique}}

\subsubsection{Intrusions Targeting the Administration of U.S. Elections}

In addition to targeting individuals involved in the Clinton Campaign, GRU officers also targeted individuals and entities involved in the administration of the elections.
Victims included U.S. state and local entities, such as state boards of elections (SBOEs), secretaries of state, and county governments, as well as individuals who worked for those entities.% 186
\footnote{\textit{Netyksho} Indictment \P~69.}
The GRU also targeted private technology firms responsible for manufacturing and administering election-related software and hardware, such as voter registration software and electronic polling stations.% 187
\footnote{\textit{Netyksho} Indictment \P~69; \blackout{Investigative Technique}}
The GRU continued to target these victims through the elections in November 2016.
While the investigation identified evidence that the GRU targeted these individuals and entities, the Office did not investigate further.
The Office did not, for instance, obtain or examine servers or other relevant items belonging to these victims.
The Office understands that the FBI, the U.S. Department of Homeland Security, and the states have separately investigated that activity.

By at least the summer of 2016, GRU officers sought access to state and local computer networks by exploiting known software vulnerabilities on websites of state and local governmental entities.
GRU officers, for example, targeted state and local databases of registered voters using a technique known as ``SQL injection,'' by which malicious code was sent to the state or local website in order to run commands (such as exfiltrating the database contents).% 188
\footnote{\blackout{Investigative Technique}}
In one instance in approximately June 2016, the GRU compromised the computer network of the Illinois State Board of Elections by exploiting a vulnerability in the SBOE's website.
The GRU then gained access to a database containing information on millions of registered Illinois voters,% 189
\footnote{\blackout{Investigative Technique}}
and extracted data related to thousands of U.S. voters before the malicious activity was identified.% 190
\footnote{\blackout{Investigative Technique}}

GRU officers \blackout{Investigative Technique} scanned state and local websites for vulnerabilities.
For example, over a two-day period in July 2016, GRU officers \blackout{Investigative Technique: Lorem ipsum dolor sit amet} for vulnerabilities on websites of more than two dozen states.
\blackout{Investigative Technique: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}
Similar \blackout{Investigative Technique:} for vulnerabilities continued through the election.

Unit 74455 also sent spearphishing emails to public officials involved in election administration and personnel at companies involved in voting technology.
In August 2016, GRU officers targeted employees of \blackout{Personal Privacy}, a voting technology company that developed software used by numerous U.S. counties to manage voter rolls, and installed malware on the company network.
Similarly, in November 2016, the GRU sent spearphishing emails to over 120 email accounts used by Florida county officials responsible for administering the 2016 U.S. election.% 191
\footnote{\textit{Netyksho} Indictment \P~76; \blackout{Investigative Technique}}
The spearphishing emails contained an attached Word document coded with malicious software (commonly referred to as a Trojan) that permitted the GRU to access the infected computer.% 192
\footnote{\blackout{Investigative Technique}}
The FBI was separately responsible for this investigation.
We understand the FBI believes that this operation enabled the GRU to gain access to the network of at least one Florida county government.
The Office did not independently verify that belief and, as explained above, did not undertake the investigative steps that would have been necessary to do so.

\subsection{Trump Campaign and the Dissemination of Hacked Materials}

The Trump Campaign showed interest in WikiLeaks's releases of hacked materials throughout the summer and fall of 2016.
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}

\subsubsection{[\protect\censor{Harm to Ongoing Matter}]}

\paragraph{Background}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}

\paragraph{Contacts with the Campaign about WikiLeaks}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 193
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}
On June~12, 2016, Assange claimed in a televised interview to ``have emails relating to <NAME> which are pending publication,''% 194
\footnote{\textit{See} <NAME>, \textit{Julian Assange Timed DNC Email Release for Democratic Convention}, Time (July~27, 2016) (quoting the June~12, 2016 television interview).}
but provided no additional context.

