Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 1 of 50 PageID# 184

AO 106(Rev. 04/10) Application for a Search Warrant

United States District

for the / ' ' •
Eastern District of Virginia '' .
In the Matter ofthe Search of tJnd^ S.^l- ,
(Briefly desctibe the propertyio be searched
or identify the person by name and adA-ess) Case No. 1:17SW449

THE PREMISES LOCATED J

■■■I ALEXANDRIA, VIRGINIA 22314

APPUCATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penally of perjury that I have rei^bh to believe that oh the following person or property (identify the person or describe the
property to be searched and give its location):

See Attachment A
located in the Eastem District of Virginia , diere is now concealed (identify the
person or describe the property to be seized)'.
See Attachment B

The basis for the search under Fed. R. Grim. P. 41(o) is (check one or more):
fif evidence of a crime;
isf contraband, Suits of crime, or other items illegally possessed;
sT properly designed for use, intended for use, or used in committing a crime;
□ a person to be arrested or a person who is unlawfiilly restrained.
The search is related to a violation of;

Code Section Offense Description

See attached Affidavit.

The application is based on these facts;

See attached Affidavit.

QT Continued on the attached sheet.

□ Delayed notice of days (give exact ending date if more than 30 days; ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA; Applicant's sighattce

Special Agent, FBI

Printed name and title
/s/
Sworn to before me and signed in my presence.
TJieresa Carfoil Buchanan
UniietJ-Staies Magistrate Judge
Date; 07/26/2017
Judge's signature

Chy and state; Alexandria, VA The Honorable Theresa 0. Buchanan

Printed name and title
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 2 of 50 PageID# 185

ATTACHMDENTA

The Property to Be Searched

The premises to be searched (the'"Subject Premises") is the condominium unit located at

Alexandria, VA 22314,including the storage unit numbered J

B as well as any locked drawers, containers, cabinets, safes; coinputers, electronic devices, and
storage media(such as hard disks or other media that can store data)found therein.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 3 of 50 PageID# 186

ATTACHMENTS

Items to Be Seized (or,in the alternative,identified)

1, Records relating to violations of31 U.S.C.§§ 5314,5322(a)(Mure to file areport

offoreign bank and financial accounts);22 U.S.C. § 611,et seq.(foreign agents registration act);
26 U.S.C. § 7206(1)(filing a false tax return); 18 U.S.C, § 1014 (fraud in connection with the
extension ofcredit); 18 U.S.C.§§ 1341,1343,and 1349(mail fraud, wire fraud,and conspiracy to
commit these offenses); 18 U.S.C. §§ 1956 and 1957(money laundering and money laundering
conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18
U.S.C. §§ 371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses)
(collectively, the "Subject Offenses"), occurring on or after January 1, 2006, including but not
limited to:

a. Any and all financial records for Paul Manafort, Jr.,(H^^^^^^^RMard

Gates, or companies associated with Paul ManafortrJrT^HH^^HH
Richard Gates,including but notlimited to records relating to any foreign financial
accounts and records relating to payments by or on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

b. Any and all federal and state tax documentation, including but not limited to
personal and business tax returns and all associated schedules for Paul Manafort,
Jr., Richard Gates, or companies associated with Manafort or Gates;

c. Letters, correspondence, emails, or other forms of communications with any

foreign financial institution, or any individual acting as the signatory or controlling
any foreign bank account;

d. Records relating to efforts by Manafort, Gates,or their affiliated entities to conduct

activities on behalf of, for the benefit of, or at the direction of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals, including but not limited to the Party of Regions and Viktor
Yanukovych;

e. Records relating to, discussing, or documenting Telmar Investments Limited,

Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited,
Black Sea View Limited,Bletilla Ventures Limited,Evo Holdings Limited,'Global
. Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited,Peranova
Holdings Limited, including but not limited to bank records, canceled checks,
money drafts, letters of credit, cashier's checks, safe deposit records, checkbooks,
and check stubs, duplicates and copies ofchecks, deposit items,savings passbooks,
wire transfer records, and similar bank and financial accoimt records;

f. Physical items purchased through the use offunds from Cypriot accounts,including
but notlimited to rugs purchased fix>m a Bijan Black Titanium
^'Royal Way" watch, and clothing purchased from
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 4 of 50 PageID# 187

g. Evidence relevant to any false statements, pretenses, representations, or material

omissions in connection with communications with the Department of Justice, the
Internal Revenue Service,tax preparers, accountants, or banks;

h. Communications, records, > documents, and other files involving any of the
attendees of the June 9,2016 meeting at Trump tower, as well as Aras and Amin
Agalorov;

i. Evidence indicating Manafort's state of mind as it relates to the crimes under

investigation;

j. The identity of any person(s)—^including records that help reveal the whereabouts
ofthe person(s)—who communicated with Manafort about any matters relating to
activities conducted by Manafort on behalfof,for the benefit of, or at the direction
of any foreign government, foreign ofBcials, foreign entities, foreign persons, or
foreign principals;

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort
or Gates.

2. Computers or storage media used as a means to commit the Subject Offenses.

3. For any computer or storage medium whose seizure is otherwise authorized by

this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant(hereinafter,"COMPUTER"):
a. evidence of who used,owned,or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted,such as logs,
registry entries, configuration files, saved usemames and passwords,
documents, browsing history, user profiles, email, email contacts,"chat,"
instant messaging logs, photographs, and correspondence;
b. evidence ofsoftware that would allow others to control the COMPUTER,
such as vimses, Trojan horses, and other forms of malicious software, as well
as evidence ofthe presence or absence ofsecurity software designed to detect
malicious software;

c. evidence ofthe lack ofsuch malicious software;

d. evidence indicating how and when the computer was accessed or used to
determine the chronological context ofcomputer access, use, and events
relating to crime imder investigation and to the computer user;
e. evidence indicating the computer user's state of mind as it relates to the crime
under investigation;
f. evidence ofthe attachmentto the COMPUTER ofother storage devices or
similar containers for electronic evidence;
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 5 of 50 PageID# 188

g. evidence ofcounter-forensic programs(and associated data)that are designed

to eliminate data from the COMPUTER;

h. evidence ofthe times the COMPUTiBR was used;

i. passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

j. documentation and manuals that may be necessary to access the COMPUTER

or to conduct a forensic examination ofthe COMPUTER;

k. records ofor information about Intemet Protocol addresses used by the

COMPUTER;

1. records ofor information about the COMPUTER'S Intemet activity, including

firewall logs, caches, browser history and cookies,"bookmarked" or
"favorite" web pages,search terms that the user entered into any Intemet
search engine, and records of user-typed web addresses;
m. contextual information necessary to understand the evidence described in this
attachment.

As used above, the terms "records" and "information" includes all forms of creation or

storage, including any form of computer or electronic storage (such as hard disks or other media
that can store data); any handmade form(such as writing); any mechanical form (such as printing
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives,
videotapes, motion pictures, or photocopies).

The term "computer" includes all types of electronic, magnetic, optical, electrochemical,
or other high speed data processing devices performing logical* arithmetic, or storage functions,
including desktop computers,notebook computers, mobile phones,tablets, semr computers, and
network hardware.

The term "storage medium" includes any physical object upon which computer data can

be recorded^ Examples include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and
other magnetic or optical media.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 6 of 50 PageID# 189

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF VIRGINIA
KLrJUNlA
'JUL 25 2(1(7
Alexandria Division (. '

Criminal No. l:17-sw-449

THE PREMISES LOCATED AT I
ALEXANDRIA, Filed Under Seal
VIRGINIA 22314

' AFFTOAVrriN SUPPORT OF AN

APPLICATION FOR A SEARCH WARRANT

Federal Bureau ofInvestigation('TBr'), being duly sworn, deposes and

says:

I. Ritroduction

A. Affiant

1. I am a Special Agent with the FBI and have been since 2015. I am cuirently

assigned to the investigation being conducted by the Department of Justice Special Counsel As a

Special Agent of the FBI, I have received training and ejqperience in investigating criminal and

national security matters. Prior to my employment with theIBI,Ispent seven years in the software

industry and have extensive experience working with computer technology.

