Search warrant application for Paul Manafort’s condominium

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 1 of 50 PageID# 184
AO 106(Rev. 04/10) Application for a Search Warrant

United States District
for the

Eastern District of Virginia

‘

aC/

” .

tJnd^ S.^l- ,

In the Matter ofthe Search of

(Briefly desctibe the propertyio be searched
or identify the person by name and adA-ess)

‘

Case No. 1:17SW449

THE PREMISES LOCATED J
a a a I ALEXANDRIA, VIRGINIA 22314
APPUCATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penally of perjury that I have rei^bh to believe that oh the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A

located in the

Eastem

District of

, diere is now concealed (identify the

Virginia

person or describe the property to be seized)’.
See Attachment B

The basis for the search under Fed. R. Grim. P. 41(o) is (check one or more):

fif evidence of a crime;
isf contraband, Suits of crime, or other items illegally possessed;
sT properly designed for use, intended for use, or used in committing a crime;
a! a person to be arrested or a person who is unlawfiilly restrained.
The search is related to a violation of;
Code Section

Offense Description

See attached Affidavit.

The application is based on these facts;
See attached Affidavit.

QT Continued on the attached sheet.
a! Delayed notice of
days (give exact ending date if more than 30 days;
under 18 U.S.C. ASS 3103a, the basis of which is set forth on the attached sheet.

Reviewed by AUSA/SAUSA;

) is requested

Applicant’s sighattce

Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

/s/
TJieresa Carfoil Buchanan

UniietJ-Staies Magistrate Judge
Date;

07/26/2017

Judge’s signature

Chy and state; Alexandria, VA

The Honorable Theresa 0. Buchanan
Printed name and title

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 2 of 50 PageID# 185

ATTACHMDENTA

The Property to Be Searched

The premises to be searched (the'”Subject Premises”) is the condominium unit located at

Alexandria, VA 22314,including the storage unit numbered J
B as well as any locked drawers, containers, cabinets, safes; coinputers, electronic devices, and
storage media(such as hard disks or other media that can store data)found therein.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 3 of 50 PageID# 186

ATTACHMENTS

Items to Be Seized (or,in the alternative,identified)

1,
Records relating to violations of31 U.S.C.ASSASS 5314,5322(a)(Mure to file areport
offoreign bank and financial accounts);22 U.S.C. ASS 611,et seq.(foreign agents registration act);
26 U.S.C. ASS 7206(1)(filing a false tax return); 18 U.S.C, ASS 1014 (fraud in connection with the
extension ofcredit); 18 U.S.C.ASSASS 1341,1343,and 1349(mail fraud, wire fraud,and conspiracy to
commit these offenses); 18 U.S.C. ASSASS 1956 and 1957(money laundering and money laundering
conspiracy); 52 U.S.C. ASSASS 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18
U.S.C. ASSASS 371 and 2 (conspiracy, aiding and abetting, and attempt to commit such offenses)
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not
limited to:

Any and all financial records for Paul Manafort, Jr.,(H^^^^^^^RMard
Gates, or companies associated with Paul ManafortrJrT^HH^^HH
Richard Gates,including but notlimited to records relating to any foreign financial
accounts and records relating to payments by or on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;

Any and all federal and state tax documentation, including but not limited to
personal and business tax returns and all associated schedules for Paul Manafort,
Jr., Richard Gates, or companies associated with Manafort or Gates;

Letters, correspondence, emails, or other forms of communications with any
foreign financial institution, or any individual acting as the signatory or controlling
any foreign bank account;

Records relating to efforts by Manafort, Gates,or their affiliated entities to conduct
activities on behalf of, for the benefit of, or at the direction of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals, including but not limited to the Party of Regions and Viktor
Yanukovych;

Records relating to, discussing, or documenting Telmar Investments Limited,
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited,
Black Sea View Limited,Bletilla Ventures Limited,Evo Holdings Limited,’Global
. Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited,Peranova
Holdings Limited, including but not limited to bank records, canceled checks,
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks,
and check stubs, duplicates and copies ofchecks, deposit items,savings passbooks,
wire transfer records, and similar bank and financial accoimt records;

Physical items purchased through the use offunds from Cypriot accounts,including
but notlimited to rugs purchased fix>m
a Bijan Black Titanium
^’Royal Way” watch, and clothing purchased from

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 4 of 50 PageID# 187

Evidence relevant to any false statements, pretenses, representations, or material
omissions in connection with communications with the Department of Justice, the
Internal Revenue Service,tax preparers, accountants, or banks;

Communications, records, > documents, and other files involving any of the

attendees of the June 9,2016 meeting at Trump tower, as well as Aras and Amin
Agalorov;

Evidence indicating Manafort’s state of mind as it relates to the crimes under
investigation;

The identity of any person(s)a^including records that help reveal the whereabouts
ofthe person(s)awho communicated with Manafort about any matters relating to
activities conducted by Manafort on behalfof,for the benefit of, or at the direction
of any foreign government, foreign ofBcials, foreign entities, foreign persons, or
foreign principals;

Any and all daily planners, logs, calendars, or schedule books relating to Manafort
or Gates.

Computers or storage media used as a means to commit the Subject Offenses.

3.
For any computer or storage medium whose seizure is otherwise authorized by
this warrant, and any computer or storage medium that contains or in which is stored records or
information that is otherwise called for by this warrant(hereinafter,”COMPUTER”):
a. evidence of who used,owned,or controlled the COMPUTER at the time the

things described in this warrant were created, edited, or deleted,such as logs,
registry entries, configuration files, saved usemames and passwords,
documents, browsing history, user profiles, email, email contacts,”chat,”
instant messaging logs, photographs, and correspondence;
b. evidence ofsoftware that would allow others to control the COMPUTER,

such as vimses, Trojan horses, and other forms of malicious software, as well
as evidence ofthe presence or absence ofsecurity software designed to detect
malicious software;
c. evidence ofthe lack ofsuch malicious software;

d. evidence indicating how and when the computer was accessed or used to
determine the chronological context ofcomputer access, use, and events
relating to crime imder investigation and to the computer user;

e. evidence indicating the computer user’s state of mind as it relates to the crime
under investigation;
f. evidence ofthe attachmentto the COMPUTER ofother storage devices or
similar containers for electronic evidence;

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 5 of 50 PageID# 188

g. evidence ofcounter-forensic programs(and associated data)that are designed
to eliminate data from the COMPUTER;

h. evidence ofthe times the COMPUTiBR was used;

i. passwords, encryption keys, and other access devices that may be necessary to
access the COMPUTER;

j. documentation and manuals that may be necessary to access the COMPUTER
or to conduct a forensic examination ofthe COMPUTER;

k. records ofor information about Intemet Protocol addresses used by the
COMPUTER;

1. records ofor information about the COMPUTER’S Intemet activity, including

firewall logs, caches, browser history and cookies,”bookmarked” or
“favorite” web pages,search terms that the user entered into any Intemet
search engine, and records of user-typed web addresses;

m. contextual information necessary to understand the evidence described in this
attachment.

As used above, the terms “records” and “information” includes all forms of creation or

storage, including any form of computer or electronic storage (such as hard disks or other media
that can store data); any handmade form(such as writing); any mechanical form (such as printing

or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives,
videotapes, motion pictures, or photocopies).

The term “computer” includes all types of electronic, magnetic, optical, electrochemical,

or other high speed data processing devices performing logical* arithmetic, or storage functions,
including desktop computers,notebook computers, mobile phones,tablets, semr computers, and
network hardware.

The term “storage medium” includes any physical object upon which computer data can

be recorded^ Examples include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and
other magnetic or optical media.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 6 of 50 PageID# 189

UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF VIRGINIA
KLrJUNlA

Alexandria Division

‘JUL 25 2(1(7
(. ‘

Criminal No. l:17-sw-449

THE PREMISES LOCATED AT I
ALEXANDRIA,

Filed Under Seal

VIRGINIA 22314

‘ AFFTOAVrriN SUPPORT OF AN
APPLICATION FOR A SEARCH WARRANT

Federal Bureau ofInvestigation(‘TBr’), being duly sworn, deposes and
says:

I. Ritroduction
A. Affiant

I am a Special Agent with the FBI and have been since 2015. I am cuirently

assigned to the investigation being conducted by the Department of Justice Special Counsel As a

Special Agent of the FBI, I have received training and ejqperience in investigating criminal and
national security matters. Prior to my employment with theIBI,Ispent seven years in the software

industry and have extensive experience working with computer technology.