In debriefings with the Office, former campaign chairman <NAME> said that, \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 195
\footnote{In February 2018, Gates pleaded guilty, pursuant to a plea agreement, to a superseding criminal information charging him with conspiring to defraud and commit multiple offenses (\textit{i.e.}, tax fraud, failure to report foreign bank accounts, and acting as an unregistered agent of a foreign principal) against the United States, as well as making false statements to our Office.
Superseding Criminal Information, \textit{United States~v.\ Richard W. Gates~III}, 1:17-cr-201 (D.D.C. Feb.~23, 2018), Doc.~195 (``\textit{Gates} Superseding Criminal Information'');
Plea Agreement, \textit{United States~v.\ Richard W. Gates~III}, 1:17-cr-201 (D.D.C. Feb.~23, 2018), Doc.~205 (``\textit{Gates} Plea Agreement'').
Gates has provided information and in-court testimony that the Office has deemed to be reliable.}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}
Gates recalled candidate Trump being generally frustrated that the Clinton emails had not been found.% 196
\footnote{Gates 10/25/18 302, at~1--2.}

<NAME>, who would later become campaign chairman, \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 197
\footnote{\label{fnOneNineSeven}As explained further in \hyperlink{subsubsection.1.4.1.8}{Volume~I, Section~IV.A.8}, \textit{infra}, Manafort entered into a plea agreement with our Office.
We determined that he breached the agreement by being untruthful in proffer sessions and before the grand jury.
We have generally recounted his version of events in this report only when his statements are sufficiently corroborated to be trustworthy;
to identify issues on which Manafort's untruthful responses may themselves be of evidentiary value;
or to provide Manafort's explanations for certain events, even when we were unable to determine whether that explanation was credible.
His account appears here principally because it aligns with those of other witnesses.}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 198
\footnote{\blackout{Grand Jury}}

<NAME>, former executive vice president of the Trump Organization and special counsel to <NAME>,% 199
\footnote{In November 2018, Cohen pleaded guilty pursuant to a plea agreement to a single-count information charging him with making false statements to Congress, in violation of 18~U.S.C. \S~1001(a) \&~(c).
He had previously pleaded guilty to several other criminal charges brought by the U.S. Attorney's Office in the Southern District of New York, after a referral from this Office.
In the months leading up to his false-statements guilty plea, Cohen met with our Office on multiple occasions for interviews and provided information that the Office has generally assessed to be reliable and that is included in this report.}
told the Office that he recalled an incident in which he was in candidate Trump's office in Trump Tower
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 200
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 201
\footnote{\blackout{Harm to Ongoing Investigation}}
Cohen further told the Office that, after WikiLeaks's subsequent release of stolen DNC emails in July 2016, candidate Trump said to Cohen something to the effect of, \blackout{Harm to Ongoing Matter.}% 202
\footnote{Cohen 9/18/18 302, at~10.
\blackout{Harm to Ongoing Investigation} \blackout{Harm to Ongoing Investigation} \blackout{Harm to Ongoing Investigation}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}
According to Gates, Manafort expressed excitement about the release \blackout{Harm to Ongoing Matter}% 203
\footnote{Gates 10/25/18 302 (serial 241), at~4.}
Manafort, for his part, told the Office that, shortly after Wikileaks's July~22 release, Manafort also spoke with candidate Trump \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 204
\footnote{\blackout{Grand Jury}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 205
\footnote{\blackout{Grand Jury}}
Manafort also \blackout{Harm to Ongoing Matter} wanted to be kept apprised of any developments with WikiLeaks and separately told Gates to keep in touch \blackout{Harm to Ongoing Matter} about future WikiLeaks releases.% 206
\footnote{\blackout{Grand Jury}}

According to Gates, by the late summer of 2016, the Trump Campaign was planning a press strategy, a  communications campaign and messaging based on the possible release of Clinton emails by WikiLeaks.% 207
\footnote{Gates 4/10/18 302, at~3;
Gates 4/11/18 302, at~1--2 (SM-2180998);
Gates 10/25/18 302, at~2.}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 208
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua}
while Trump and Gates were driving to LaGuardia Airport.
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}, shortly after the call candidate Trump told Gates that more releases of damaging information would be coming.% 209
\footnote{Gates 10/25/18 302 (serial 241), at~4.}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 210
\footnote{\blackout{Harm to Ongoing Investigation}}