2. I make this affidavit in support of an application pursuant to Rule 41 ofthe Federal

Rules of Criminal Procedure for a warrant to search the premises located at

mm Alexandria; Virginia 22314 (the "Subject Premises")* which is described more

particularly in Attachment A,in order to locate and seize (and/or photograph)the items described

in Attachment B. This affidavit is based upon my personal knowledge, my review of documents

and other evidence, my conversations with other law enforcement persoimel, and my training and

experience. Because this affidavit is being submitted for the limited purpose of establishing

probable cause, it does not include all the facts that I have learned during the course of my
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 7 of 50 PageID# 190

investigation.' Where the contents of documents and the statements, and conversations of others
\

are reported herein, they are reported in substance and in pertinent part, except where otherwise

indicated.

B. The Subject Offenses

3. For the reasons detailed below, there is probable cause to believe that the Subject

Premises contain evidence, fruits, and instrumentalities of violations of: 31 U.S.C. §§ 5314,

5322(a)(failure to file a report offoreign bank and financial accounts); 22 U.S.C. § 611, et. seq,

(foreign agents registration act); 26 U.S.C. § 7206(1)(filing a false tax retum); 18 U.S.C. § 1014

(fraud in connection with the extension ofcredit); 18 U.S.C. §§ 1341,1343,and 1349(mail fraud,
wire fraud, and conspiracy to commit these offenses); 18 U.S.C. §§ 1956 and 1957 (money

laundering and money laundering conspiracy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2)(foreign

contribution ban); and 18 U.S.C. §§ 371 and 2(conspiracy, aiding and abetting, and attempt to

commit such offenses)(collectively, the "Subject Offenses").

n. Probable Cause

4. As setforth herein,there is probable cause to believe that the Subject Offenses have

been committed by Paul J. Manafort, Jr., the former campaign chairman of Donald Trump for

President, Inc., and others known and unknown. Between at least 2006 and 2014, Manafort, a

United States citizen, worked as a lobbyist and political consultant for the Party of Regions, a

Ukrainian political party commonly believed to be aligned with Russia. There is probable cause

to believe that Manafort engaged in a scheme to hide income paid on behalf of Ukrainian

politicians and others through foreign bank accounts in Cyprus and elsewhere,to and on behalfof

Manafort and related people and companies.

5. There is also probable cause to believe that Manafort participated in a scheme to

I financial
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 8 of 50 PageID# 191

institution, by providing false information to, and withholding material information from,]

related to the loans.

6. By way of background concerning Manafort, based on publicly available

information,in March of2016, Manafort officially joined Donald J. Trump for President,Inc.(the

'Trunq)Campaign"),the presidential campaign ofthen candidate Trump,in order to, among other

things, help.manage the delegate process for the Republican National Convention. In May of

2016, Manafort became chairman ofthe Trump Campaign. In June of2016, Manafort reportedly

became defacto manager for the Trun^ Campaign with the departure of prior campaign manager

Corey Lewandowski. On August 19, 2016, after public reports regarding connections between

Manafort, Ukraine, and Russia - including an alleged ^Tslack ledger" of off-the-book payments

from the Party of Regions to Manafort - Manafort left his post as chairman of the Trump

Campaign.

7. Portions of the information set forth below (as well as certain additional facts not

relevant herein) were set forth in(1)an affidavit by Special Agent

submitted in support of a warrant to search a storage locker in Alexandria, Virginia

used by Manafort ("Storage Locker Search Warrant");(2) an affidavit by Special Agent

submitted in support of a search warrant for the email account used

by Manafort('Email Search Warrant"); and (3) an affidavit by Special Agent

UmillHH submitted in support of a warrant to search a hard drive associated with

Manafort's business entities ("Hard Drive Search Warrant"). On May 27, 2017, the Honorable

Theresa Carroll Buchanan, United States Magistrate Judge for the Eastern District of Virginia,
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 9 of 50 PageID# 192

issued the Storage Locker Search Wairant upon a jSnding ofprobable cause; on June 21,2017,the

Honorable James L. Cott, United States Magistrate Judge for the Southern District of New York,

issued the fimail Search Warrant upon a finding of probable cause; and on June 14, 2017, Chief

Judge Beryl Howell of the District of the District of Columbia issued the Hard Drive Search
Warrant upon a finding of probable cause. Copies of the search wamant affidavits are attached
hereto as Attachments C-E,respectively.

Manafort's Work for Ukraine

8. The information contained herein is based on public records; bank records and

reports; Davis Manafort records; tax .filings by Manafort and Richard W. Gates, lU, a Davis
Manafort en^)loyee;the June 2017 fihng by DMP International,LLC,Manafort, and Gates under
the Foreign Agents Registration Act(FARA); and statements by Manafort and Gates to the FBI,
among other things.

9. Manafort and Gates have been en:q)loyed for many years through Davis Manafort

and related entities as lobbyists and political consultants working both in the United States and
internationally. Beginning in or about 200(5 and at least until 2014, Manafort provided political
and policy services to the Ukrainian Party of Regions,including Viktor Yanukovych, head of the
Party of Regions and the President of Ukraine from 2010 to 2014. Gates told the FBI in an
interview in July 2014("the Gates Interview") that he was hired by Manafort in 2006 and worked
on Ukrainian election and policy advice, up to the time of the interview. Gates advised that in
2010,he and Manafort were in Ukraine for over two months leading up to the election that brought

Yanukovych to power. Manafort told the FBI in ah interview also in July 2014 ("the Manafort
Interview")that he performed work for the Party of Regions, as well as significant work for Rinat

Akhmetov, a financial supporter of President Yanukovych, and for Oleg Deripaska, a Russian
oligarch.

4
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 10 of 50 PageID# 193

10. Based on reporting from multiple sources, the FBI believes that Yanukovych's

government engaged in systematic public corruption. The same sources report that corrupt

government officials and their allies in the business community during Yanukovych*s presidency

looted Ukraine's public coffers of millions of dollars and fonneled those assets to foreign bank

accounts to hide the embezzlement. The current government of Ukraine has sought the assistance

ofthe United States and Cypras to locate and recover these misappropriated assets. Yanukovych,

who fled to Russia in 2014, is currently wanted in Ukraine for numerous criiniaal violations,

including the embezzlement and misappropriation of public property. In late June 2017, media

outlets such as Bloomberg reported that Ukrainian prosecutors had uncovered no evidence ofillicit

payments to Manafort as part of their investigation into suspected criminal conduct by former

Ukrainian officials. In a statement available on its public website dated June 29,2017, Ukraine's

National Anti-Corruption Bureau of Ukraine (NABU) provided the following context by

announcing that it "did not conduct an official investigation regarding Paul Manafort. He has

never been a Ukrainian official, and therefore cannot commit corruption acts, according to the

Ukrainian laws. An assessment of the actions of the abovementioned person should be made by

the competent authorities ofother countries, whose jurisdiction extends to the investigation ofthe

facts of probable offenses."

1. Payments from Cypiiot Accounts to and for Manafort

11. From in or about at least 2008 to at least 2014, payments from bank accounts in

Cyprus - nominally owned by foreign companies - were used to make payments to (a) United

States corporate and personal bank accounts controlled by Manafort or Gates and(b)United States

vendors for services provided to Manafort or Gates. During this time period, tens of millions of
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 11 of 50 PageID# 194

dollars from these foreign accounts were paid "directly"^ and indirectly to Manafort, Gates, and

Manafort-related entities.