I make this affidavit in support of an application pursuant to Rule 41 ofthe Federal

Rules of Criminal Procedure for a warrant to search the premises located at

mm Alexandria; Virginia 22314 (the “Subject Premises”)* which is described more
particularly in Attachment A,in order to locate and seize (and/or photograph)the items described
in Attachment B. This affidavit is based upon my personal knowledge, my review of documents

and other evidence, my conversations with other law enforcement persoimel, and my training and
experience. Because this affidavit is being submitted for the limited purpose of establishing
probable cause, it does not include all the facts that I have learned during the course of my

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 7 of 50 PageID# 190

investigation.’ Where the contents of documents and the statements, and conversations of others

are reported herein, they are reported in substance and in pertinent part, except where otherwise
indicated.

B. The Subject Offenses

For the reasons detailed below, there is probable cause to believe that the Subject

Premises contain evidence, fruits, and instrumentalities of violations of: 31 U.S.C. ASSASS 5314,

5322(a)(failure to file a report offoreign bank and financial accounts); 22 U.S.C. ASS 611, et. seq,

(foreign agents registration act); 26 U.S.C. ASS 7206(1)(filing a false tax retum); 18 U.S.C. ASS 1014
(fraud in connection with the extension ofcredit); 18 U.S.C. ASSASS 1341,1343,and 1349(mail fraud,
wire fraud, and conspiracy to commit these offenses); 18 U.S.C. ASSASS 1956 and 1957 (money
laundering and money laundering conspiracy); 52 U.S.C. ASSASS 30121(a)(1)(A) and (a)(2)(foreign
contribution ban); and 18 U.S.C. ASSASS 371 and 2(conspiracy, aiding and abetting, and attempt to
commit such offenses)(collectively, the “Subject Offenses”).
n. Probable Cause

As setforth herein,there is probable cause to believe that the Subject Offenses have

been committed by Paul J. Manafort, Jr., the former campaign chairman of Donald Trump for
President, Inc., and others known and unknown. Between at least 2006 and 2014, Manafort, a

United States citizen, worked as a lobbyist and political consultant for the Party of Regions, a

Ukrainian political party commonly believed to be aligned with Russia. There is probable cause

to believe that Manafort engaged in a scheme to hide income paid on behalf of Ukrainian

politicians and others through foreign bank accounts in Cyprus and elsewhere,to and on behalfof
Manafort and related people and companies.

There is also probable cause to believe that Manafort participated in a scheme to
I financial

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 8 of 50 PageID# 191

institution, by providing false information to, and withholding material information from,]
related to the loans.

By way of background concerning Manafort, based on publicly available

information,in March of2016, Manafort officially joined Donald J. Trump for President,Inc.(the

‘Trunq)Campaign”),the presidential campaign ofthen candidate Trump,in order to, among other

things, help.manage the delegate process for the Republican National Convention. In May of
2016, Manafort became chairman ofthe Trump Campaign. In June of2016, Manafort reportedly
became defacto manager for the Trun^ Campaign with the departure of prior campaign manager
Corey Lewandowski. On August 19, 2016, after public reports regarding connections between
Manafort, Ukraine, and Russia – including an alleged ^Tslack ledger” of off-the-book payments
from the Party of Regions to Manafort – Manafort left his post as chairman of the Trump
Campaign.
7.

Portions of the information set forth below (as well as certain additional facts not

relevant herein) were set forth in(1)an affidavit by Special Agent

submitted in support of a warrant to search a storage locker in Alexandria, Virginia
used by Manafort (“Storage Locker Search Warrant”);(2) an affidavit by Special Agent
submitted in support of a search warrant for the email account used
by Manafort(‘Email Search Warrant”); and (3) an affidavit by Special Agent

UmillHH submitted in support of a warrant to search a hard drive associated with
Manafort’s business entities (“Hard Drive Search Warrant”). On May 27, 2017, the Honorable

Theresa Carroll Buchanan, United States Magistrate Judge for the Eastern District of Virginia,

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 9 of 50 PageID# 192

issued the Storage Locker Search Wairant upon a jSnding ofprobable cause; on June 21,2017,the
Honorable James L. Cott, United States Magistrate Judge for the Southern District of New York,

issued the fimail Search Warrant upon a finding of probable cause; and on June 14, 2017, Chief

Judge Beryl Howell of the District of the District of Columbia issued the Hard Drive Search
Warrant upon a finding of probable cause. Copies of the search wamant affidavits are attached
hereto as Attachments C-E,respectively.
Manafort’s Work for Ukraine

The information contained herein is based on public records; bank records and

reports; Davis Manafort records; tax .filings by Manafort and Richard W. Gates, lU, a Davis
Manafort en^)loyee;the June 2017 fihng by DMP International,LLC,Manafort, and Gates under
the Foreign Agents Registration Act(FARA); and statements by Manafort and Gates to the FBI,
among other things.

Manafort and Gates have been en:q)loyed for many years through Davis Manafort

and related entities as lobbyists and political consultants working both in the United States and

internationally. Beginning in or about 200(5 and at least until 2014, Manafort provided political

and policy services to the Ukrainian Party of Regions,including Viktor Yanukovych, head of the
Party of Regions and the President of Ukraine from 2010 to 2014. Gates told the FBI in an
interview in July 2014(“the Gates Interview”) that he was hired by Manafort in 2006 and worked
on Ukrainian election and policy advice, up to the time of the interview. Gates advised that in
2010,he and Manafort were in Ukraine for over two months leading up to the election that brought

Yanukovych to power. Manafort told the FBI in ah interview also in July 2014 (“the Manafort
Interview”)that he performed work for the Party of Regions, as well as significant work for Rinat

Akhmetov, a financial supporter of President Yanukovych, and for Oleg Deripaska, a Russian
oligarch.
4

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 10 of 50 PageID# 193

10.

Based on reporting from multiple sources, the FBI believes that Yanukovych’s

government engaged in systematic public corruption. The same sources report that corrupt
government officials and their allies in the business community during Yanukovych*s presidency
looted Ukraine’s public coffers of millions of dollars and fonneled those assets to foreign bank
accounts to hide the embezzlement. The current government of Ukraine has sought the assistance

ofthe United States and Cypras to locate and recover these misappropriated assets. Yanukovych,
who fled to Russia in 2014, is currently wanted in Ukraine for numerous criiniaal violations,

including the embezzlement and misappropriation of public property. In late June 2017, media
outlets such as Bloomberg reported that Ukrainian prosecutors had uncovered no evidence ofillicit
payments to Manafort as part of their investigation into suspected criminal conduct by former

Ukrainian officials. In a statement available on its public website dated June 29,2017, Ukraine’s
National Anti-Corruption Bureau of Ukraine (NABU) provided the following context by
announcing that it “did not conduct an official investigation regarding Paul Manafort. He has
never been a Ukrainian official, and therefore cannot commit corruption acts, according to the

Ukrainian laws. An assessment of the actions of the abovementioned person should be made by
the competent authorities ofother countries, whose jurisdiction extends to the investigation ofthe
facts of probable offenses.”
1.

11.

Payments from Cypiiot Accounts to and for Manafort

From in or about at least 2008 to at least 2014, payments from bank accounts in

Cyprus – nominally owned by foreign companies – were used to make payments to (a) United

States corporate and personal bank accounts controlled by Manafort or Gates and(b)United States

vendors for services provided to Manafort or Gates. During this time period, tens of millions of

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 11 of 50 PageID# 194

dollars from these foreign accounts were paid “directly”^ and indirectly to Manafort, Gates, and
Manafort-related entities.

12.