\paragraph{[\protect\censor{Harm to Ongoing Matter}]}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 211
\footnote{\blackout{Harm to Ongoing Investigation}}
Corsi is an author who holds a doctorate in political science.% 212
\footnote{Corsi first rose to public prominence in August 2004 when he published his book \textit{Unfit for Command: Swift Boat Veterans Speak Out Against John Kerry}.
In the 2008 election cycle, Corsi gained prominence for being a leading proponent of the allegation that <NAME> was not born in the United States.
Corsi told the Office that <NAME> expressed interest in his writings, and that he spoke with Trump on the phone on at least six occasions.
Corsi 9/6/18 302, at~3.}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 213
\footnote{Corsi 10/31/18 302, at~2;
\blackout{Grand Jury} Corsi was first interviewed on September~6, 2018 at the Special Counsel's offices in Washington, D.C.
He was accompanied by counsel throughout the interview.
Corsi was subsequently interviewed on September~17, 2018; September~21, 2018; October~31, 2018; November~1, 2018; and November~2, 2018.
Counsel was present for all interviews, and the interviews beginning on September~21, 2018 were conducted pursuant to a proffer agreement that precluded affirmative use of his statements against him in limited circumstances.}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.}% 214
\footnote{\blackout{Harm to Ongoing Investigation}}
Corsi told the Office during interviews that he ``must have'' previously discussed Assange with Malloch.% 215
\footnote{Corsi 10/31/18 302, at~4.}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}% 216
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}% 217
\footnote{\blackout{Harm to Ongoing Investigation}}

\blackout{Grand Jury: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}
According to Malloch, Corsi asked him to put Corsi in touch with Assange, whom Corsi wished to interview.
Malloch recalled that Corsi also suggested that individuals in the ``orbit'' of U.K. politician <NAME> might be able to contact Assange and asked if Malloch knew them.
Malloch told Corsi that he would think about the request but made no actual attempt to connect Corsi with Assange.% 218
\footnote{\blackout{Grand Jury}
Malloch denied ever communicating with Assange or WikiLeaks, stating that he did not pursue the request to contact Assange because he believed he had no
connections to Assange.
\blackout{Grand Jury}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}% 219
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}% 220
\footnote{\blackout{Harm to Ongoing Investigation}}

Malloch stated to investigators that beginning in or about August 2016, he and Corsi had multiple FaceTime discussions about WikiLeaks \blackout{Harm to Ongoing Matter: Lorem ipsum} had made a connection to Assange and that the hacked emails of John Podesta would be released prior to Election Day and would be helpful to the Trump Campaign.
In one conversation in or around August or September 2016, Corsi told Malloch that the release of the Podesta emails was coming, after which ``we'' were going to be in the driver's seat.% 221
\footnote{\blackout{Grand Jury}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 222
\footnote{\blackout{Harm to Ongoing Investigation} \blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 223
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 224
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 225
\footnote{\blackout{Harm to Ongoing Investigation}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 226
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 227
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 228
\footnote{\blackout{Harm to Ongoing Investigation}})

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 229
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 230
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 231
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 232
\footnote{\blackout{Harm to Ongoing Investigation}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 233
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 234
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 235
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 236
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 237
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 238
\footnote{\blackout{Harm to Ongoing Investigation}}

\paragraph{WikiLeaks's October~7, 2016 Release of Stolen Podesta Emails}

On October~7, 2016, four days after the Assange press conference \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit}, the Washington Post published an \textit{Access Hollywood} video that captured comments by candidate Trump some years earlier and that was expected to adversely affect the Campaign.% 239
\footnote{Candidate Trump can be heard off camera making graphic statements about women.}
Less than an hour after the video's publication, WikiLeaks released the first set of emails stolen by the GRU from the account of Clinton Campaign chairman <NAME>.

