Mueller Report PDF

The Investigation Into Russian Interference In The 2016 Presidential Election

Report On The Investigation Into Russian Interference In The 2016 Presidential Election Volume I of II Special Counsel Robert S. Mueller, III Submitted Pursuant to 28 C.F.R. § 600.8(c) Washington, D.C. March 2019

CREDIT The Digital Public Library of America (DPLA) has made this public domain text available as part of Open Bookshelf, a free collection of popular openly-licensed ebooks. Digital Divide Data provided EPUB conversion, OCR, and proofreading services. The New York Times contributed a collection of links to citations and footnotes. Internet Archive (archive.org) and MuckRock (muckrock.com) provided help in adding Wayback Machine links to these and other citations and footnotes. Standard Ebooks (standardebooks.org) provided help in editing the links. Bill Kasdorf and Thad McIlroy of Publishing Technology Partners initiated work on a more accessible version. Bill Kasdorf provided guidance to the project on accessibility technology. codeMantra (codemantra.com) implemented the accessibility improvements. Duff Johnson provided accessibility advice. To learn more about Open Bookshelf and other DPLA ebooks offerings, visit https://ebooks.dp.la or email [email protected]. DPLA’s Ebook work and the production of this ebook has been supported by the Alfred P. Sloan Foundation. Version 1.6

NOTE TO READER The redacted version of the Report On The Investigation into Russian Interference In The 2016 Presidential Election, colloquially known as the “Mueller Report”, was released on the 18th of April 2019 by US Attorney General William Barr. The official PDF version of this document contains 2,390 footnotes (including 3,355 specific references), spread across two volumes and four appendices. Of these references, only 14 are hyperlinked URLs leading to live web pages. This annotated EPUB version of the Mueller Report addresses this problem with over 740 hyperlinked citations, including over 100 links to Justice.gov, 80 links to Twitter.com and 50 links to C-span.org totaling over 700 links to the original sources cited. In an attempt to add contextualization to the report we have added links to resources not directly cited, these are denoted with the message ‘Internet Archive Editor’s Note (IAEN)’. In an effort to eliminate link rot and content drift we are using Wayback Machine URLs or Archive.org items in all cases. While the loading of content from archival links is typically slower than from the “live web” the Internet Archive believes integrity is more important than speed. This annotated version is not all-encompassing at this time. For example, many cited tweets are unavailable on either the live web or the Internet Archive’s Wayback Machine. Where a reference is unavailable to the public it was left un-linked. As more information is released, and as redactions are revealed, we intend to update this annotated version.

TABLE OF CONTENTS – VOLUME I INTRODUCTION TO VOLUME I EXECUTIVE SUMMARY TO VOLUME I I. THE SPECIAL COUNSEL’S INVESTIGATION II. RUSSIAN “ACTIVE MEASURES” SOCIAL MEDIA CAMPAIGN A. Structure of the Internet Research Agency B. Funding and Oversight from Concord and Prigozhin C. The IRA Targets U.S. Elections 1. The IRA Ramps Up U.S. Operations As Early As 2014 2. U.S. Operations Through IRA-Controlled Social Media Accounts 3. U.S. Operations Through Facebook 4. U.S. Operations Through Twitter a. Individualized Accounts b. IRA Botnet Activities 5. U.S. Operations Involving Political Rallies 6. Targeting and Recruitment of U.S. Persons 7. Interactions and Contacts with the Trump Campaign a. Trump Campaign Promotion of IRA Political Materials b. Contact with Trump Campaign Officials in Connection to Rallies III. RUSSIAN HACKING AND DUMPING OPERATIONS A. GRU Hacking Directed at the Clinton Campaign 1. GRU Units Target the Clinton Campaign 2. Intrusions into the DCCC and DNC Networks a. Initial Access b. Implantation of Malware on DCCC and DNC Networks c. Theft of Documents from DNC and DCCC Networks B. Dissemination of the Hacked Materials 1. DCLeaks 2. Guccifer 2.0 3. Use of WikiLeaks a. WikiLeaks’s Expressed Opposition Toward the Clinton Campaign b. WikiLeaks’s First Contact with Guccifer 2.0 and DCLeaks c. The GRU’s Transfer of Stolen Materials to WikiLeaks d. WikiLeaks Statements Dissembling About the Source of Stolen Materials C. Additional GRU Cyber Operations