12. Based on the evidence setforth more folly below,there is probable cause to believe

that Manafort and Gates maintained Cypriot bank accounts held in the names ofnumerous entities,

which include those listed in the chart below:

Company Bank Name Account # Transaction Example

On or about June 27,
Telmar Bank of 2014, $250,000 was sent
Investments Cyprus PCL to an account in the name
Limited Ltd —— of DMP International,
LLC at HSBC Bank.
On or about September 2,
2010,$1 million was sent
to an account in the name
of Global Sites LLC at
Yiakora Bank of Wachovia Bank.
Ventures Cyprus PCL On or about June 4,2008,
Limited Ltd $8 million was sent to an
account in the name of
Jesand Investnient
Corporation at First
Republic Bank
Cyprus On or about November 9,
Popular Bank 2012, $300,000 was sent
Lucicle
(Previously to an account in-the name
Consultants
Marfin of DMP International,
Limited '
Popular LLC at JPMorganChase
Bank) Bank.
Cyprus On or about August 1,
Popular Bank 2012,$70,000 was sent to
Actinet
(Previously
Trading an account m the name of
Marfin
Limited DMP International, LLC
Popular at JPMorganChase Bank
B^)

^ The term "directly" is used to differentiate the "indirect" Manafort payments made to vendors
that provided services to Manafort. Wires from GypriOt accounts that were sentto Davis M^afort
would also at various times be passed tbrou^ more lhan one United States account afOliated with
Manafort before being used to pay for Davis Manafort expenses as well as other items.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 12 of 50 PageID# 195

Company Bank Name , Account # Transaction Example

Cyprus On or about December
Popular Bank 21, 2011, $1 million was
Black Sea (Previously sent to an account in the
View Limited Marfb name of Paul J Manafort
Popular andHimH^^^I
Bank) at First Republic Bank.
Cyprus On or about April 10,
Popular Bank 2012, $900,000 was sent
BletiUa
(Previously to an account in the name
Ventures
Marfin of DMP Intemational,
Limited
Popular LLC at JPMorganChase
Bank) Bank.
Cyprus
On or about January 30,
Popular Bank 2009,$70,000 was sent to
Evo Holdings (Previously an account in the name of
Limited Marfin
Davis Manafbrt Partners,
Popular Inc. at Wachovia Bank.
Bank)
Cyprus On or about December
Popular Bank 23, 2009, $500,000 was
Global
(Previously sent to an account in the
Highway nanie of Davis Manafort
Marfin
Limited
Popular Partners, Inc; at
Bank) Wachovia BanL
Cyprus On or about May 27,
Popular Bank 2011, $258,000 was sent
Leviathan
(Previously to an account in the name
Advisors
Marfin of Davis Manafort
Limited
Popular Partners, Inc. at First
Bank) Republic Bank.
Cyprus Oh or about October 7,
Popular Bank 2010, $120,000 was sent
Loav
(Previously to an account in the name
Advisors
Marfin of Paul J Manafort and
Limited
Popular
Bank) Wachovia BanL
Cyprus On or about June 27,
Popular Bank 2012, $650,000 was sent
Lucicle
(Previously to an account in the name
Consultants
Marfin of DMP International,
Limited
Popular LLC at JPMorganChase
Bank) Bank.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 13 of 50 PageID# 196

Company Bank Name Account # Transaction Example

Cyprus On or about February 1,
Popular Bank 2012, $1.5 million was
Peranova
(Previously sent to an account in the
Holdings
Marfin name of DMP
Limited
Popular — International, LLC at
Bank) First Republic Bank. .
On or about January 16,
Telmar 2014, $500,000 was sent
Eurobank
Investments to an account in the name
Cyprus Ltd
Limited of DMP International,
LLCatHSBCBank.
On or about April 8,2013,
Actinet $200,000 was sent to an
Hellenic Bank
Trading account in the name of
PCLLtd
Limited DMP International, LLC
atHSBCBank.
On or about March 1,
BletiUa 2013, $300,000 was sent
Hellenic Bank
Ventures to an account in the name
PCLLtd —
Limited of Symthson LLC at
. JPMorganChase Bank.
On or about February 15,
Lucicle 2013, $500,000 was sent
Hellenic Bank
Consultants to an account in the name
PCLLtd
Limited of Symthson LLC at
JPMorganChase Bank.

13. The FBI has obtained bank records tiiat evidence that Manafort controlled and/or

held executive positions at the following United States entities, which received tens of millions of

dollars jfromthe above-listed financial accounts in Cyprus between at least 2008 to at least 2014;

(1)Davis Manafort Partners, Inc.;

(2)DMP International, LLC;
(3)Global Sites LLC;and
(4)Jesand Investment Corporation^.

^ Jesand Investment Corporation was incorporated in Virginia in 2002 and dissolved in 2013. It
lists its addresses as Manafort's addresses in Alexandria, Virginia and Palm Beach Gardens,
Florida, *'Jesand" is
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 14 of 50 PageID# 197

Bank records also reflect that Gates held signature authority over the account in the name of

Symthson LLC^.

14. In addition, bank records evidence that millions of dollars were wired directly from

the Cypriot accounts to pay vendors for goods and services provided to and for Manafort. For

instance,funds flrom these foreign accounts were used to rent a villa in Italy at which the Manaforts

vacationed (over $49,000); to pay for rugs from an Alexandria store called

.(over $360,000); to pay for landscaping services for.the Manaforts (over $395,000); and to pay

two separate clothiers clothing purchased by Manafort

(over $400,000 and $360,000 respectively). The records for one of the clothiers

-evidence that Manafort was aware ofand controlled these foreign wire payments, as he noted to

the vendor in two spring 2011 emails that the vendor would be paid shortly from the Leviathan

Holdings Cypriot account, noted above.

15. Manafort and Gates have both told the FBI in interviews in 2014 that they were
S I

paid for their work for the Ukrainian Party of Regions through Cypriot bank accounts. In the

Manafort Interview, Manafort claimed he did not know who specifically set up the Cypriot

accounts, but they were vehicles used to pay him for public political services. Manafort

specifically acknowledged that any money flowing from the accounts held in the name of Global

Highway Ltd. and Leviathan(two entities listed above) would have been money he earned from

his services. In the Gates Interview, Gates admitted he was directed to open accounts m Cyprus

by President Yanukoyych's Chief of Staff Boris Kolesnikov. He was told it was easier for them

to be paid from one Cyprus account to another Cyprus account. Gates said that various oligarchs

^ Smythson LLC was incorporated in Delaware in 2008. Note that bank accounts for this company
were opened under the name "Symthson," using addresses listed for Manafort in other of his
companies.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 15 of 50 PageID# 198

would chip in to pay them for their consulting work. Gates identified Lucicle, BletUla,Leviathan,

and Global Endeavor(among others) as accounts opened to receive such payments.

16. In addition, in 2014 Manafort wrote to the First Republic Bank, a United States

finandal institution, to object to the bank's determination to close all the Manafort-related

accounts based on its anti-money laundering policies and concerns about incoming international

wires. In his correspondence to the bank, Manafort admitted he was paid by Ukraine but he
claimed that the money he received from Ukraine was for "very public consulting services" from
"legitimate activities that were totally legal." Manafort also wrote the bank that he had "[n]o
interaction with oligarchs for business." However,in the ManafortInterview conducted that same

year, Manafort told the FBI that he did significant work for Deripaska, a Russian oligarch. And
in March 2017,in response to press reports concerning a written annual contract between Manafort
and Deripaska, Manafort publicly confirmed that he had provided investment consulting services
to Deripaska interests.

Deripaska helped fund Manafort's Ukrainian work when it began in 2005-06.^^ And the 2010 tax
returns for a company jointly owned by Manafort and his wife — John Hannah,LLC® — reveals a
$10,000,000 loan to the company from a '^Russian lender." A court-authorized search in May
2017 of a storage locker in Virginia used by Manafort revealed documents that show that the

® John Hannflh, LLC was located at the same address as Davis Manafort,Inc.|
Alexandria, Virginia, 22314, and received mail there. The company also
received mail at the Manafort home in Florida. Hjjim the name ofthe conpany is derived from
the respective middle names of Manafort and Gates. Manafort declared on his tax returns,
discussed below,income from John Hannah,LLC.