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 240
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 241
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 242
\footnote{\blackout{Harm to Ongoing Investigation}}

\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 243
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}
Corsi said that, because he had no direct means of communicating with WikiLeaks, he told members of the news site WND---who were participating on a conference call with him that day---to reach Assange immediately.% 244
\footnote{In a later November 2018 interview, Corsi stated \blackout{Harm to Ongoing Investigation} that he believed Malloch was on the call but then focused on other individuals who were on the call-invitation, which Malloch was not.
(Separate travel records show that at the time of the call, Malloch was aboard a transatlantic flight).
Corsi at one point stated that after WikiLeaks's release of stolen emails on October~7, 2016, he concluded Malloch had gotten in contact with Assange.
Corsi 11/1/18 302, at~6.}
Corsi claimed that the pressure was enormous and recalled telling the conference call the \textit{Access Hollywood} tape was coming.% 245
\footnote{During the same interview, Corsi also suggested that he may have sent out public tweets because he knew Assange was reading his tweets.
Our Office was unable to find evidence of any such tweets.}
Corsi stated that he was convinced that his efforts had caused WikiLeaks to release the emails when they did.% 246
\footnote{Corsi 9/21/18 302, at~6--7.}
In a later November 2018 interview, Corsi stated that he thought that he had told people on a WND conference call about the forthcoming tape and had sent out a tweet asking whether anyone could contact Assange, but then said that maybe he had done nothing.% 247
\footnote{Corsi 11/1/18 302, at~6.}

The Office investigated Corsi's allegations about the events of October~7, 2016 but found little corroboration for his allegations about the day.% 248
\footnote{\blackout{Harm to Ongoing Investigation} \blackout{Grand Jury}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 249
\footnote{\blackout{Harm to Ongoing Investigation}}
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 250
\footnote{\blackout{Harm to Ongoing Investigation} \blackout{Grand Jury} \blackout{Harm to Ongoing Investigation}}
However, the phone records themselves do not indicate that the conversation was with any of the reporters who broke the \textit{Access Hollywood} story, and the Office has not otherwise been able to identify the substance of the conversation.
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}% 251
\footnote{\blackout{Harm to Ongoing Investigation} \blackout{Grand Jury} \blackout{Harm to Ongoing Investigation} \blackout{Grand Jury} \blackout{Harm to Ongoing Investigation}}
However, the Office has not identified any conference call participant, or anyone who spoke to Corsi that day, who says that they received non-public information about the tape from Corsi or acknowledged having contacted a member of WikiLeaks on October~7, 2016 after a conversation with Corsi.

\paragraph{Donald Trump~Jr.\ Interaction with WikiLeaks}

Donald Trump~Jr.\ had direct electronic communications with WikiLeaks during the campaign period.
On September~20, 2016, an individual named <NAME> sent WikiLeaks the password for an unlaunched website focused on Trump's ``unprecedented and dangerous'' ties to Russia, \UseVerb{PutinTrumporg}.% 252
\footnote{9/20/16 Twitter DM, \UseVerb{atJasonFishbein} to \UseVerb{atWikiLeaks};
see JFO0587 (9/21/16 Messages, \blackout{Personal Privacy}\UseVerb{atjabber} \& \blackout{Personal Privacy}\UseVerb{atjabber};
Fishbein 9/5/18 302, at~4.
When interviewed by our Office, Fishbein produced what he claimed to be logs from a chatroom in which the participants discussed U.S. politics;
one of the other participants had posted the website and password that Fishbein sent to WikiLeaks.}
WikiLeaks publicly tweeted: ``\thinspace`Let's bomb Iraq'
Progress for America PAC to launch `\UseVerb{PutinTrumporg}' at 9:30am. Oops pw is `putintrump' \UseVerb{putintrumporg}.''
Several hours later, WikiLeaks sent a Twitter direct message to <NAME>~Jr., ``A PAC run anti-Trump site \UseVerb{putintrumporg} is about to launch.
The PAC is a recycled pro-Iraq war PAC\null.
We have guessed the password.
It is `<PASSWORD>.'
See `About' for who is behind it.
Any comments?''% 253
\footnote{9/20/16 Twitter DM, \UseVerb{atWikiLeaks} to \UseVerb{DJTJ}.}