1. Summer and Fall 2016 Operations Targeting Democrat-Linked Victims 2. Intrusions Targeting the Administration of U.S. Elections D. Trump Campaign and the Dissemination of Hacked Materials 1. HOM█ █ █ █ a. Background b. Contacts with the Campaign about WikiLeaks c. Harm to Ongoing Matter█ █ █ █ d. WikiLeaks’s October 7, 2016 Release of Stolen Podesta Emails e. Donald Trump Jr. Interaction with WikiLeaks 2. Other Potential Campaign Interest in Russian Hacked Materials a. Henry Oknyansky (a/k/a Henry Greenberg) b. Campaign Efforts to Obtain Deleted Clinton Emails IV. RUSSIAN GOVERNMENT LINKS TO AND CONTACTS WITH THE TRUMP CAMPAIGN A. Campaign Period (September 2015 – November 8, 2016) 1. Trump Tower Moscow Project a. Trump Tower Moscow Venture with the Crocus Group (2013-2014) b. Communications with I.C. Expert Investment Company and Giorgi Rtskhiladze (Summer and Fall 2015) c. Letter of Intent and Contacts to Russian Government (October 2015-January 2016) i. Trump Signs the Letter of Intent on behalf of the Trump Organization ii. Post-LOI Contacts with Individuals in Russia d. Discussions about Russia Travel by Michael Cohen or Candidate Trump (December 2015-June 2016) i. Sater’s Overtures to Cohen to Travel to Russia ii. Candidate Trump’s Opportunities to Travel to Russia 2. George Papadopoulos a. Origins of Campaign Work b. Initial Russia-Related Contacts c. March 31 Foreign Policy Team Meeting d. George Papadopoulos Learns That Russia Has “Dirt” in the Form of Clinton Emails e. Russia-Related Communications With The Campaign f. Trump Campaign Knowledge of “Dirt” g. Additional George Papadopoulos Contact 3. Carter Page a. Background b. Origins of and Early Campaign Work c. Carter Page’s July 2016 Trip To Moscow d. Later Campaign Work and Removal from the Campaign

4. Dimitri Simes and the Center for the National Interest a. CNI and Dimitri Simes Connect with the Trump Campaign b. National Interest Hosts a Foreign Policy Speech at the Mayflower Hotel c. Jeff Sessions’s Post-Speech Interactions with CNI d. Jared Kushner’s Continuing Contacts with Simes 5. June 9, 2016 Meeting at Trump Tower a. Setting Up the June 9 Meeting i. Outreach to Donald Trump Jr ii. Awareness of the Meeting Within the Campaign b. The Events of June 9, 2016 i. Arrangements for the Meeting ii. Conduct of the Meeting c. Post-June 9 Events 6. Events at the Republican National Convention a. Ambassador Kislyak’s Encounters with Senator Sessions and J.D. Gordon the Week of the RNC b. Change to Republican Party Platform 7. Post-Convention Contacts with Kislyak a. Ambassador Kislyak Invites J.D. Gordon to Breakfast at the Ambassador’s Residence b. Senator Sessions’s September 2016 Meeting with Ambassador Kislyak 8. Paul Manafort a. Paul Manafort’s Ties to Russia and Ukraine i. Oleg Deripaska Consulting Work ii. Political Consulting Work iii. Konstantin Kilimnik b. Contacts during Paul Manafort’s Time with the Trump Campaign i. Paul Manafort Joins the Campaign ii. Paul Manafort’s Campaign-Period Contacts iii. Paul Manafort’s Two Campaign-Period Meetings with Konstantin Kilimnik in the United States c. Post-Resignation Activities B. Post-Election and Transition-Period Contacts 1. Immediate Post-Election Activity a. Outreach from the Russian Governmen b. High-Level Encouragement of Contacts through Alternative Channels 2. Kirill Dmitriev’s Transition-Era Outreach to the Incoming Administration a. Background b. Kirill Dmitriev’s Post-Election Contacts With the Incoming Administration c. Erik Prince and Kirill Dmitriev Meet in the Seychelles