10
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 16 of 50 PageID# 199

identity of the Russian lender was *T)erapaska." Finally, in the Gates Interview, Gates admitted

that Manafort met with another oligarch, discuss a New York real estate

transaction they would undertake together and to pitch other ideas. In the Manafort Interview,

Manafoit also admitted approaching to propose the New York deal, which according to

business records publicly filed in a New York litigation was initiated in 2008.

2. Manafort and Gates Tax Returns

17. There is probable cause to believe that Manafort failed to properly disclose to the

United States government his ^relationship to the Ukrainian Party of Regions, the income he

received (directly or indirectly) as a result of his work for that party, and the existence offoreign

accounts in which he held a financial interest(and into which payments from Ukrainian politicians

were deposited, as discussed above).

18. . Pursuant to a tax order from the Eastern District of Virginia(Buchanan, J.) dated

April 14,2017,the FBI has obtained and reviewed, among others, the tax returns for Manafort

and Gates for 2009-2014. In aU ofthe tax returns, Manafort and Gates submitted a Schedule B

form, which required them to declare whether they have "an interest in or a signature or other

authority over a financial account in a foreign country, such as a bank account, securities

account,or other financial account." Each year, Manafort and Gates declared **No." That same

form also contained a cross-reference to the requirement to file a Report ofForeign Bank and

Financial Accounts(FBAR)to report overseas financial interests or signature authority. An

FEAR filing is required, on a yearly basis, if a United States person has a financial interest in or

signatory authority over at least one financial account located outside the United States and at

least $10,000 in aggregate value in foreign accounts at any time during the calendar year. As

discussed above, there is probable cause to believe that Manafort and Gates had a financial

11
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 17 of 50 PageID# 200

interest,in excess of$10,000,in various accounts in Cyprus in at least 2008-14. A review of

data from the Financial Crimes Enforcement Network(commonly known as FinCEN)shows

that Manafort and Gates have not filed an FBAR for at least the years 2008 to the present.

19. A search ofthe United States Department ofJustice database ofall agents currently

or previously registered under FARA,conducted in July 2017, also discloses that Manafort,Gates,

and their affiliated entities, including Davis Manafort, failed to register as agents of a foreign

government until June 27,2017.® As long-time lobbyists, Manafort and Gates would know about

the FARA requirements. Indeed,in email.communications between Gates and||^^BIl^Hi

(a United States lobbying and public ajBfairs firm) concerning joint Ukraine work. Gates

demonstrated that he was clearly aware in 2012 ofFARA filing rules.

20. In addition, the foreign source income listed in the tax returns for Manafort does

not appear to account for the above distributions to or from the Cj^riot accounts on his behalf.

For instance, the 2009 Manafort tax retum indicates $17,736 in gross foreign source income;in

2010,$42,789; in 2011,$165,871;in 2012,$129,777;in 2013,$38,375; and in 2014,$39,468.

21. The bank records, however, reveal the following:

• In 2008,the Cypriot accounts transferred at least $3,500,000to accountsin thejoint

names of Paul and HIH Manafort and transferred at least $9,000,000 to

accounts of United States entities affiliated with Manafort.

• In 2009,the Cypriot accounts transferred at least $1,500,000to accounts in the joint

names of Paul and Manafort, transferred at least $35,000 to accounts in

the names of Manafort's relatives, transferred at least $3,000,000 to accounts of

The database is publicly available at https://www.fara.gov/.

12
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 18 of 50 PageID# 201

United States entities aJBOliated with Manafort, and transferred at least $200,000 to

accounts ofthird parties as payment for the benefit of Manafort.

• In 2010,the Cypriot accounts transferred atleast $2,000,000to accounts in the joint

names of Paul and Manafort, transferred at least $80,000 to accounts in

the names of Manafoit's relatives, transferred at least $6,000,000 to United States

entities affiliated with Manafort, and transferred at least $600,000 to accounts of

third parties as payment for the benefit ofManafort.

• In 2011, the Cypriot accounts transferred at least $1,800,000 to an account in the

joint names of Paul and HIHI Manafort, transferred at least $30,000 to an

account in the name of a Manafort relative, transferred at least $3,000,000 to an

account of a United States entity affiliated with Manafort, and transferred at least

$500,000 to accounts ofthird parties as payment for the benefit of Manafort.

• In 2012,the Cypriot accounts transferred at least $200,000to an accountin the joint

names of Paul and Manafort,transferred at least $8,500,000 to accounts

of United States entities affiliated with Manafort, and transferred at least

$1,000,000 to accounts ofthird parties as payment for the benefit of Manafort.

• In 2013,the Cypriot accounts transferred at least $2,500,000 to accounts of United

States entities affiliated with Manafort and transferred at least $1,000,000 to

accounts ofthird parties as payment for the benefit of Manafort.

• In 2014,the Cypriot accounts transferred at least $5,000,000 to accounts of United

States entities affiliated with Manafort.

22. There appears to be no legitimate business reason for these transactions, which

appear to pass fonds fiom a Ukrainian political party through more than one Cypriot bank

13
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 19 of 50 PageID# 202

account; have payments made directly to United States vendors from the Cypriot accounts; and

pass money brought onshore from Cyprus through multiple United States accounts. Based on

my training and experience,these transactions evidence in my view the crimes oftax evasion

and money laundering to conceal the origins of the ftinds paid to Manafort and Gates.

B. Manafort's Loan Applications

23. There is also probable cause to believe that Manafort made misrepresentations and

material omissions for the purpose of securing loans from|^BII^^HIIIi^^H^^HH

and is a Federal Deposit Insurance Corporation member bank.

The information contained herein is based on information set forth in the attached

Afridavit, which is based on public records, financial records and reports, court records, and

information provided by other law enforcement personnel, among other things.

24. Based on court filings and records obtained from Genesis Capital Corporation

("Genesis"), in February 2016, Genesis, through an affiliated entity, extended two loans to MC
Brooklyn Hpldings LLC('MC Brooklyn Holdings") totaling approximately $5.3 million. MC
Brooklyn Holdings is the holding con^any for atownhouse located at Brooklyn,
New York 11231 ("Brooklyn Property*'). MC Brooklyn Holdings' members are Manafort,H

Manafort also personally guaranteed the $5.3 million loans from Genesis.

25. Additionally, based on documents obtained from^H^Febraary 2016, Genesis

frinded a refinance and constmction loan for approximately $3.7 million, secured by a property

located Hm^l^miBBHLos Angeles, California("Los Angeles Property"). The Los

AngelesProperty was held by^^^m^^m||||[||H|LLC,a company in which(as ofFebmary
2016)Manafort and^^|held equal interest.

14
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 20 of 50 PageID# 203

26. Both sets of Genesis loans went into default in 2016. As a consequence,- on.

September 20,2016,a Genesis affiliate filed an action in New York Supreme Court,Kings County

(the foreclosure Action"), seeking to foreclose the loans encumbering the Brooklyn Property.

After its initiation, the Foreiclosure Action was adjourned several times as Manafort and|m
sought refinancing.

27. As explained in theBHIAfiidavit attached hereto,based on documents obtained

fiommibeginning in 2016,Manafort began negotiations with||||||||for the extension ofloans
for several purposes, including to refinance the Genesis loans that were in default. These

negotiations ultimately resulted in^^|extending two sets of loans to Manafort-linked entities

in the total amount of approximately $16 million. One loan, for approximately $9.5 million

(enough to cover the outstanding balance on the Genesis loan secured by the Los AngelesProperty)

was extended to a conjpany called Summerbreeze LLC that was owned by

(hereinafter, the Summerbreeze Loan"). A second set of loans, in the amount of

$6.5 miUion, was secured by the Brooklyn Property and was used to refinance the Genesis loans

secured by that property (hereinafter, "the Brooklyn Property Loan"). That refinancing

ultimately terminated the Genesis Foreclosure Action.