Several hours later, Trump~Jr.\ emailed a variety of senior campaign staff:

\begin{quote}
Guys I got a weird Twitter DM from wikileaks.
See below.
I tried the password and it works and the about section they reference contains the next pic in terms of who is behind it.
Not sure if this is anything but it seems like it's really wikileaks asking me as I follow them and it is a DM\null.
Do you know the people mentioned and what the conspiracy they are looking for could be?
These are just screen shots but it's a fully built out page claiming to be a PAC let me know your thoughts and if we want to look into it.% 254
\footnote{TRUMPORG\_28\_000629--33 (9/21/16 Email, Trump~Jr.\ to Conway et~al.\ (subject ``Wikileaks'')).}
\end{quote}

Trump~Jr.\ attached a screenshot of the ``About'' page for the unlaunched site \UseVerb{PutinTrumporg}.
The next day (after the website had launched publicly), Trump~Jr.\ sent a direct message to WikiLeaks:
``Off the record, I don't know who that is but I'll ask around. Thanks.''% 255
\footnote{9/21/16 Twitter DM, \UseVerb{DJTJ} to \UseVerb{atWikiLeaks}.}

On October~3, 2016, WikiLeaks sent another direct message to Trump~Jr., asking ``you guys'' to help disseminate a link alleging candidate Clinton had advocated using a drone to target <NAME>.
Trump~Jr.\ responded that he already ``had done so,'' and asked, ``what's behind this Wednesday leak I keep reading about?''% 256
\footnote{10/3/16 Twitter DMs, \UseVerb{DJTJ} \& \UseVerb{atWikiLeaks}.}
WikiLeaks did not respond.

On October~12, 2016, WikiLeaks wrote again that it was ``great to see you and your dad talking about our publications.
Strongly suggest your dad tweets this link if he mentions us \UseVerb{wlsearchtk}.''% 257
\footnote{At the time, the link took users to a WikiLeaks archive of stolen Clinton Campaign documents.}
WikiLeaks wrote that the link would help Trump in ``digging through'' leaked emails and stated, ``we just released Podesta emails Part~4.''% 258
\footnote{10/12/16 Twitter DM, \UseVerb{atWikiLeaks} to \UseVerb{DJTJ}.}
Two days later, Trump~Jr.\ publicly tweeted the \UseVerb{wlsearchtk} link.% 259
\footnote{\UseVerb{DJTJ} 10/14/16 (6:34~a.m.) Tweet.}

\subsubsection{Other Potential Campaign Interest in Russian Hacked Materials}

Throughout 2016, the Trump Campaign expressed interest in Hillary Clinton's private email server and whether approximately 30,000 emails from that server had in fact been permanently destroyed, as reported by the media.
Several individuals associated with the Campaign were contacted in 2016 about various efforts to obtain the missing Clinton emails and other stolen material in support of the Trump Campaign.
Some of these contacts were met with skepticism, and nothing came of them; others were pursued to some degree.
The investigation did not find evidence that the Trump Campaign recovered any such Clinton emails, or that these contacts were part of a coordinated effort between Russia and the Trump Campaign.

\paragraph{<NAME> (a/k/a <NAME>)}

In the spring of 2016, Trump Campaign advisor <NAME> learned through a Florida-based Russian business partner that another Florida-based Russian, <NAME> (who also went by the name <NAME>), claimed to have information pertaining to <NAME>.
Caputo notified Roger Stone and brokered communication between Stone and Oknyansky.
Oknyansky and Stone set up a May~2016 in-person meeting.% 260
\footnote{Caputo 5/2/18 302, at~4;
Oknyansky 7/13/18 302, at~1.}