i. George Nader and Erik Prince Arrange Seychelles Meeting with Dmitriev ii. The Seychelles Meetings iii. Erik Prince’s Meeting with Steve Bannon after the Seychelles Trip d. Kirill Dmitriev’s Post-Election Contact with Rick Gerson Regarding U.S.-Russia Relations 3. Ambassador Kislyak’s Meeting with Jared Kushner and Michael Flynn in Trump Tower Following the Election 4. Jared Kushner’s Meeting with Sergey Gorkov 5. Petr Aven’s Outreach Efforts to the Transition Team 6. Carter Page Contact with Deputy Prime Minister Arkady Dvorkovich 7. Contacts With and Through Michael T. Flynn a. United Nations Vote on Israeli Settlements b. U.S. Sanctions Against Russia V. PROSECUTION AND DECLINATION DECISIONS A. Russian “Active Measures” Social Media Campaign B. Russian Hacking and Dumping Operations 1. Section 1030 Computer-Intrusion Conspiracy a. Background b. Charging Decision As to Harm to Ongoing Matter█ █ █ █ 2. Potential Section 1030 Violation By Personal Privacy█ █ █ █ C. Russian Government Outreach and Contacts 1. Potential Coordination: Conspiracy and Collusion 2. Potential Coordination: Foreign Agent Statutes (FARA and 18 U.S.C. § 951) a. Governing Law b. Application 3. Campaign Finance a. Overview Of Governing Law b. Application to June 9 Trump Tower Meeting i. Thing-of-Value Element ii. Willfulness iii. Difficulties in Valuing Promised Information c. Application to WikiLeaks HOM█ █ █ █ i. Questions Over Harm to Ongoing Matter█ █ █ █ ii. Willfulness iii. Constitutional Considerations iv. Analysis HOM█ █ █ █ 4. False Statements and Obstruction of the Investigation a. Overview Of Governing Law

b. Application to Certain Individuals i. George Papadopoulos ii. Personal Privacy█ █ █ █ iii. Michael Flynn iv. Michael Cohen v. HOM█ █ █ █ vi. Jeff Sessions vii. Others Interviewed During the Investigation

INTRODUCTION TO VOLUME I This report is submitted to the Attorney General pursuant to 28 C.F.R. § 600.8(c), which states that, “[a]t the conclusion of the Special Counsel’s work, he . . . shall provide the Attorney General a confidential report explaining the prosecution or declination decisions [the Special Counsel] reached.” The Russian government interfered in the 2016 presidential election in sweeping and systematic fashion. Evidence of Russian government operations began to surface in mid-2016. In June, the Democratic National Committee and its cyber response team publicly announced that Russian hackers had compromised its computer network. Releases of hacked materials—hacks that public reporting soon attributed to the Russian government—began that same month. Additional releases followed in July through the organization WikiLeaks, with further releases in October and November. In late July 2016, soon after WikiLeaks’s first release of stolen documents, a foreign government contacted the FBI about a May 2016 encounter with Trump Campaign foreign policy advisor George Papadopoulos. Papadopoulos had suggested to a representative of that foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information damaging to Democratic presidential candidate Hillary Clinton. That information prompted the FBI on July 31, 2016, to open an investigation into whether individuals associated with the Trump Campaign were coordinating with the Russian government in its interference activities. That fall, two federal agencies jointly announced that the Russian government “directed recent compromises of e-mails from US persons and institutions, including US political organizations,” and, “[t]hese thefts and disclosures are intended to interfere with the US election process.” After the election, in late December 2016, the United States imposed sanctions on Russia for having interfered in the election. By early 2017, several congressional committees were examining Russia’s interference in the election. Within the Executive Branch, these investigatory efforts ultimately led to the May 2017 appointment of Special Counsel Robert S. Mueller, III. The order appointing the Special Counsel authorized him to investigate “the Russian government’s efforts to interfere in the 2016 presidential election,” including any

links or coordination between the Russian government and individuals associated with the Trump Campaign. As set forth in detail in this report, the Special Counsel’s investigation established that Russia interfered in the 2016 presidential election principally through two operations. First, a Russian entity carried out a social media campaign that favored presidential candidate Donald J. Trump and disparaged presidential candidate Hillary Clinton. Second, a Russian intelligence service conducted computer-intrusion operations against entities, employees, and volunteers working on the Clinton Campaign and then released stolen documents. The investigation also identified numerous links between the Russian government and the Trump Campaign. Although the investigation established that the Russian government perceived it would benefit from a Trump presidency and worked to secure that outcome, and that the Campaign expected it would benefit electorally from information stolen and released through Russian efforts, the investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities. * * * Below we describe the evidentiary considerations underpinning statements about the results of our investigation and the Special Counsel’s charging decisions, and we then provide an overview of the two volumes of our report. The report describes actions and events that the Special Counsel’s Office found to be supported by the evidence collected in our investigation. In some instances, the report points out the absence of evidence or conflicts in the evidence about a particular fact or event. In other instances, when substantial, credible evidence enabled the Office to reach a conclusion with confidence, the report states that the investigation established that certain actions or events occurred. A statement that the investigation did not establish particular facts does not mean there was no evidence of those facts. In evaluating whether evidence about collective action of multiple individuals constituted a crime, we applied the framework of conspiracy law, not the concept of “collusion.” In so doing, the Office recognized that the word “collud[e]” was used in communications with the Acting Attorney General