28. As described below,Manafort made several materially inconsistent representations

during the process of negotiating for theH||||loans, including by making substantially different
representations about his income and net worth on different loan applications (signed and

unsigned) within a three-month period. And|

15
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 21 of 50 PageID# 204

1. Extension of Refinancing Loan

29. According to documents obtained firomjm on or about July 27,2016,Manafort

met-with I

to discuss a proposed loan fiomm to refinance the Genesis loan secured by the Los Angeles
Property("the Genesis Los Angeles Loan"). H and other members oftheH^|loan committee
approved the terms of this loan the next day.

16
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 22 of 50 PageID# 205

33. On or about September 8,2016,Manafort's attorney transmitted to

|H a demand
letter to||||||||||^^n^m||| ^ collector, which demanded payofffor missed June
and July payments on the Genesis Los Angeles Loan, including late fees and over $2,000 dahy

interest on the late fees. IIIH forwarded this document to

writing: "Just a lyi-looks like these guys are in default to Genesis "HHB wrote back:

"It is what it is. Let's send it offto and have it be part of the file.

2. Extension of Additional RelBnancing Loan Despite Manafort's Initial

$1 Miilion Understatement of Original Loan Amount

34. Based on documents obtained fi:om||^|in late August 2016, at approximately

the time when Manafort officially left his position with the Trump Campaign, the company

Summerbreeze LLC was formed, withjBI^HIIHHm^^^Hi^ member,

mm records show that Summerbreeze LLC then took out a loan ftom a subsidiary of the jeal
estate investment company ^ amount of approximately $3.5 million,

secured by real estate in Water Mill, New York (hereinafter,the'HB Loan").

35.

17
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 23 of 50 PageID# 206

37. On September 27,2016, copies ofmortgage

statements showing that the Loan was for approximately $3.5 million.

replied to aU recipients: "What the hell he just took the loan out at the end

of August how can he be $1,000,000 oft!" replied,

^*He is so in debt."

FBI agents interviewed

|

who stated in substance, among other things, as follows:

a. She discussed the loan withBBHI^^HIil^HH^HB^ course of

her work on the loan, ^dBH^I expressed to her on several occasions that the
proposed Manafort loan was a bad loan.

b. There were several issues with the proposed Manafort loan. For example, when
she ran Manafort*s credit report in August of 2016, she saw that his credit had

dropped significantly compared to his last credit report in June, due to an

18
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 24 of 50 PageID# 207

approximately $300,000 debt Manafort had incurred on his American Express card

(which Manafort claimed was because he had allowed a Mend to use it to buy New

York Yankees season tickets). Additionally, a number of Manafoit's assets turned

out to be.less valuable than ejected. Two pieces of real estate considered as

collateral were each appraised at over $1 million less than the e:q)ected value, and

an investment account of Manafort's, which had believed would /have a

balance of$10 million, had a lower effective value because Manafort had taken out

a$5 million line ofcredit against it. also considered it unusualto approve

a construction loan (as the proposed Manafort loan was planned to be) for

borrowers who,like Manafort andlim^acked construction e^qperience. She also

considered it unusual that||||^| was willing to fiind the loan despite Manafort's
and|||||||IH default to Genesis Capital.

19
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 25 of 50 PageID# 208

40. In early October 2016, before Manafort and closed on the originally
contemplated refinancing of the Genesis Los Angeles Loan, documents provided byH^|show
that Manafort sought a second loan bromjUII tlmt would refinance the Genesis loans secured by
the Brooklyn Property, which were the subject ofGenesis's Foreclosure Action filed in September
2016.

3. Manafort's Conflicting Representations in His Loan Applications

I

41. During the course of applying and negotiating for lending fromHH Manafort
made a series ofconflicting representations in his loan applications about his income and net worth.
Documents produced by mi show that on August 11, 2016, Manafort digitally signed a loan
application for the proposed Los Angeles Property refinancing that listed his income as $275,000
per month and his personal net worth as $17,051,676.17.

20
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 26 of 50 PageID# 209

42. Two loans applications for them Sununerbreeze Loan were also produced by
m[unsigned by Manafort but dated October 26, 2016. Both listed Manafort's income as
approximately $224,846 per month. One listed the net worth of Manafort and his wife, as co-

borrowers, as $21,376,722.13, and Ae other listed their net worth as $6 million lower, or

$15,376,722.13.

43. Two days after the date of these applications, on or about October 28, 2016,

Manafort and his wife signed a loan application for the TFSB Sununerbreeze Loan listing

Manafort's income as $100,652 per month and their net worth as co-borrowers as $34,685,418.13.

44. On or about three days after that application was submitted,or November 1,2016,

Manafort and his wife signed a loan application for the BrooJdyn Property Loan, which

listed Manafort's income as $224,846 per month and their net worth as co-boirowers as

$14,994,402.13.

45. Following these representations, the Sununerbreeze Loan closed on

November 16, 2016. Of the total loan amount of $9.5 million, $7 million was underwritten by

The fuaalHH credit approval memorandum produced by^H

did not mention the Los Angeles Property Loan default or the Foreclosure Action against

Manafort, and it assigned the^^H Summerbreeze Loan a risk factor of"4(Average)." m|[

46. On January 17,2017,the^^|Brooklyn Property Xx>an was funded, resulting in

$6.5 million being paid for the benefit of Manafort and his wife. The Genesis Foreclosure Action

21
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 27 of 50 PageID# 210

was terminated by stipulation executed the next day. The jSnalj^JPcredit approval memorandum
produced by did not mention the default on the Genesis loans or the Foreclosure Action and
assigned theH|||||[ Brooklyn Property Loan a risk factor of"4(Average)."

22
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 28 of 50 PageID# 211

23
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 29 of 50 PageID# 212

24
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 30 of 50 PageID# 213

25
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 31 of 50 PageID# 214

26
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 32 of 50 PageID# 215

27
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 33 of 50 PageID# 216

D. The Subject Premises

60. Law enforcement databases and mortgage records show that Manafort maintains

several residences, including a residence at the Subject Premises. The Subject Premises is located

in a complex called Appraisal and title insurance documentation

obtained jGromim indicate that the Subject Premises is a three-bedroom condominium unit with
2779 square feet of living space and includes two parking spaces numbered and and
one storage unit numbered|H A law enforcement database shows that the property was
purchased by Paul and ^^H|||[ Manafort on or about January 15,2015 for $2,700,000 in cash.
61. In email communications in July 2016, bank officials at HHIHUHHI
who were working to approve loan to Manafort-related entities(as described above)characterized
the Subject Premises as Manafort*s '^primary residence." hi subsequent paperwork,
identified Manafort's residence in Florida as his primary residence on the basis of Manafort's use

ofthat address for income tax purposes.

62. In several voluntary meetings with the FBI, ^individual who

works for Manafort, confirmed that Manafort maintains a residence at the Subject Premises.

informed the FBI that he previously worked for Davis Manafort and that in late 2011 he

began working more directly for Manafort. He currently receives his salary from Steam Mountain,

LLC,which is another business operated by Manafort. |||[[H| advised that he performs a variety
offunctions for Manafort and his companies, as directed by Manafort.

28
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 34 of 50 PageID# 217

63. In spring of 2017, HHI advised the FBI that in approximately 2015, at the
direction of Manafort,HH moved boxes of office files for Manafort's businesses fioni one

smaller storage unit at 370 Holland Lane, Alexandria, Virginia, to a larger storage unit(Unit 3013)
I

at the same storage facility. HIadvised that he personally moved the ofhce files into Unit

3013. A search of Unit 3013 at 370 HoUand Lane was conducted in late May of2017 pursuant to

a warrant issued by Magistrate Judge Theresa Carroll Buchanan. That search confirmed the

information provided the FBI. Among the items that the FBIidentified in that search were

tax returns for Manafort and various Manafort-related business entities, documents related to

Ukraine and the Party ofRegions, and various financial documents. A copy ofthat search warrant

affidavit is attached hereto.