Oknyansky was accompanied to the meeting by <NAME>, a Ukrainian associate involved in Florida real estate.
At the meeting, Rasin offered to sell Stone derogatory information on Clinton that Rasin claimed to have obtained while working for Clinton.
Rasin claimed to possess financial statements demonstrating Clinton's involvement in money laundering with Rasin's companies.
According to Oknyansky, Stone asked if the amounts in question totaled millions of dollars but was told it was closer to hundreds of thousands.
Stone refused the offer, stating that Trump would not pay for opposition research.% 261
\footnote{Oknyansky 7/13/18 302, at~1--2.}

Oknyansky claimed to the Office that Rasin's motivation was financial.
According to Oknyansky, Rasin had tried unsuccessfully to shop the Clinton information around to other interested parties, and Oknyansky would receive a cut if the information was sold.% 262
\footnote{Oknyansky 7/13/18 302, at~2.}
Rasin is noted in public source documents as the director and/or registered agent for a number of Florida companies, none of which appears to be connected to Clinton.
The Office found no other evidence that Rasin worked for Clinton or any Clinton-related entities.

In their statements to investigators, Oknyansky and Caputo had contradictory recollections about the meeting.
Oknyansky claimed that Caputo accompanied Stone to the meeting and provided an introduction, whereas Caputo did not tell us that he had attended and claimed that he was never told what information Oknyansky offered.
Caputo also stated that he was unaware Oknyansky sought to be paid for the information until Stone informed him after the fact.% 263
\footnote{Caputo 5/2/18 302, at~4;
Oknyansky 7/13/18 302, at~1.}

The Office did not locate Rasin in the United States, although the Office confirmed Rasin had been issued a  Florida driver's license.
The Office otherwise was unable to determine the content and origin of the information he purportedly offered to Stone.
Finally, the investigation did not identify evidence of a connection between the outreach or the meeting and Russian interference efforts.

\paragraph{Campaign Efforts to Obtain Deleted Clinton Emails}

After candidate Trump stated on July~27, 2016, that he hoped Russia would ``find the 30,000 emails that are missing,'' Trump asked individuals affiliated with his Campaign to find the deleted Clinton emails.% 264
\footnote{Flynn 4/25/18 302, at~5--6;
Flynn 5/1/18 302, at~1--3.}
<NAME>---who would later serve as National Security Advisor in the Trump Administration---recalled that Trump made this request repeatedly, and Flynn subsequently contacted multiple people in an effort to obtain the emails.% 265
\footnote{Flynn 5/1/18 302, at~1--3.}

<NAME> and <NAME> were among the people contacted by Flynn.
Ledeen, a long-time Senate staffer who had previously sought the Clinton emails, provided updates to Flynn about her efforts throughout the summer of 2016.% 266
\footnote{ Flynn 4/25/18 302, at~7; Flynn 5/4/18 302, at~1--2; Flynn 11/29/17 302, at~7--8.}
Smith, an investment advisor who was active in Republican politics, also attempted to locate and obtain the deleted Clinton emails.% 267
\footnote{ Flynn 11/29/17 302, at~7.}

Ledeen began her efforts to obtain the Clinton emails before Flynn's request, as early as December 2015.% 268
\footnote{Szobocsan 3/29/17 302, at~1.}
On December~3, 2015, she emailed Smith a proposal to obtain the emails, stating, ``Here is the proposal I briefly mentioned to you.
The person I described to you would be happy to talk with you either in person or over the phone.
The person can get the emails which 1.~Were classified and 2.~Were purloined by our enemies.
That would demonstrate what needs to be demonstrated.''% 269
\footnote{19/3/15 Email, Ledeen to Smith.}