confirming certain aspects of the investigation’s scope and that the term has frequently been invoked in public reporting about the investigation. But collusion is not a specific offense or theory of liability found in the United States Code, nor is it a term of art in federal criminal law. For those reasons, the Office’s focus in analyzing questions of joint criminal liability was on conspiracy as defined in federal law. In connection with that analysis, we addressed the factual question whether members of the Trump Campaign “coordinat[ed]”—a term that appears in the appointment order—with Russian election interference activities. Like collusion, “coordination” does not have a settled definition in federal criminal law. We understood coordination to require an agreement—tacit or express—between the Trump Campaign and the Russian government on election interference. That requires more than the two parties taking actions that were informed by or responsive to the other’s actions or interests. We applied the term coordination in that sense when stating in the report that the investigation did not establish that the Trump Campaign coordinated with the Russian government in its election interference activities. * * * The report on our investigation consists of two volumes: Volume I describes the factual results of the Special Counsel’s investigation of Russia’s interference in the 2016 presidential election and its interactions with the Trump Campaign. Section I describes the scope of the investigation. Sections II and III describe the principal ways Russia interfered in the 2016 presidential election. Section IV describes links between the Russian government and individuals associated with the Trump Campaign. Section V sets forth the Special Counsel’s charging decisions. Volume II addresses the President’s actions towards the FBI’s investigation into Russia’s interference in the 2016 presidential election and related matters, and his actions towards the Special Counsel’s investigation. Volume II separately states its framework and the considerations that guided that investigation.

EXECUTIVE SUMMARY TO VOLUME I RUSSIAN SOCIAL MEDIA CAMPAIGN The Internet Research Agency (IRA) carried out the earliest Russian interference operations identified by the investigation—a social media campaign designed to provoke and amplify political and social discord in the United States. The IRA was based in St. Petersburg, Russia, and received funding from Russian oligarch Yevgeniy Prigozhin and companies he controlled. Prigozhin is widely reported to have ties to Russian President Vladimir Putin, █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ In mid-2014, the IRA sent employees to United States on an intelligence- gathering mission with instructions Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The IRA later used social media accounts and interest groups to sow discord in the U.S. political system through what it termed “information warfare.” The campaign evolved from a generalized program designed in 2014 and 2015 to undermine the U.S. electoral system, to a targeted operation that by early 2016 favored candidate Trump and disparaged candidate Clinton. The IRA’s operation also included the purchase of political advertisements on social media in the names of U.S. persons and entities, as well as the staging of political rallies inside the United States. To organize those rallies, IRA employees posed as U.S. grassroots entities and persons and made contact with Trump supporters and Trump Campaign officials in the United States. The investigation did not identify evidence that any U.S. persons conspired or coordinated with the IRA. Section II of this report details the Office’s investigation of the Russian social media campaign. RUSSIAN HACKING OPERATIONS At the same time that the IRA operation began to focus on supporting candidate Trump in early 2016, the Russian government employed a second

form of interference: cyber intrusions (hacking) and releases of hacked materials damaging to the Clinton Campaign. The Russian intelligence service known as the Main Intelligence Directorate of the General Staff of the Russian Army (GRU) carried out these operations. In March 2016, the GRU began hacking the email accounts of Clinton Campaign volunteers and employees, including campaign chairman John Podesta. In April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC). The GRU stole hundreds of thousands of documents from the compromised email accounts and networks. Around the time that the DNC announced in mid-June 2016 the Russian government’s role in hacking its network, the GRU began disseminating stolen materials through the fictitious online personas “DCLeaks” and “Guccifer 2.0.” The GRU later released additional materials through the organization WikiLeaks. The presidential campaign of Donald J. Trump (“Trump Campaign” or “Campaign”) showed interest in WikiLeaks’s releases of documents and welcomed their potential to damage candidate Clinton. Beginning in June 2016, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ forecast to senior Campaign officials that WikiLeaks would release information damaging to candidate Clinton. WikiLeaks’s first release came in July 2016. Around the same time, candidate Trump announced that he hoped Russia would recover emails described as missing from a private server used by Clinton when she was Secretary of State (he later said that he was speaking sarcastically). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ WikiLeaks began releasing Podesta’s stolen emails on October 7, 2016, less than one hour after a U.S. media outlet released video considered damaging to candidate Trump. Section III of this Report details the Office’s investigation into the Russian hacking operations, as well as other efforts by Trump Campaign supporters to obtain Clinton-related emails. RUSSIAN CONTACTS WITH THE CAMPAIGN The social media campaign and the GRU hacking operations coincided with a series of contacts between Trump Campaign officials and individuals with ties to the Russian government. The Office investigated whether those contacts