64. Ill^l told the FBI that Manafort moved from his former residence on Mount
Vemon Circle (alSo in Alexandria, VA)to the Subject Premises in or around May of 2015, and

that he impersonally helped Manafort move belongings from the former residence to the
Subject Premises and to the aforementioned storage locker on 370 Holland Lane. |[|||i also
advised that the Subject Premises includes its own separate locked storage unit, which is used to

store, among other things, miscellaneous items of furniture. The last time ||||||||[i accessed the
storage unit was in March or April 2017.

65. HHH iiidicated that Manafort used his home to do business and maintained
records of his businesses at his home. For instance, some of the material that was moved to Unit

3013 included files from Manafort's former residence on Mount Vemon Circle in Alexandria,

Virginia. indicated that Manafort was using his former residence as an office at the time.

also advised the FBI that company documentation was being kept at the Subject

Premises. In particular,HH informed the FBI that in late April or early May of2017,1

29
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 35 of 50 PageID# 218

I told him that She and Manafort were reorganizing their lives and as part of that process

were getting documents ready for meetings with their attorney. At the same time,HH saw
miscellaneous documents on.a coffee table at the Subject Premises, including but not limited to

Federal Election Commission documents.

66. Hm also informed the FBI that one ofthe rooms in the Subject Premises is used
as an office, and that IIIH has seen business records in that ofdce, including in one or two
drawers. Among the records maintaiaed in the drawers were records related to Manafoit's various
business entities^ including John Hannah LLC (as discussed in Paragraph 16 above) and, he

believes, DMP International,IXC.

67. In an interview with the FBI on July 19, 2017,ll^l indicated that the last time
he was inside the Subject Premises was on or about July 5,2017, when he picked up Manafort's
Tnflil and shipped a suit to another Manafort residence at Manafort's request; and the last time he

was at the Subject Premises was on or about July 11, 2017, when he took|m|||^H^|to
the akport.

68. It is reasonable to believe that business records related to Manafort's work in

Xlkraiae, including historical records, would be maintained among the business files kept.at the
Subject Premises, including the files kept for use in consulting with counsel. On June 27, 2017,
Manafort,Gates,and DMP Intemational,LLC registered under FARA for the years 2012-2014 as

a result of their political work in Ukraine, having failed to do so previously. This registration
followed a series of communications between Manafort, his counsel, and officials in the United

States Department of Justice's National Security Division (which administers the FARA
registration process) about the FARA requirements. At least one ofthese communications, dated
September 13, 2016, was directed to Manafort at ^ Alexandriia, VA,

30
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 36 of 50 PageID# 219

i.e., the Subject Premises. It is therefore reasonable to believe that records relating to this filing

(and thus related to ManaforPs feilure to file previously) are maintained at the Subject Premises,

including records of Manafort's work on behalf of the Party of Regions and payments received

fi:om them. Among other things, in the Gates Interview, Gates told the FBI that Manafort and he

Used "standard English" common law contracts for their Ukrainian work and would invoice the

customer for payment.^

69. These records are particularly valuable since counselfor Manafort has informed the

United States Department of Justice that at least as of November 23, 2016, DMP International,

LLC purports to have an "Email Retention Policy" which results in its not retaining

"communications beyond thirty days." In spite of its title, the policy purports to cover not just

email, but "information that is either stored or shared via electronic mail or instant messaging

technologies, and documentation residing on any computer or server." The policy also purports

to provide that "[ejach en^loyee may at its [sic] discretion archive certain electronic information

that pertains to the con5)any's business or mission," but the the employee "must do so with the

knowledge that all emails,electronic documents and other electronic material shall be deleted from

corporate equipment,including but not limited to,computers, servers, and mobile devices, within

30 days of possession ofthe information."

70. There is also probable cause to believe that the Subject Premises contains records

related to Manafort's efforts to secure loans fi:om|H|||on the basis ofinconsistentrepresentations

about his income and net worth, as described above. Records obtained from|HH show that in

^ In contrast,in their June 27,2017,FARA filings. Gates, Manafort, and DMP International, LLC
indicated that there was no formal written contract of exchange of correspondence between the
parties. In such circumstances, the FARA form requires the filer to "give a corrqplete description"
of the terms and conditions of the oral agreement or understanding, its duration, the fees and
expenses,if any, to be received." The June 2017 filings provide none ofthat information.

31
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 37 of 50 PageID# 220

approximately August 2016,Manafort submitted bank statements for two accounts at Cititom
in connection with his application for lending. One ofthe two bank statements submitted to m|||
is addressed tojjH^HHIi address ofthe Subject Premises. Bank records also show
that beginning in December 2016,bank statements for the other account were directed to the same

address. Accordingly, there is probable cause to believe that bank statements and other

documentation related to those accounts, which formed part of the consideration of

Manafort's request for lending, could be found at the Subject Premises.

71. Additionally, there is probable cause to believe that other financial records relevant

to the Subject Offenses wiU be found at the Subject Premises. Manafort's prior residence in
Alexandria, listed as the address of record for a number of

accounts,including accounts at First Republic Bank ici Chicago that were closed in 2014following

anti-money laundermg concerns by the bank, as discussed in Paragraph 16 above. Prom my

training and experience,I am aware that individuals and businesses often retain copies offinancial
records for several years, including m connection with tax filing obligations. Accordingly, and

given the fact that Manafort and his wife moved to the Subject Premises from his prior residence
in the same city in approximately May of 2015, it is reasonable to believe that financial records
sent to his prior residence may be found at the Subject Premises. Additionally, a mail cover
conducted by the PBI, involving the review of the outside cover of United States Postal Service
(USPS) TTiflil addressed to the Subject Premises, reveals that during the period between

approximately June 13, 2017 and July 12, 2017, mail to the Subject Premises included, among

other things, a first class mailing:&om^H[mH|||||^HBH M&T Bank,

and a statement from American Express addressed to both Paul Manafort and *Davis Manafort

Part," which I believe to refer to Davis Manafort Partners,

32
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 38 of 50 PageID# 221

72. Further, there is probable cause to believe that the Subject Premises contains

physical evidence in the form of physical items purchased through the use offunds from foreign

bank accounts, including from the Cypriot bank accounts described above. For instance, given

that Manafort lives at the premises, there is probable cause to believe that men's clothing and

accessories purchased at one or both of the clothing vendors and paid for by wire transfers from

various Cyprus accounts, as referenced in Paragraph 14 above, will be found at the Subject

premises. Bank records and records obtained from the clothiers show that between 2009 and 2012,

Manafort purchased more than approximately $760,000 in merchandise from these two clothiers

using funds wired from several of the Cypriot accounts. Purchases included multiple suits and

jackets in excess of$10,000 and at least one limited edition Bijan Black Titanium '*Royal Way"

watch, purchased for $21,000. Between approximately 2009 and spring 2015, invoices for

Manafort's purchases from|||^^^^B were sent to Manafort's previous Alexandria residence

on recently, invoices have been sent to Manafort at the Subject

Premises. According toimil there are two closets at the Subject Premises that contain clothing
and jewelry.

73. There is also reason to believe that rugs piurchased with funds from the Cypriot

accounts would be found at the Subject Premises. Wire transfers totaling more than $360,000

were sent from Cypriot accounts directly to ^ carpet store located in

Alexandria, Virginia, near to the Subject Premises. The funds were used to pay,for rugs acquired

by Manafort. In an interview with the FBI,one ofthe owners advised that

Manafort brought several ofhis purchases back to the store for cleaning, which remain at the store.

It is reasonable to believe that the remaining rugs purchased by Manafort with funds funneled

33
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 39 of 50 PageID# 222

through the Cypriot accounts will he found at the Subject Premises (to include Premises* storage

unit).