Based on the evidence setforth more folly below,there is probable cause to believe

that Manafort and Gates maintained Cypriot bank accounts held in the names ofnumerous entities,
which include those listed in the chart below:

Company

Bank Name

Telmar

Bank of

Investments
Limited

Cyprus PCL
Ltd

Account #

Transaction Example
On or about June 27,
2014, $250,000 was sent

to an account in the name

of DMP International,
LLC at HSBC Bank.

On or about September 2,
2010,$1 million was sent

Yiakora

Bank of

Ventures

Cyprus PCL

Limited

Ltd

to an account in the name
of Global Sites LLC at
Wachovia
Bank.

On or about June 4,2008,
$8 million was sent to an
account in the name of
Jesand
Investnient

Corporation
Cyprus
Popular Bank
(Previously

Lucicle

Consultants
Limited

Actinet

Trading
Limited

‘

First

Republic Bank
On or about November 9,
2012, $300,000 was sent
to an account in-the name

Marfin

of DMP International,

Popular

LLC at JPMorganChase

Bank)

Bank.

Cyprus
Popular Bank
(Previously

On or about August 1,
2012,$70,000 was sent to

Marfin

Popular

B^)

an account m the name of

DMP International, LLC

at JPMorganChase Bank

^ The term “directly” is used to differentiate the “indirect” Manafort payments made to vendors
that provided services to Manafort. Wires from GypriOt accounts that were sentto Davis M^afort
would also at various times be passed tbrou^ more lhan one United States account afOliated with
Manafort before being used to pay for Davis Manafort expenses as well as other items.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 12 of 50 PageID# 195

Transaction Example

Company

Bank Name

Black Sea

Cyprus
Popular Bank
(Previously

View Limited

Marfb

sent to an account in the
name of Paul J Manafort

Popular

andHimH^^^I

BletiUa
Ventures
Limited

On or about December

21, 2011, $1 million was

Bank)

at First Republic Bank.

Cyprus
Popular Bank
(Previously

On or about April 10,
2012, $900,000 was sent
to an account in the name

Marfin

of DMP Intemational,

Popular

LLC at JPMorganChase

Bank)

Bank.

Cyprus
Popular Bank
Evo Holdings (Previously
Limited

, Account #

Marfin

Popular

On or about January 30,
2009,$70,000 was sent to
an account in the name of
Davis Manafbrt Partners,
Inc. at Wachovia Bank.

Bank)

Global

Highway
Limited

Leviathan
Advisors
Limited

Cyprus
Popular Bank
(Previously
Marfin

sent to an account in the
nanie of Davis Manafort

Popular

Partners,

Bank)

Wachovia BanL

Cyprus
Popular Bank
(Previously

On or about May 27,
2011, $258,000 was sent

Marfin

Popular
Bank)

Loav
Advisors

Limited

Lucicle
Consultants
Limited

On or about December

23, 2009, $500,000 was

Inc;

to an account in the name
of
Davis
Manafort

Partners, Inc. at First
Republic Bank.
Oh or about October 7,

Cyprus
Popular Bank
(Previously

to an account in the name

Marfin

of Paul J Manafort and

2010, $120,000 was sent

Popular
Bank)

Wachovia BanL

Cyprus
Popular Bank
(Previously

2012, $650,000 was sent

Marfin

of DMP International,

Popular

LLC at JPMorganChase

Bank)

Bank.

On or about June 27,
to an account in the name

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 13 of 50 PageID# 196

Company

Peranova

Holdings
Limited

Bank Name

Account #

Cyprus
Popular Bank
(Previously
Marfin

Popular

Limited

sent to an account in the
name
of
DMP

International,

LLC

First Republic Bank. .
On or about January 16,
2014, $500,000 was sent

Bank)
Telmar
Investments

Transaction Example
On or about February 1,
2012, $1.5 million was

Eurobank

to an account in the name

Cyprus Ltd

of DMP International,
LLCatHSBCBank.

Actinet

Trading
Limited

On or about April 8,2013,
$200,000 was sent to an
Hellenic Bank

account in the name of

PCLLtd

DMP International, LLC
atHSBCBank.

On or about March 1,
BletiUa
Ventures

Limited

Hellenic Bank
PCLLtd

2013, $300,000 was sent
to an account in the name

Lucicle
Consultants
Limited

Hellenic Bank

PCLLtd

of Symthson LLC at
. JPMorganChase Bank.
On or about February 15,
2013, $500,000 was sent
to an account in the name

of Symthson LLC at
JPMorganChase Bank.

13.

The FBI has obtained bank records tiiat evidence that Manafort controlled and/or

held executive positions at the following United States entities, which received tens of millions of
dollars jfromthe above-listed financial accounts in Cyprus between at least 2008 to at least 2014;
(1)Davis Manafort Partners, Inc.;
(2)DMP International, LLC;
(3)Global Sites LLC;and

(4)Jesand Investment Corporation^.

^ Jesand Investment Corporation was incorporated in Virginia in 2002 and dissolved in 2013. It
lists its addresses as Manafort’s addresses in Alexandria, Virginia and Palm Beach Gardens,
Florida,

*’Jesand” is

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 14 of 50 PageID# 197

Bank records also reflect that Gates held signature authority over the account in the name of

Symthson LLC^.
14.

In addition, bank records evidence that millions of dollars were wired directly from

the Cypriot accounts to pay vendors for goods and services provided to and for Manafort. For
instance,funds flrom these foreign accounts were used to rent a villa in Italy at which the Manaforts

vacationed (over $49,000); to pay for rugs from an Alexandria store called

.(over $360,000); to pay for landscaping services for.the Manaforts (over $395,000); and to pay
two separate clothiers

clothing purchased by Manafort

(over $400,000 and $360,000 respectively). The records for one of the clothiers
-evidence that Manafort was aware ofand controlled these foreign wire payments, as he noted to
the vendor in two spring 2011 emails that the vendor would be paid shortly from the Leviathan
Holdings Cypriot account, noted above.
15.

Manafort and Gates have both told the FBI in interviews in 2014 that they were
S

paid for their work for the Ukrainian Party of Regions through Cypriot bank accounts. In the
Manafort Interview, Manafort claimed he did not know who specifically set up the Cypriot

accounts, but they were vehicles used to pay him for public political services. Manafort
specifically acknowledged that any money flowing from the accounts held in the name of Global
Highway Ltd. and Leviathan(two entities listed above) would have been money he earned from
his services. In the Gates Interview, Gates admitted he was directed to open accounts m Cyprus

by President Yanukoyych’s Chief of Staff Boris Kolesnikov. He was told it was easier for them
to be paid from one Cyprus account to another Cyprus account. Gates said that various oligarchs

^ Smythson LLC was incorporated in Delaware in 2008. Note that bank accounts for this company
were opened under the name “Symthson,” using addresses listed for Manafort in other of his
companies.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 15 of 50 PageID# 198

would chip in to pay them for their consulting work. Gates identified Lucicle, BletUla,Leviathan,
and Global Endeavor(among others) as accounts opened to receive such payments.

16.

In addition, in 2014 Manafort wrote to the First Republic Bank, a United States

finandal institution, to object to the bank’s determination to close all the Manafort-related
accounts based on its anti-money laundering policies and concerns about incoming international

wires. In his correspondence to the bank, Manafort admitted he was paid by Ukraine but he
claimed that the money he received from Ukraine was for “very public consulting services” from
“legitimate activities that were totally legal.” Manafort also wrote the bank that he had “[n]o
interaction with oligarchs for business.” However,in the ManafortInterview conducted that same

year, Manafort told the FBI that he did significant work for Deripaska, a Russian oligarch. And
in March 2017,in response to press reports concerning a written annual contract between Manafort

and Deripaska, Manafort publicly confirmed that he had provided investment consulting services
to Deripaska interests.