Attached to the email was a 25-page proposal stating that the ``Clinton email server was, in all likelihood, breached long ago,'' and that the Chinese, Russian, and Iranian intelligence services could ``re-assemble the server's email content.''% 270
\footnote{12/3/15 Email, Ledeen to Smith (attachment).}
The proposal called for a three-phase approach.
The first two phases consisted of open-source analysis.
The third phase consisted of checking with certain intelligence sources ``that have access through liaison work with various foreign services'' to determine if any of those services had gotten to the server.
The proposal noted, ``Even if a single email was recovered and the providence [sic] of that email was a foreign service, it would be catastrophic to the Clinton campaign[.]''
Smith forwarded the email to two colleagues and wrote, ``we can discuss to whom it should be referred.''% 271
\footnote{12/3/15 Email, Smith to Szobocsan \& Safron.}
On December~16, 2015, Smith informed Ledeen that he declined to participate in her ``initiative.''
According to one of Smith's business associates, Smith believed Ledeen's initiative was not viable at that time.% 272
\footnote{Szobocsan 3/29/18 302, at~1.}

Just weeks after Trump's July 2016 request to find the Clinton emails, however, Smith tried to locate and obtain the emails himself.
He created a company, raised tens of thousands of dollars, and recruited security experts and business associates.
Smith made claims to others involved in the effort (and those from whom he sought funding) that he was in contact with hackers with ``ties and affiliations to Russia'' who had access to the emails, and that his efforts were coordinated with the Trump Campaign.% 273
\footnote{8/31/16 Email, Smith to Smith.}

On August~28, 2016, Smith sent an email from an encrypted account with the subject ``Sec.~Clinton's unsecured private email server'' to an undisclosed list of recipients, including Campaign co-chairman <NAME>.
The email stated that Smith was ``[j]ust finishing two days of sensitive meetings here in DC with involved groups to poke and probe on the above.
It is clear that the Clinton's home-based, unprotected server was hacked with ease by both State-related players, and private mercenaries.
Parties with varying interests, are circling to release ahead of the election.''% 274
\footnote{8/28/16 Email, Smith to Smith.}

On September~2, 2016, Smith directed a business associate to establish KLS Research LLC in furtherance of his search for the deleted Clinton emails.% 275
\footnote{Incorporation papers of KLS Research LLC, 7/26/17 \blackout{Grand Jury}
Szobocsan 3/29/18 302, at~2.}
One of the purposes of KLS Research was to manage the funds Smith raised in support of his initiative.% 276
\footnote{Szobocsan 3/29/18 302, at~3.}
KLS Research received over \$30,000 during the presidential campaign, although Smith represented that he raised even more money.% 277
\footnote{Financial Institution Record of <NAME> and KLS Research LLC, 10/31/17 \blackout{Grand Jury} 10/11/16 Email, Smith to \blackout{Personal Privacy}}

Smith recruited multiple people for his initiative, including security experts to search for and authenticate the emails.% 278
\footnote{Tait 8/22/17 302, at~3; York 7/12/17 302, at~1--2; York 11/22/17 302, at~1.}
In early September 2016, as part of his recruitment and fundraising effort, Smith circulated a document stating that his initiative was ``in coordination'' with the Trump Campaign, ``to the extent permitted as an independent expenditure organization.''% 279
\footnote{York 7/13/17 302 (attachment KLS Research, LLC, ``Clinton Email Reconnaissance Initiative,'' Sept.~9, 2016).}
The document listed multiple individuals affiliated with the Trump Campaign, including Flynn, Clovis, Bannon,
and <NAME>.% 280
\footnote{The same recruitment document listed <NAME> under ``Independent Groups/Organi-zations/Individuals,'' and described him as an ``established author and writer from the right on President Obama and Sec.~Clinton.''}
The investigation established that Smith communicated with at least Flynn and Clovis about his search for the deleted Clinton emails,% 281
\footnote{Flynn 11/29/17 302, at~7--8; 10/15/16 Email, Smith to Flynn et~al.;
8/28/16 Email, Smith to Smith (bcc: Clovis et~al.).}
but the Office did not identify evidence that any of the listed individuals initiated or directed Smith's efforts.