74. Although I submit that there is probable cause to seize the aforementioned rugs and

clothing as fruits of the Subject Offenses, the FBI does not intend to seize those items. Rather,

upon an authorized search of the Subject Premises, the FBI intends to identify and photograph

those items.

Computers,Electromc Storage,and Forensic Analysis

75. As described in Attachment B, this application seeks permission to search for

records that might be found on the Subject Premises,in whatever form they are found. One form

in which the records might be found is data stored on a computer's hard drive or other storage

media. Thus, the warrant applied for would authorize the seizure ofelectronic storage media or,

potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B).

76. In a July 2017 interview, m advised the FBI that there is a Mac desktop
conqjuter on the desk in the office at the Subject Premises, which is used by Manafort. For a

variety of reasons, copies of historical records and current records are also frequently stored on

external hard drives, thumb drives, and magnetic disks. There is reasonable cause to believe such

media may be contained in and among records of Manafort's business and financial activity at the

Subject Premises. FBI interviews of|[H|||further confirm that Manafort has made widespread
use of electronic media in the course of his business activity. For exan^le,

that Manafort had a drawer fiiU of phones and electronic equipment at his old residence in Mount

Vemon Square. At one point, Manafort gaveH||H a bag of computers and directed HHIto

A storage medium is any physical object upon which computer data can be recorded. Examples
include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and other magnetic or optical
media.

34
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 40 of 50 PageID# 223

have the drives wiped before giving them to charity. Manafort also',gaveH^|several additional

devices, both laptops and cellular phones.

77. Isubmit that there is probable cause to beHeve that evidence ofthe Subject Offenses

may be found on storage media located at the Subject Premises, including but not limited to a

desktop con^uter,for at least the foUowing reasons:

a. Based on my knowledge,training, and experience,I know that computer files or

remnants ofsuch fiiles can be recovered months or even years after they have been

downloaded onto a storage medium, deleted, or viewed via the Intemet.

Electronic files downloaded to a storage medium can be stored for years at little

or no cost. Even when files have been deleted, they can be recovered months or

years later using forensic tools. This is so because when a person "deletes" a file

on a computer,the data contained in the file does not actually disappear} rather,

that data remains on the storage medium until it is overwritten by new data.

b. Therefore deleted files, or remnants of deleted files, may reside in free space or

slack space-that is, in space on the storage medium that is not currently being used

by an active file 7-for long periods of time before they are overwritten. In addition,

a conoputer's operating system may also keep a record of deleted data in a "swap"

or '^recovery" file. .

c. Wholly apart from user-generated files, computer storage media - in particular,

• con[5)uters' internal hard drives - contain electronic evidence of how a computer

has been used, what it has been used for, and who has used it. To give a few

examples, this forensic evidence can take the form of operating system

configurations, artifacts from operating system or ^plication operation,file system

35
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 41 of 50 PageID# 224

data structures, and virtual memory "swap" or paging files. Con^uter users

typically do not erase or delete this evidence, because special software is typically
required for that task. However,it is technically possible to delete this information.

78. Forensic evidence. As further described in Attachment B,this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how computers

were used, the purpose oftheir use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence will be on any storage medium in the Subject Premises

because:

a. Data on the storage TTiedium can provide evidence of a file that was once on the
storage medium but has since been deleted or edited, or of a deleted portion of a
file(such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces ofinformation on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
programs, and chat programs store configuration information on the storage
medium that can reveal infiirmation such as online nicknames and passwords.

Ojperating systems can record additional information, such as the attachment of

peripherals, the attachment of USB fiash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were

created, although this information can later be falsified.

b. As explained herein, information stored within a computer and other electronic

storage media may provide crucial;evidence ofthe *Who, what, why, when.

36
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 42 of 50 PageID# 225

where, and how" of the criminal conduct under investigation, thus enabling the

United States to establish and prove each element or alternatively, to exclude the

innocent from frirther suspicion. In my training and experience, information

stored within a con^uter or storage media(e.g.,registry information,

communications, images and movies, transactional information, records of

session times and durations, internet history, and anti-virus, spyware, and

malware detection programs)can indicate who has used or controlled the

computer or storage media. This "user attribution" evidence is analogous to the

search for "indicia ofoccupancy" while executing a search warrant at a residence.

The existence or absence of anti-virus, spyware, and malware detection programs

may indicate whether the computer was remotely accessed, thus inculpating or

exculpating the computer owner. Further, con5)uter and storage media activity

can indicate how and when the computer or storage media was accessed or used.

For example, as described hereiu, con^uters typically contain,information that

log: computer user account session times and durations, computer activity

associated with user accounts, electronic storage media that connected with the

computer, and the IP addresses through which the computer accessed networks

and the internet. Such information allows investigators to understand the

chronological context ofcomputer or electronic storage media access, use, and

events relating to the crime under investigation. Additionally,some iuformation

stored within a con5)uter or electronic storage media may provide crucial

evidence relating to the physical location of other evidence and the suspect For

example,images stored on a computer may both show a particular location and

37
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 43 of 50 PageID# 226

have geolocation information incorporated into its file data. Such file data

typically also contains information indicating when the file or image was created.
The existence ofsuch image files, along with external device connection logs,

may also indicate the presence of additional electronic storage media (e.g., a

digital camera or cellular phone with an incoiporated camera). The geographic

and timeline information described herein may either inculpate or exculpate the"

computer user. Last,information stored within a con[5)uter may provide relevant

insight into the computer user*s state of mind as it relates to the offense under
investigation. For example, information within the computer may indicate the

owner's motive and intent to commit a criine (e.g.,intemet searches indicating

criininal planning), or consciousness of guilt (e.g.,running a **wipmg" program to

destroy e'vidence on the computer or password protecting/encrypting such
evidence in an effort to concealit from law enforcement).

c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about

how computers were used, the purpose oftheir use, who used them, and when.
d. The process ofidentifying the exact files, blocks, registry entries,logs, or other
forms offorensic evidence on a storage medium that are necessary to draw an

accurate conclusion is a dynamic process. While it is possible to specify in

advance the records to be sought, computer evidence is not always data that can

be merely reviewed by a review team-and passed along to investigators. Whether

data stored on a computer is evidence may depend on other inforniation stored on
the cori^uter and the application of knowledge about how a computer behaves.

38
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 44 of 50 PageID# 227

Therefore, contextual information necessary to understand other evidence also

falls within the scope ofthe warrant,

e. Further, in finding evidence of how a computer was used, the purpose of its use,

who used it, and when,sometimes it is necessary to establish that a particular

thing is not present on a storage medium. For example, the presence or absence

of counter-forensic programs or anti-virus programs(and associated data) may be

relevant to establishing the user's intent.

79. Necessity ofseizing or copying entire computers or storage media. In niost cases,

a thorough search of a premdses for information that might be stored on storage media often

requires the seizure of the physical storage media and later off-site review consistent with the

warrant.In lieu ofremoving storage media from the premises, it is sometimes possible to make

an image copy of storage media. Generally speaking,imaging is the taking of a con^lete

electronic picture oftbe computer's data,including all hidden sectors and deleted files. Either

seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded

on the storage media, and to prevent the loss ofthe data either from accidental or intentional

destmction. This is true because ofthe following:

a. The time requiredfor an examination. As noted above, not all evidence takes the

form of documents and files that can be easily viewed on site. Analyzing

evidence of how a computer has been used, what it has been used for, and who

has used it requires considerable time, and taking that much time on premises

could be unreasonable. As explained above, because the warrant calls for forensic

electronic evidence, it is exceedingly likely that it will be necessary to thoroughly

examine storage media to obtain evidence. Storage media can store a large

39
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 45 of 50 PageID# 228

volume ofinformation. Reviewing that information for things described in the

warrant can take weeks or months* depending on the volume of data stored* and

would be impractical and invasive to attenapt on-site.

b. Technical requirements. Computers can be configured in several different ways*

featuring a variety of different operating systems, application software* ^d

configurations. Therefore, searching them sometimes requires tools or knowledge
tbflt might not be present on the search site. The vast array of computer hardware

and software available makes it difficult to know beforq a search what tools or

knowledge will be required to analyze the system and its data on the Subject

Premises. However,taking the storage media off-site and reviewing it in a

controlled environment will allow its exanoination with the proper tools and

knowledge.

c. Variety offorms ofelectronic media. Records sought under this warrant could be
stored in a variety ofstorage media formats that may require off-site reviewing
with specialized forensic tools.