Deripaska helped fund Manafort’s Ukrainian work when it began in 2005-06.^^ And the 2010 tax
returns for a company jointly owned by Manafort and his wife a John Hannah,LLCA(r) a reveals a
$10,000,000 loan to the company from a ‘^Russian lender.” A court-authorized search in May
2017 of a storage locker in Virginia used by Manafort revealed documents that show that the

A(r) John Hannflh, LLC was located at the same address as Davis Manafort,Inc.
Alexandria, Virginia, 22314, and received mail there. The company also

received mail at the Manafort home in Florida. Hjjim the name ofthe conpany is derived from
the respective middle names of Manafort and Gates. Manafort declared on his tax returns,
discussed below,income from John Hannah,LLC.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 16 of 50 PageID# 199

identity of the Russian lender was *T)erapaska.” Finally, in the Gates Interview, Gates admitted
that Manafort met with another oligarch,

discuss a New York real estate

transaction they would undertake together and to pitch other ideas. In the Manafort Interview,
Manafoit also admitted approaching

to propose the New York deal, which according to

business records publicly filed in a New York litigation was initiated in 2008.
2.

17.

Manafort and Gates Tax Returns

There is probable cause to believe that Manafort failed to properly disclose to the

United States government his ^relationship to the Ukrainian Party of Regions, the income he

received (directly or indirectly) as a result of his work for that party, and the existence offoreign
accounts in which he held a financial interest(and into which payments from Ukrainian politicians
were deposited, as discussed above).

18. . Pursuant to a tax order from the Eastern District of Virginia(Buchanan, J.) dated

April 14,2017,the FBI has obtained and reviewed, among others, the tax returns for Manafort
and Gates for 2009-2014. In aU ofthe tax returns, Manafort and Gates submitted a Schedule B

form, which required them to declare whether they have “an interest in or a signature or other
authority over a financial account in a foreign country, such as a bank account, securities
account,or other financial account.” Each year, Manafort and Gates declared **No.” That same

form also contained a cross-reference to the requirement to file a Report ofForeign Bank and
Financial Accounts(FBAR)to report overseas financial interests or signature authority. An
FEAR filing is required, on a yearly basis, if a United States person has a financial interest in or
signatory authority over at least one financial account located outside the United States and at

least $10,000 in aggregate value in foreign accounts at any time during the calendar year. As
discussed above, there is probable cause to believe that Manafort and Gates had a financial

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 17 of 50 PageID# 200

interest,in excess of$10,000,in various accounts in Cyprus in at least 2008-14. A review of
data from the Financial Crimes Enforcement Network(commonly known as FinCEN)shows
that Manafort and Gates have not filed an FBAR for at least the years 2008 to the present.
19.

A search ofthe United States Department ofJustice database ofall agents currently

or previously registered under FARA,conducted in July 2017, also discloses that Manafort,Gates,

and their affiliated entities, including Davis Manafort, failed to register as agents of a foreign

government until June 27,2017.A(r) As long-time lobbyists, Manafort and Gates would know about

the FARA requirements. Indeed,in email.communications between Gates and ^^BIl^Hi
(a United States lobbying and public ajBfairs firm) concerning joint Ukraine work. Gates
demonstrated that he was clearly aware in 2012 ofFARA filing rules.

20.

In addition, the foreign source income listed in the tax returns for Manafort does

not appear to account for the above distributions to or from the Cj^riot accounts on his behalf.
For instance, the 2009 Manafort tax retum indicates $17,736 in gross foreign source income;in
2010,$42,789; in 2011,$165,871;in 2012,$129,777;in 2013,$38,375; and in 2014,$39,468.
21.

The bank records, however, reveal the following:

aC/ In 2008,the Cypriot accounts transferred at least $3,500,000to accountsin thejoint

names of Paul and HIH Manafort and transferred at least $9,000,000 to
accounts of United States entities affiliated with Manafort.

aC/ In 2009,the Cypriot accounts transferred at least $1,500,000to accounts in the joint
names of Paul and

Manafort, transferred at least $35,000 to accounts in

the names of Manafort’s relatives, transferred at least $3,000,000 to accounts of

The database is publicly available at https://www.fara.gov/.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 18 of 50 PageID# 201

United States entities aJBOliated with Manafort, and transferred at least $200,000 to
accounts ofthird parties as payment for the benefit of Manafort.

aC/ In 2010,the Cypriot accounts transferred atleast $2,000,000to accounts in the joint
names of Paul and

Manafort, transferred at least $80,000 to accounts in

the names of Manafoit’s relatives, transferred at least $6,000,000 to United States
entities affiliated with Manafort, and transferred at least $600,000 to accounts of

third parties as payment for the benefit ofManafort.

aC/ In 2011, the Cypriot accounts transferred at least $1,800,000 to an account in the

joint names of Paul and HIHI Manafort, transferred at least $30,000 to an
account in the name of a Manafort relative, transferred at least $3,000,000 to an
account of a United States entity affiliated with Manafort, and transferred at least

$500,000 to accounts ofthird parties as payment for the benefit of Manafort.

aC/ In 2012,the Cypriot accounts transferred at least $200,000to an accountin the joint
names of Paul and

Manafort,transferred at least $8,500,000 to accounts

of United States entities affiliated with Manafort, and transferred at least

$1,000,000 to accounts ofthird parties as payment for the benefit of Manafort.

aC/ In 2013,the Cypriot accounts transferred at least $2,500,000 to accounts of United
States entities affiliated with Manafort and transferred at least $1,000,000 to

accounts ofthird parties as payment for the benefit of Manafort.

aC/ In 2014,the Cypriot accounts transferred at least $5,000,000 to accounts of United
States entities affiliated with Manafort.

22.

There appears to be no legitimate business reason for these transactions, which

appear to pass fonds fiom a Ukrainian political party through more than one Cypriot bank

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 19 of 50 PageID# 202

account; have payments made directly to United States vendors from the Cypriot accounts; and

pass money brought onshore from Cyprus through multiple United States accounts. Based on

my training and experience,these transactions evidence in my view the crimes oftax evasion
and money laundering to conceal the origins of the ftinds paid to Manafort and Gates.
B.

Manafort’s Loan Applications

23.

There is also probable cause to believe that Manafort made misrepresentations and

material omissions for the purpose of securing loans from ^BII^^HIIIi^^H^^HH
and is a Federal Deposit Insurance Corporation member bank.
The information contained herein is based on information set forth in the attached

Afridavit, which is based on public records, financial records and reports, court records, and
information provided by other law enforcement personnel, among other things.
24.

Based on court filings and records obtained from Genesis Capital Corporation

(“Genesis”), in February 2016, Genesis, through an affiliated entity, extended two loans to MC

Brooklyn Hpldings LLC(‘MC Brooklyn Holdings”) totaling approximately $5.3 million. MC
Brooklyn Holdings is the holding con^any for atownhouse located at

Brooklyn,

New York 11231 (“Brooklyn Property*’). MC Brooklyn Holdings’ members are Manafort,H

Manafort also personally guaranteed the $5.3 million loans from Genesis.

25.

Additionally, based on documents obtained from^H^Febraary 2016, Genesis

frinded a refinance and constmction loan for approximately $3.7 million, secured by a property

located Hm^l^miBBHLos Angeles, California(“Los Angeles Property”). The Los
AngelesProperty was held by^^^m^^m [ H LLC,a company in which(as ofFebmary
2016)Manafort and^^ held equal interest.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 20 of 50 PageID# 203

26.

Both sets of Genesis loans went into default in 2016. As a consequence,- on.

September 20,2016,a Genesis affiliate filed an action in New York Supreme Court,Kings County
(the foreclosure Action”), seeking to foreclose the loans encumbering the Brooklyn Property.

After its initiation, the Foreiclosure Action was adjourned several times as Manafort and m
sought refinancing.

27.

As explained in theBHIAfiidavit attached hereto,based on documents obtained

fiommibeginning in 2016,Manafort began negotiations with for the extension ofloans
for several purposes, including to refinance the Genesis loans that were in default. These

negotiations ultimately resulted in^^ extending two sets of loans to Manafort-linked entities
in the total amount of approximately $16 million. One loan, for approximately $9.5 million
(enough to cover the outstanding balance on the Genesis loan secured by the Los AngelesProperty)
was extended to a conjpany called Summerbreeze LLC that was owned by
(hereinafter, the

Summerbreeze Loan”). A second set of

loans, in the amount of

$6.5 miUion, was secured by the Brooklyn Property and was used to refinance the Genesis loans

secured by that property (hereinafter, “the

Brooklyn Property Loan”). That refinancing

ultimately terminated the Genesis Foreclosure Action.