In September 2016, Smith and Ledeen got back in touch with each other about their respective efforts.
Ledeen wrote to Smith, ``wondering if you had some more detailed reports or memos or other data you could share because we have come a long way in our efforts since we last visited\dots.
We would need as much technical discussion as possible so we could marry it against the new data we have found and then could share it back to you `your eyes only.'\thinspace''% 282
\footnote{9/16/16 Email, Ledeen to Smith.}

Ledeen claimed to have obtained a trove of emails (from what she described as the ``dark web'') that purported to be the deleted Clinton emails.
Ledeen wanted to authenticate the emails and solicited contributions to fund that effort.
<NAME> provided funding to hire a tech advisor to ascertain the authenticity of the emails.
According to Prince, the tech advisor determined that the emails were not authentic.% 283
\footnote{Prince 4/4/18 302, at~4--5.}

A backup of Smith's computer contained two files that had been downloaded from WikiLeaks and that were originally attached to emails received by <NAME>.
The files on Smith's computer had creation dates of October~2, 2016, which was prior to the date of their release by WikiLeaks.
Forensic examination, however, established that the creation date did not reflect when the files were downloaded to Smith's computer.
(It appears the creation date was when WikiLeaks staged the document for release, as discussed in \hyperlink{paragraph.1.3.2.3.3}{Volume~I, Section~III.B.3.c}, \textit{supra}.% 284
\footnote{The forensic analysis of Smith's computer devices found that Smith used an older Apple operating system that would have preserved that October~2, 2016 creation date when it was downloaded (no matter what day it was in fact downloaded by Smith).
\textit{See} \hyperlink{paragraph.1.3.2.3.3}{Volume~I, Section~III.B.3.c}, \textit{supra}.
The Office tested this theory in March 2019 by downloading the two files found on Smith's computer from WikiLeaks's site using the same Apple operating system on Smith's computer;
both files were successfully downloaded and retained the October~2, 2016 creation date.
\textit{See} SM-2284941, serial 62.
})
The investigation did not otherwise identify evidence that Smith obtained the files before their release by WikiLeaks.

Smith continued to send emails to an undisclosed recipient list about Clinton's deleted emails until shortly before the election.
For example, on October~28, 2016, Smith wrote that there was a ``tug-of-war going on within WikiLeaks over its planned releases in the next few days,'' and that WikiLeaks ``has maintained that it will save its best revelations for last, under the theory this allows little time for response prior to the U.S. election November~8.''% 285
\footnote{10/28/16 Email, Smith to Smith.}
An attachment to the email claimed that WikiLeaks would release ``All 33k deleted Emails'' by ``November~1st.''
No emails obtained from Clinton's server were subsequently released.

Smith drafted multiple emails stating or intimating that he was in contact with Russian hackers.
For example, in one such email, Smith claimed that, in August 2016, KLS Research had organized meetings with parties who had access to the deleted Clinton emails, including parties with ``ties and affiliations to Russia.''% 286
\footnote{8/31/16 Email, Smith to Smith.}
The investigation did not identify evidence that any such meetings occurred.
Associates and security experts who worked with Smith on the initiative did not believe that Smith was in contact with Russian hackers and were aware of no such connection.% 287
\footnote{Safron 3/20/18 302, at~3; Szobocsan 3/29/18 302, at~6.}
The investigation did not establish that Smith was in contact with Russian hackers or that Smith, Ledeen, or other individuals in touch with the Trump Campaign ultimately obtained the deleted Clinton emails.

\hr

In sum, the investigation established that the GRU hacked into email accounts of persons affiliated with the Clinton Campaign, as well as the computers of the DNC and DCCC\null.
The GRU then exfiltrated data related to the 2016 election from these accounts and computers, and disseminated that data through fictitious online personas (DCLeaks and Guccifer~2.0) and later through WikiLeaks.
The investigation also established that the Trump Campaign displayed interest in the WikiLeaks releases, and that \blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.}
As explained in \hyperlink{subsection.1.5.2}{Volume~I, Section V.B}, \textit{infra}, the evidence was sufficient to support computer-intrusion (and other) charges against GRU officers for their role in election-related hacking.
\blackout{Harm to Ongoing Matter: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco labor is nisi ut aliquip ex ea commodo consequat.}