80. Nature ofexamination. Based on the foregoing* and consistent with Rule
41(e)(2)(B)* the warrant I am applying for would permit seizing,imaging* or otherwise copying
storage media that reasonably appear to contain some or aU ofthe evidence described in the •
warrant, and would authorize a later review ofthe media or information consistent with the

warrant. The later review may require techniques* including but not limited to conqiuter-assisted
scans ofthe entire mftdinm, that might expose many parts ofa hard drive to human inspection in
order to determine whether it is evidence described by the warrant.

40
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 46 of 50 PageID# 229

81. Based on the foregomg,Irespectfully submit there is probable cause to believe that

the Subject Offenses have been committed and that there is probable cause that evidence of the

Subject Offenses, as described in Attachment B,is to be found at the Subject Premises.

in. Conclusion and Ancillary Provisions

82. Based on the foregoing,Irespectfully request the Court to issue a warrant to search

the Subject Premises, as described in Attachment A to this af&davit, and to seize the items and

information specified in Attachment B.

83. In light of the confidential and highly sensitive nature of the continuing

investigation, I respectfully request that this affidavit and all papers submitted herewith be

maintained under seal until the Court orders otherwise.

Respectfully submitted.

SpecM Agent
Federal Bureau ofInvestigation
SworjLto before me on
July ,2017 Theresa Carroll Buciianan
United States Magistrate Judge

41
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 47 of 50 PageID# 230

ATTACHMENT A

The Property to Be Searched

The premises to be searched (the "Subject Premises") is the condominiuTn unit located at
millllllllllll^milllllll, Alexandria, VA 22314, including the storage unit numberecH
m as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and
storage media(such as hard disks or other media that can store data)found therein.
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 48 of 50 PageID# 231

ATTACHMENTS

Items to Be Seized (or,in the alternative,identified)

1. Records relating to violations of31 U.S.C. §§5314,5322(a)(failure tp file a report

offoreign bank and financial accounts); 22 U.S.C. § 611,a/, seq.(foreign agents registration act);
26 Xi.S.C. § 7206(1)(filing a false tax return); 18 U.S.C. § 1014 (fraud in connection with the
extension ofcredit); 18 U.S.C.§§ 1341,1343,and 1349(mail fraud, wire fraud,and conspiracy to
commit these offenses); 18 U.S.C. §§ 1956 and 1957(money laundering and money laundering
conspira.cy); 52 U.S.C. §§ 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18
U.S.C. §§371 and 2 (conspiracy, aiding and abetting, and attempt to commit-such offenses)
(collectively, the "Subject Offenses"), occurring on or after January 1, 2006, including but not
limited to:

a. Any and all financial records for Paul Manafort, Jr.,^^^^^^^^^|Richard

Gates, or companies associated with Paul Manafort, fr7|||||||||iHhH or
Richard Gates,including but not limited to records relating to any foreign financial
accounts and records relating to payments by or on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;
I

b. Any and all federal and state tax documentation, including but not limited to
personal and business tax returns and all associated schedules for Paul Manafort,
Jr., Richard Gates, or companies associated with Manafort or Gates;

c. Letters, correspondence, emails, or other forms of communications with any

foreign financid institution, or any individual acting as the signatory or controlling
any foreign bank account;

d. Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct

activities on behalf of, for the benefit of, or at the direction of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals, including but not limited to the Party of Regions and Viktor
YaniUcovych;

e. Records relating to, discussing, or documenting Telmar Investments Limited,

Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited,
Black Sea View Limited,Bletilla Ventures Limited,Evo Holdings Limited, Global
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited,Peranova
Holdings Limited, including but not limited to bank records, canceled checks,
money drafts, letters of credit, cashier's checks, safe deposit records, checkbooks,
and check stubs, duplicates and copies ofchecks,deposit items,savings passbooks,
wire transfer records, and similar bank and financial account records;

f. Physical items purchased through the use offunds from Cypriot accounts,including
but not limited to rugs purchased from^B^^B^^B,a Bijan Black Titanium
"Royal Way" watch, and clothing purchased from
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 49 of 50 PageID# 232

g. Evidence relevant to any false statements, pretenses, representations, or material

omissions in connection with communications with the Department ofJustice, the
Internal Revenue Service,tax preparers, accountants, or banks;
h. Communications, records, documents, and other files^Jmmlvin^^^j^^^e
attendees of the. June 9,2016 meeting at Trump tower,]

i. Evidence indicating Manafort's state of mind as it relates to the crimes under

investigation;

j. The identity ofany person(s)—^including records that help reveal the whereabouts
ofthe person(s)—who communicated with Manafort about any matters relating to
activities conducted by Manafort on behalf of,for the benefit of, or at the direction
of any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

k. Any and all daily planners, logs, calendars, or schedule books relating to Manafort
or Gates.

2. Computers or storage media used as a means to committhe Subject Offenses.

3. For any computer or storage medium whose seizure is otherwise authorized by
this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant(hereinafter,"COMPUTER"):
a. evidence of who used, owned,or controlled the COMPUTER at the time the
things described in this warrant were created, edited, or deleted,such as logs,
registiy entries, configuration files, saved usemames and passwords,
documents, browsing history, user profiles, email, email contacts,"chat,"
instant messaging logs, photographs, and correspondence;
b. evidence ofsoftware that would allow others to control the COMPUTER,
such as viruses, Trojan horses, and other forms of malicious software, as well
as evidence ofthe presence or absence ofsecurity software designed to detect
malicious software;

c. evidence ofthe lack ofsuch malicious software;

d. evidence indicating how and when the computer was accessed or used to
determine the chronological context ofcomputer access, use, and events
relating to crime under investigation and to the computer user;
e. evidence indicating the computer user's state of mind as it relates to.the crime
under investigation;

f. evidence ofthe attachment to the COMPUTER ofothw storage devices or

similar containers for electronic evidence;
Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 50 of 50 PageID# 233

g. evidence ofcounter-forensic programs(and associated data)that are designed

to eliminate data from the COMPUTER;

h. evidence ofthe times the COMPUTER was used;

i. passwords,encryption keys, and other access devices that may be necessary to
access the COMPUTER;

j. documentation and manuals that may be necessary to access the COMPUTER

or to conduct a forensic examination ofthe COMPUTER;

k. records ofor information about Intemet Protocol addresses used by the

COMPUTER;

1. records ofor information about the COMPUTER's Intemet activity, including

firewall logs, caches, browser history and cookies,"bookmarked" or
"favorite" web pages,search terms diat the user entered into any Intemet
search engine, and records ofuser-typed web addresses;
m. contextual information necessary to understand the evidence described in this
attachment.

As used above, the terms "records" and "information" includes all forms of creation or

storage, including any form of computer or electronic storage (such as hard disks or other media

that can store data); any handmade form (such as writing); any mechanical form (such as printing

or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives,

videotapes, motion pictures, or photocopies).

The term "computer" includes all types of electronic, magnetic, optical, electrochemical,

or other high speed data processing devices performing logical, arithmetic, or storage functions,

including desktop computers, notebook computers, mobile phones,tablets, server computers, and

network hardware.

The term "storage medium" includes any physical object upon which computer data can

be recorded. Examples include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and

other magnetic or optical media.