28.

As described below,Manafort made several materially inconsistent representations

during the process of negotiating for theH loans, including by making substantially different
representations about his income and net worth on different loan applications (signed and

unsigned) within a three-month period. And

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 21 of 50 PageID# 204

29.

Extension of Refinancing Loan

According to documents obtained firomjm on or about July 27,2016,Manafort

met-with I

to discuss a proposed loan fiomm to refinance the Genesis loan secured by the Los Angeles

Property(“the Genesis Los Angeles Loan”). H and other members oftheH^ loan committee
approved the terms of this loan the next day.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 22 of 50 PageID# 205

33.

On or about September 8,2016,Manafort’s attorney transmitted to
H a demand

letter to ^^n^m

collector, which demanded payofffor missed June

and July payments on the Genesis Los Angeles Loan, including late fees and over $2,000 dahy

interest on the late fees. IIIH forwarded this document to
writing: “Just a lyi-looks like these guys are in default to Genesis
“It is what it is. Let’s send it offto

“HHB wrote back:

and have it be part of the file.

Extension of Additional RelBnancing Loan Despite Manafort’s Initial

$1 Miilion Understatement of Original Loan Amount

34.

Based on documents obtained fi:om ^ in late August 2016, at approximately

the time when Manafort officially left his position with the Trump Campaign, the company

Summerbreeze LLC was formed, withjBI^HIIHHm^^^Hi^

member,

mm records show that Summerbreeze LLC then took out a loan ftom a subsidiary of the jeal
estate investment company

amount of approximately $3.5 million,

secured by real estate in Water Mill, New York (hereinafter,the’HB Loan”).
35.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 23 of 50 PageID# 206

37.

On September 27,2016,

statements showing that the

copies ofmortgage

Loan was for approximately $3.5 million.

replied to aU recipients: “What the hell he just took the loan out at the end
of August how can he be $1,000,000 oft!”

replied,

^*He is so in debt.”

FBI agents interviewed

who stated in substance, among other things, as follows:

a. She discussed the loan withBBHI^^HIil^HH^HB^

course of

her work on the loan, ^dBH^I expressed to her on several occasions that the
proposed Manafort loan was a bad loan.

b. There were several issues with the proposed Manafort loan. For example, when
she ran Manafort*s credit report in August of 2016, she saw that his credit had

dropped significantly compared to his last credit report in June, due to an

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 24 of 50 PageID# 207

approximately $300,000 debt Manafort had incurred on his American Express card
(which Manafort claimed was because he had allowed a Mend to use it to buy New

York Yankees season tickets). Additionally, a number of Manafoit’s assets turned
out to be.less valuable than ejected. Two pieces of real estate considered as
collateral were each appraised at over $1 million less than the e:q)ected value, and
an investment account of Manafort’s, which

had believed would /have a

balance of$10 million, had a lower effective value because Manafort had taken out

a$5 million line ofcredit against it.

also considered it unusualto approve

a construction loan (as the proposed Manafort loan was planned to be) for

borrowers who,like Manafort andlim^acked construction e^qperience. She also
considered it unusual that ^ was willing to fiind the loan despite Manafort’s
and IH default to Genesis Capital.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 25 of 50 PageID# 208

40.

In early October 2016, before Manafort and

closed on the originally

contemplated refinancing of the Genesis Los Angeles Loan, documents provided byH^ show
that Manafort sought a second loan bromjUII tlmt would refinance the Genesis loans secured by
the Brooklyn Property, which were the subject ofGenesis’s Foreclosure Action filed in September
2016.

Manafort’s Conflicting Representations in His Loan Applications

41.

During the course of applying and negotiating for lending fromHH Manafort

made a series ofconflicting representations in his loan applications about his income and net worth.

Documents produced by mi show that on August 11, 2016, Manafort digitally signed a loan

application for the proposed Los Angeles Property refinancing that listed his income as $275,000
per month and his personal net worth as $17,051,676.17.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 26 of 50 PageID# 209

42.

Two loans applications for them Sununerbreeze Loan were also produced by

m[unsigned by Manafort but dated October 26, 2016. Both listed Manafort’s income as
approximately $224,846 per month. One listed the net worth of Manafort and his wife, as coborrowers, as $21,376,722.13, and Ae other listed their net worth as $6 million lower, or
$15,376,722.13.

43.

Two days after the date of these applications, on or about October 28, 2016,

Manafort and his wife signed a loan application for the TFSB Sununerbreeze Loan listing

Manafort’s income as $100,652 per month and their net worth as co-borrowers as $34,685,418.13.
44.

On or about three days after that application was submitted,or November 1,2016,

Manafort and his wife signed a loan application for the

BrooJdyn Property Loan, which

listed Manafort’s income as $224,846 per month and their net worth as co-boirowers as
$14,994,402.13.

45.

Following these representations, the

Sununerbreeze Loan closed on

November 16, 2016. Of the total loan amount of $9.5 million, $7 million was underwritten by

The fuaalHH credit approval memorandum produced by^H
did not mention the Los Angeles Property Loan default or the Foreclosure Action against

Manafort, and it assigned the^^H Summerbreeze Loan a risk factor of”4(Average).” m [

46.

On January 17,2017,the^^ Brooklyn Property Xx>an was funded, resulting in

$6.5 million being paid for the benefit of Manafort and his wife. The Genesis Foreclosure Action

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 27 of 50 PageID# 210

was terminated by stipulation executed the next day. The jSnalj^JPcredit approval memorandum
produced by

did not mention the default on the Genesis loans or the Foreclosure Action and

assigned theH [ Brooklyn Property Loan a risk factor of”4(Average).”

Case Document 13 Filed 06/26/18 Page 28 of 50 Page D# 211

Case Document 13 Filed 06/26/18 Page 29 of 50 Page D# 212

Case Document 13 Filed?O6/26/18 Page 30 of 50 Page D# 213

Case Document 13 Filed 06/26/18 Page 31 of 50 Page D# 214

Case Document 13 Filed 06/26/18 Page 32 of 50 Page D# 215

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 33 of 50 PageID# 216

The Subject Premises

60.

Law enforcement databases and mortgage records show that Manafort maintains

several residences, including a residence at the Subject Premises. The Subject Premises is located

in a complex called

Appraisal and title insurance documentation

obtained jGromim indicate that the Subject Premises is a three-bedroom condominium unit with
2779 square feet of living space and includes two parking spaces numbered

and

one storage unit numbered H A law enforcement database shows that the property was

purchased by Paul and ^^H [ Manafort on or about January 15,2015 for $2,700,000 in cash.

61.

In email communications in July 2016, bank officials at HHIHUHHI

who were working to approve loan to Manafort-related entities(as described above)characterized
the Subject Premises as Manafort*s ‘^primary residence.” hi subsequent paperwork,
identified Manafort’s residence in Florida as his primary residence on the basis of Manafort’s use
ofthat address for income tax purposes.

62.

In several voluntary meetings with the FBI,

^individual who

works for Manafort, confirmed that Manafort maintains a residence at the Subject Premises.

informed the FBI that he previously worked for Davis Manafort and that in late 2011 he

began working more directly for Manafort. He currently receives his salary from Steam Mountain,

LLC,which is another business operated by Manafort. [[H advised that he performs a variety
offunctions for Manafort and his companies, as directed by Manafort.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 34 of 50 PageID# 217

63.

In spring of 2017, HHI advised the FBI that in approximately 2015, at the

direction of Manafort,HH moved boxes of office files for Manafort’s businesses fioni one
smaller storage unit at 370 Holland Lane, Alexandria, Virginia, to a larger storage unit(Unit 3013)
I

at the same storage facility. HIadvised that he personally moved the ofhce files into Unit
3013. A search of Unit 3013 at 370 HoUand Lane was conducted in late May of2017 pursuant to

a warrant issued by Magistrate Judge Theresa Carroll Buchanan. That search confirmed the
information

provided the FBI. Among the items that the FBIidentified in that search were

tax returns for Manafort and various Manafort-related business entities, documents related to

Ukraine and the Party ofRegions, and various financial documents. A copy ofthat search warrant
affidavit is attached hereto.

64.

Ill^l told the FBI that Manafort moved from his former residence on Mount

Vemon Circle (alSo in Alexandria, VA)to the Subject Premises in or around May of 2015, and

that he impersonally helped Manafort move belongings from the former residence to the
Subject Premises and to the aforementioned storage locker on 370 Holland Lane. [ i also
advised that the Subject Premises includes its own separate locked storage unit, which is used to

store, among other things, miscellaneous items of furniture. The last time [i accessed the
storage unit was in March or April 2017.

65.

HHH iiidicated that Manafort used his home to do business and maintained

records of his businesses at his home. For instance, some of the material that was moved to Unit
3013 included files from Manafort’s former residence on Mount Vemon Circle in Alexandria,

Virginia.

indicated that Manafort was using his former residence as an office at the time.

also advised the FBI that company documentation was being kept at the Subject

Premises. In particular,HH informed the FBI that in late April or early May of2017,1

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 35 of 50 PageID# 218

I told him that She and Manafort were reorganizing their lives and as part of that process

were getting documents ready for meetings with their attorney. At the same time,HH saw
miscellaneous documents on.a coffee table at the Subject Premises, including but not limited to
Federal Election Commission documents.

66.

Hm also informed the FBI that one ofthe rooms in the Subject Premises is used

as an office, and that IIIH has seen business records in that ofdce, including in one or two
drawers. Among the records maintaiaed in the drawers were records related to Manafoit’s various
business entities^ including John Hannah LLC (as discussed in Paragraph 16 above) and, he
believes, DMP International,IXC.

67.

In an interview with the FBI on July 19, 2017,ll^l indicated that the last time

he was inside the Subject Premises was on or about July 5,2017, when he picked up Manafort’s

Tnflil and shipped a suit to another Manafort residence at Manafort’s request; and the last time he

was at the Subject Premises was on or about July 11, 2017, when he took m ^H^ to
the akport.

68.

It is reasonable to believe that business records related to Manafort’s work in

Xlkraiae, including historical records, would be maintained among the business files kept.at the
Subject Premises, including the files kept for use in consulting with counsel. On June 27, 2017,
Manafort,Gates,and DMP Intemational,LLC registered under FARA for the years 2012-2014 as

a result of their political work in Ukraine, having failed to do so previously. This registration
followed a series of communications between Manafort, his counsel, and officials in the United

States Department of Justice’s National Security Division (which administers the FARA
registration process) about the FARA requirements. At least one ofthese communications, dated

September 13, 2016, was directed to Manafort at

^ Alexandriia, VA,

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 36 of 50 PageID# 219

i.e., the Subject Premises. It is therefore reasonable to believe that records relating to this filing

(and thus related to ManaforPs feilure to file previously) are maintained at the Subject Premises,
including records of Manafort’s work on behalf of the Party of Regions and payments received
fi:om them. Among other things, in the Gates Interview, Gates told the FBI that Manafort and he
Used “standard English” common law contracts for their Ukrainian work and would invoice the

customer for payment.^
69.

These records are particularly valuable since counselfor Manafort has informed the

United States Department of Justice that at least as of November 23, 2016, DMP International,
LLC purports to have an “Email Retention Policy” which results in its not retaining
“communications beyond thirty days.” In spite of its title, the policy purports to cover not just
email, but “information that is either stored or shared via electronic mail or instant messaging

technologies, and documentation residing on any computer or server.” The policy also purports
to provide that “[ejach en^loyee may at its [sic] discretion archive certain electronic information

that pertains to the con5)any’s business or mission,” but the the employee “must do so with the
knowledge that all emails,electronic documents and other electronic material shall be deleted from

corporate equipment,including but not limited to,computers, servers, and mobile devices, within
30 days of possession ofthe information.”

70.

There is also probable cause to believe that the Subject Premises contains records

related to Manafort’s efforts to secure loans fi:om H on the basis ofinconsistentrepresentations
about his income and net worth, as described above. Records obtained from HH show that in

^ In contrast,in their June 27,2017,FARA filings. Gates, Manafort, and DMP International, LLC
indicated that there was no formal written contract of exchange of correspondence between the
parties. In such circumstances, the FARA form requires the filer to “give a corrqplete description”
of the terms and conditions of the oral agreement or understanding, its duration, the fees and
expenses,if any, to be received.” The June 2017 filings provide none ofthat information.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 37 of 50 PageID# 220

approximately August 2016,Manafort submitted bank statements for two accounts at Cititom
in connection with his application for lending. One ofthe two bank statements submitted to m
is addressed tojjH^HHIi

address ofthe Subject Premises. Bank records also show

that beginning in December 2016,bank statements for the other account were directed to the same

address. Accordingly, there is probable cause to believe that bank statements and other
documentation related to those accounts, which formed part of the

consideration of

Manafort’s request for lending, could be found at the Subject Premises.

71.

Additionally, there is probable cause to believe that other financial records relevant

to the Subject Offenses wiU be found at the Subject Premises. Manafort’s prior residence in
Alexandria,

listed as the address of record for a number of

accounts,including accounts at First Republic Bank ici Chicago that were closed in 2014following
anti-money laundermg concerns by the bank, as discussed in Paragraph 16 above. Prom my

training and experience,I am aware that individuals and businesses often retain copies offinancial
records for several years, including m connection with tax filing obligations. Accordingly, and

given the fact that Manafort and his wife moved to the Subject Premises from his prior residence

in the same city in approximately May of 2015, it is reasonable to believe that financial records
sent to his prior residence may be found at the Subject Premises. Additionally, a mail cover

conducted by the PBI, involving the review of the outside cover of United States Postal Service
(USPS) TTiflil addressed to the Subject Premises, reveals that during the period between

approximately June 13, 2017 and July 12, 2017, mail to the Subject Premises included, among

other things, a first class mailing:&om^H[mH ^HBH

M&T Bank,

and a statement from American Express addressed to both Paul Manafort and *Davis Manafort
Part,” which I believe to refer to Davis Manafort Partners,

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 38 of 50 PageID# 221

72.

Further, there is probable cause to believe that the Subject Premises contains

physical evidence in the form of physical items purchased through the use offunds from foreign
bank accounts, including from the Cypriot bank accounts described above. For instance, given

that Manafort lives at the premises, there is probable cause to believe that men’s clothing and
accessories purchased at one or both of the clothing vendors and paid for by wire transfers from

various Cyprus accounts, as referenced in Paragraph 14 above, will be found at the Subject
premises. Bank records and records obtained from the clothiers show that between 2009 and 2012,

Manafort purchased more than approximately $760,000 in merchandise from these two clothiers

using funds wired from several of the Cypriot accounts. Purchases included multiple suits and
jackets in excess of$10,000 and at least one limited edition Bijan Black Titanium ‘*Royal Way”

watch, purchased for $21,000. Between approximately 2009 and spring 2015, invoices for

Manafort’s purchases from ^^^^B were sent to Manafort’s previous Alexandria residence
on

recently, invoices have been sent to Manafort at the Subject

Premises. According toimil there are two closets at the Subject Premises that contain clothing
and jewelry.

73.

There is also reason to believe that rugs piurchased with funds from the Cypriot

accounts would be found at the Subject Premises. Wire transfers totaling more than $360,000
were sent from Cypriot accounts directly to

^ carpet store located in

Alexandria, Virginia, near to the Subject Premises. The funds were used to pay,for rugs acquired
by Manafort. In an interview with the FBI,one ofthe owners

advised that

Manafort brought several ofhis purchases back to the store for cleaning, which remain at the store.
It is reasonable to believe that the remaining rugs purchased by Manafort with funds funneled

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 39 of 50 PageID# 222

through the Cypriot accounts will he found at the Subject Premises (to include Premises* storage
unit).

74.

Although I submit that there is probable cause to seize the aforementioned rugs and

clothing as fruits of the Subject Offenses, the FBI does not intend to seize those items. Rather,

upon an authorized search of the Subject Premises, the FBI intends to identify and photograph
those items.

Computers,Electromc Storage,and Forensic Analysis

75.

As described in Attachment B, this application seeks permission to search for

records that might be found on the Subject Premises,in whatever form they are found. One form
in which the records might be found is data stored on a computer’s hard drive or other storage

media. Thus, the warrant applied for would authorize the seizure ofelectronic storage media or,
potentially, the copying of electronically stored information, all under Rule 41(e)(2)(B).

76.

In a July 2017 interview, m advised the FBI that there is a Mac desktop

conqjuter on the desk in the office at the Subject Premises, which is used by Manafort. For a

variety of reasons, copies of historical records and current records are also frequently stored on
external hard drives, thumb drives, and magnetic disks. There is reasonable cause to believe such

media may be contained in and among records of Manafort’s business and financial activity at the

Subject Premises. FBI interviews of [H further confirm that Manafort has made widespread
use of electronic media in the course of his business activity. For exan^le,

that Manafort had a drawer fiiU of phones and electronic equipment at his old residence in Mount

Vemon Square. At one point, Manafort gaveH H a bag of computers and directed HHIto

A storage medium is any physical object upon which computer data can be recorded. Examples
include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and other magnetic or optical
media.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 40 of 50 PageID# 223

have the drives wiped before giving them to charity. Manafort also’,gaveH^ several additional
devices, both laptops and cellular phones.
77.

Isubmit that there is probable cause to beHeve that evidence ofthe Subject Offenses

may be found on storage media located at the Subject Premises, including but not limited to a
desktop con^uter,for at least the foUowing reasons:

a. Based on my knowledge,training, and experience,I know that computer files or
remnants ofsuch fiiles can be recovered months or even years after they have been

downloaded onto a storage medium, deleted, or viewed via the Intemet.
Electronic files downloaded to a storage medium can be stored for years at little
or no cost. Even when files have been deleted, they can be recovered months or

years later using forensic tools. This is so because when a person “deletes” a file

on a computer,the data contained in the file does not actually disappear} rather,
that data remains on the storage medium until it is overwritten by new data.
b. Therefore deleted files, or remnants of deleted files, may reside in free space or

slack space-that is, in space on the storage medium that is not currently being used

by an active file 7-for long periods of time before they are overwritten. In addition,
a conoputer’s operating system may also keep a record of deleted data in a “swap”
or ‘^recovery” file. .

c. Wholly apart from user-generated files, computer storage media – in particular,
aC/ con[5)uters’ internal hard drives – contain electronic evidence of how a computer
has been used, what it has been used for, and who has used it. To give a few
examples, this forensic evidence can take the form of operating system

configurations, artifacts from operating system or ^plication operation,file system

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 41 of 50 PageID# 224

data structures, and virtual memory “swap” or paging files. Con^uter users

typically do not erase or delete this evidence, because special software is typically
required for that task. However,it is technically possible to delete this information.
78.

Forensic evidence. As further described in Attachment B,this application seeks

permission to locate not only computer files that might serve as direct evidence of the crimes
described on the warrant, but also for forensic electronic evidence that establishes how computers

were used, the purpose oftheir use, who used them, and when. There is probable cause to believe
that this forensic electronic evidence will be on any storage medium in the Subject Premises
because:

a. Data on the storage TTiedium can provide evidence of a file that was once on the

storage medium but has since been deleted or edited, or of a deleted portion of a

file(such as a paragraph that has been deleted from a word processing file). Virtual
memory paging systems can leave traces ofinformation on the storage medium that
show what tasks and processes were recently active. Web browsers, e-mail
programs, and chat programs store configuration information on the storage
medium that can reveal infiirmation such as online nicknames and passwords.

Ojperating systems can record additional information, such as the attachment of
peripherals, the attachment of USB fiash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were

created, although this information can later be falsified.

b. As explained herein, information stored within a computer and other electronic
storage media may provide crucial;evidence ofthe *Who, what, why, when.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 42 of 50 PageID# 225

where, and how” of the criminal conduct under investigation, thus enabling the
United States to establish and prove each element or alternatively, to exclude the

innocent from frirther suspicion. In my training and experience, information
stored within a con^uter or storage media(e.g.,registry information,
communications, images and movies, transactional information, records of

session times and durations, internet history, and anti-virus, spyware, and

malware detection programs)can indicate who has used or controlled the
computer or storage media. This “user attribution” evidence is analogous to the

search for “indicia ofoccupancy” while executing a search warrant at a residence.
The existence or absence of anti-virus, spyware, and malware detection programs
may indicate whether the computer was remotely accessed, thus inculpating or

exculpating the computer owner. Further, con5)uter and storage media activity
can indicate how and when the computer or storage media was accessed or used.

For example, as described hereiu, con^uters typically contain,information that
log: computer user account session times and durations, computer activity
associated with user accounts, electronic storage media that connected with the
computer, and the IP addresses through which the computer accessed networks
and the internet. Such information allows investigators to understand the
chronological context ofcomputer or electronic storage media access, use, and
events relating to the crime under investigation. Additionally,some iuformation

stored within a con5)uter or electronic storage media may provide crucial

evidence relating to the physical location of other evidence and the suspect For
example,images stored on a computer may both show a particular location and

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 43 of 50 PageID# 226

have geolocation information incorporated into its file data. Such file data

typically also contains information indicating when the file or image was created.
The existence ofsuch image files, along with external device connection logs,

may also indicate the presence of additional electronic storage media (e.g., a

digital camera or cellular phone with an incoiporated camera). The geographic
and timeline information described herein may either inculpate or exculpate the”

computer user. Last,information stored within a con[5)uter may provide relevant
insight into the computer user*s state of mind as it relates to the offense under
investigation. For example, information within the computer may indicate the
owner’s motive and intent to commit a criine (e.g.,intemet searches indicating

criininal planning), or consciousness of guilt (e.g.,running a **wipmg” program to
destroy e’vidence on the computer or password protecting/encrypting such
evidence in an effort to concealit from law enforcement).

c. A person with appropriate familiarity with how a computer works can, after
examining this forensic evidence in its proper context, draw conclusions about

how computers were used, the purpose oftheir use, who used them, and when.
d. The process ofidentifying the exact files, blocks, registry entries,logs, or other
forms offorensic evidence on a storage medium that are necessary to draw an

accurate conclusion is a dynamic process. While it is possible to specify in
advance the records to be sought, computer evidence is not always data that can

be merely reviewed by a review team-and passed along to investigators. Whether
data stored on a computer is evidence may depend on other inforniation stored on
the cori^uter and the application of knowledge about how a computer behaves.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 44 of 50 PageID# 227

Therefore, contextual information necessary to understand other evidence also
falls within the scope ofthe warrant,

e. Further, in finding evidence of how a computer was used, the purpose of its use,
who used it, and when,sometimes it is necessary to establish that a particular

thing is not present on a storage medium. For example, the presence or absence
of counter-forensic programs or anti-virus programs(and associated data) may be
relevant to establishing the user’s intent.

79.

Necessity ofseizing or copying entire computers or storage media. In niost cases,

a thorough search of a premdses for information that might be stored on storage media often
requires the seizure of the physical storage media and later off-site review consistent with the
warrant.In lieu ofremoving storage media from the premises, it is sometimes possible to make

an image copy of storage media. Generally speaking,imaging is the taking of a con^lete
electronic picture oftbe computer’s data,including all hidden sectors and deleted files. Either

seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded
on the storage media, and to prevent the loss ofthe data either from accidental or intentional
destmction. This is true because ofthe following:
a. The time requiredfor an examination. As noted above, not all evidence takes the

form of documents and files that can be easily viewed on site. Analyzing
evidence of how a computer has been used, what it has been used for, and who

has used it requires considerable time, and taking that much time on premises
could be unreasonable. As explained above, because the warrant calls for forensic

electronic evidence, it is exceedingly likely that it will be necessary to thoroughly
examine storage media to obtain evidence. Storage media can store a large

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 45 of 50 PageID# 228

volume ofinformation. Reviewing that information for things described in the

warrant can take weeks or months* depending on the volume of data stored* and
would be impractical and invasive to attenapt on-site.

b. Technical requirements. Computers can be configured in several different ways*

featuring a variety of different operating systems, application software* ^d
configurations. Therefore, searching them sometimes requires tools or knowledge
tbflt might not be present on the search site. The vast array of computer hardware
and software available makes it difficult to know beforq a search what tools or

knowledge will be required to analyze the system and its data on the Subject
Premises. However,taking the storage media off-site and reviewing it in a
controlled environment will allow its exanoination with the proper tools and
knowledge.

c. Variety offorms ofelectronic media. Records sought under this warrant could be
stored in a variety ofstorage media formats that may require off-site reviewing
with specialized forensic tools.

80.

Nature ofexamination. Based on the foregoing* and consistent with Rule

41(e)(2)(B)* the warrant I am applying for would permit seizing,imaging* or otherwise copying
storage media that reasonably appear to contain some or aU ofthe evidence described in the aC/
warrant, and would authorize a later review ofthe media or information consistent with the

warrant. The later review may require techniques* including but not limited to conqiuter-assisted
scans ofthe entire mftdinm, that might expose many parts ofa hard drive to human inspection in
order to determine whether it is evidence described by the warrant.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 46 of 50 PageID# 229

81.

Based on the foregomg,Irespectfully submit there is probable cause to believe that

the Subject Offenses have been committed and that there is probable cause that evidence of the
Subject Offenses, as described in Attachment B,is to be found at the Subject Premises.
in. Conclusion and Ancillary Provisions

82.

Based on the foregoing,Irespectfully request the Court to issue a warrant to search

the Subject Premises, as described in Attachment A to this af&davit, and to seize the items and
information specified in Attachment B.

83.

In light of the confidential and highly sensitive nature of the continuing

investigation, I respectfully request that this affidavit and all papers submitted herewith be
maintained under seal until the Court orders otherwise.

Respectfully submitted.

SpecM Agent
Federal Bureau ofInvestigation

SworjLto before me on

July ,2017

Theresa Carroll Buciianan
United States Magistrate Judge

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 47 of 50 PageID# 230

ATTACHMENT A

The Property to Be Searched

The premises to be searched (the “Subject Premises”) is the condominiuTn unit located at

millllllllllll^milllllll, Alexandria, VA 22314, including the storage unit numberecH
m as well as any locked drawers, containers, cabinets, safes, computers, electronic devices, and
storage media(such as hard disks or other media that can store data)found therein.

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 48 of 50 PageID# 231

ATTACHMENTS

Items to Be Seized (or,in the alternative,identified)

1.
Records relating to violations of31 U.S.C. ASSASS5314,5322(a)(failure tp file a report
offoreign bank and financial accounts); 22 U.S.C. ASS 611,a/, seq.(foreign agents registration act);

26 Xi.S.C. ASS 7206(1)(filing a false tax return); 18 U.S.C. ASS 1014 (fraud in connection with the
extension ofcredit); 18 U.S.C.ASSASS 1341,1343,and 1349(mail fraud, wire fraud,and conspiracy to
commit these offenses); 18 U.S.C. ASSASS 1956 and 1957(money laundering and money laundering

conspira.cy); 52 U.S.C. ASSASS 30121(a)(1)(A) and (a)(2) (foreign national contributions); and 18
U.S.C. ASSASS371 and 2 (conspiracy, aiding and abetting, and attempt to commit-such offenses)
(collectively, the “Subject Offenses”), occurring on or after January 1, 2006, including but not
limited to:

Any and all financial records for Paul Manafort, Jr.,^^^^^^^^^ Richard
Gates, or companies associated with Paul Manafort, fr7 iHhH or
Richard Gates,including but not limited to records relating to any foreign financial
accounts and records relating to payments by or on behalf of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals;
I

Letters, correspondence, emails, or other forms of communications with any
foreign financid institution, or any individual acting as the signatory or controlling
any foreign bank account;

Records relating to efforts by Manafort, Gates, or their affiliated entities to conduct
activities on behalf of, for the benefit of, or at the direction of any foreign
government, foreign officials, foreign entities, foreign persons, or foreign
principals, including but not limited to the Party of Regions and Viktor
YaniUcovych;

Records relating to, discussing, or documenting Telmar Investments Limited,
Tiakora Ventures Limited, Lucicle Consultants Limited, Actinet Trading Limited,
Black Sea View Limited,Bletilla Ventures Limited,Evo Holdings Limited, Global
Highway Limted, Leviathan Advisors Limited, Loav Advisors Limited,Peranova
Holdings Limited, including but not limited to bank records, canceled checks,
money drafts, letters of credit, cashier’s checks, safe deposit records, checkbooks,
and check stubs, duplicates and copies ofchecks,deposit items,savings passbooks,
wire transfer records, and similar bank and financial account records;

Physical items purchased through the use offunds from Cypriot accounts,including
but not limited to rugs purchased from^B^^B^^B,a Bijan Black Titanium
“Royal Way” watch, and clothing purchased from

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 49 of 50 PageID# 232

Evidence relevant to any false statements, pretenses, representations, or material
omissions in connection with communications with the Department ofJustice, the
Internal Revenue Service,tax preparers, accountants, or banks;

Communications, records, documents, and other files^Jmmlvin^^^j^^^e
attendees of the. June 9,2016 meeting at Trump tower,]

Evidence indicating Manafort’s state of mind as it relates to the crimes under
investigation;

The identity ofany person(s)a^including records that help reveal the whereabouts
ofthe person(s)awho communicated with Manafort about any matters relating to
activities conducted by Manafort on behalf of,for the benefit of, or at the direction
of any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;

Any and all daily planners, logs, calendars, or schedule books relating to Manafort
or Gates.

Computers or storage media used as a means to committhe Subject Offenses.

things described in this warrant were created, edited, or deleted,such as logs,
registiy entries, configuration files, saved usemames and passwords,
documents, browsing history, user profiles, email, email contacts,”chat,”
instant messaging logs, photographs, and correspondence;
b. evidence ofsoftware that would allow others to control the COMPUTER,

such as viruses, Trojan horses, and other forms of malicious software, as well
as evidence ofthe presence or absence ofsecurity software designed to detect
malicious software;

c. evidence ofthe lack ofsuch malicious software;

d. evidence indicating how and when the computer was accessed or used to
determine the chronological context ofcomputer access, use, and events
relating to crime under investigation and to the computer user;

e. evidence indicating the computer user’s state of mind as it relates to.the crime
under investigation;

f. evidence ofthe attachment to the COMPUTER ofothw storage devices or
similar containers for electronic evidence;

Case 1:17-sw-00449-TCB Document 13 Filed 06/26/18 Page 50 of 50 PageID# 233

g. evidence ofcounter-forensic programs(and associated data)that are designed
to eliminate data from the COMPUTER;
h. evidence ofthe times the COMPUTER was used;

i. passwords,encryption keys, and other access devices that may be necessary to
access the COMPUTER;

j. documentation and manuals that may be necessary to access the COMPUTER
or to conduct a forensic examination ofthe COMPUTER;

k. records ofor information about Intemet Protocol addresses used by the
COMPUTER;

1. records ofor information about the COMPUTER’s Intemet activity, including
firewall logs, caches, browser history and cookies,”bookmarked” or
“favorite” web pages,search terms diat the user entered into any Intemet
search engine, and records ofuser-typed web addresses;
m. contextual information necessary to understand the evidence described in this
attachment.

As used above, the terms “records” and “information” includes all forms of creation or

storage, including any form of computer or electronic storage (such as hard disks or other media

that can store data); any handmade form (such as writing); any mechanical form (such as printing

or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives,
videotapes, motion pictures, or photocopies).
The term “computer” includes all types of electronic, magnetic, optical, electrochemical,
or other high speed data processing devices performing logical, arithmetic, or storage functions,

including desktop computers, notebook computers, mobile phones,tablets, server computers, and
network hardware.

The term “storage medium” includes any physical object upon which computer data can
be recorded. Examples include hard disks, RAM,floppy disks, flash memory, CD-ROMs, and
other magnetic or optical media.