reflected or resulted in the Campaign conspiring or coordinating with Russia in its election-interference activities. Although the investigation established that the Russian government perceived it would benefit from a Trump presidency and worked to secure that outcome, and that the Campaign expected it would benefit electorally from information stolen and released through Russian efforts, the investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities. The Russian contacts consisted of business connections, offers of assistance to the Campaign, invitations for candidate Trump and Putin to meet in person, invitations for Campaign officials and representatives of the Russian government to meet, and policy positions seeking improved U.S.-Russian relations. Section IV of this Report details the contacts between Russia and the Trump Campaign during the campaign and transition periods, the most salient of which are summarized below in chronological order. 2015. Some of the earliest contacts were made in connection with a Trump Organization real-estate project in Russia known as Trump Tower Moscow. Candidate Trump signed a Letter of Intent for Trump Tower Moscow by November 2015, and in January 2016 Trump Organization executive Michael Cohen emailed and spoke about the project with the office of Russian government press secretary Dmitry Peskov. The Trump Organization pursued the project through at least June 2016, including by considering travel to Russia by Cohen and candidate Trump. Spring 2016. Campaign foreign policy advisor George Papadopoulos made early contact with Joseph Mifsud, a London-based professor who had connections to Russia and traveled to Moscow in April 2016. Immediately upon his return to London from that trip, Mifsud told Papadopoulos that the Russian government had “dirt” on Hillary Clinton in the form of thousands of emails. One week later, in the first week of May 2016, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information damaging to candidate Clinton. Throughout that period of time and for several months thereafter, Papadopoulos worked with Mifsud and two Russian nationals to arrange a meeting between the Campaign and the Russian government. No meeting took place.

Summer 2016. Russian outreach to the Trump Campaign continued into the summer of 2016, as candidate Trump was becoming the presumptive Republican nominee for President. On June 9, 2016, for example, a Russian lawyer met with senior Trump Campaign officials Donald Trump Jr., Jared Kushner, and campaign chairman Paul Manafort to deliver what the email proposing the meeting had described as “official documents and information that would incriminate Hillary.” The materials were offered to Trump Jr. as “part of Russia and its government’s support for Mr. Trump.” The written communications setting up the meeting showed that the Campaign anticipated receiving information from Russia that could assist candidate Trump’s electoral prospects, but the Russian lawyer’s presentation did not provide such information. Days after the June 9 meeting, on June 14, 2016, a cybersecurity firm and the DNC announced that Russian government hackers had infiltrated the DNC and obtained access to opposition research on candidate Trump, among other documents. In July 2016, Campaign foreign policy advisor Carter Page traveled in his personal capacity to Moscow and gave the keynote address at the New Economic School. Page had lived and worked in Russia between 2003 and 2007. After returning to the United States, Page became acquainted with at least two Russian intelligence officers, one of whom was later charged in 2015 with conspiracy to act as an unregistered agent of Russia. Page’s July 2016 trip to Moscow and his advocacy for pro-Russian foreign policy drew media attention. The Campaign then distanced itself from Page and, by late September 2016, removed him from the Campaign. July 2016 was also the month WikiLeaks first released emails stolen by the GRU from the DNC. On July 22, 2016, WikiLeaks posted thousands of internal DNC documents revealing information about the Clinton Campaign. Within days, there was public reporting that U.S. intelligence agencies had “high confidence” that the Russian government was behind the theft of emails and documents from the DNC. And within a week of the release, a foreign government informed the FBI about its May 2016 interaction with Papadopoulos and his statement that the Russian government could assist the Trump Campaign. On July 31, 2016, based on the foreign government reporting, the FBI opened an investigation into potential coordination between the Russian government and individuals associated with the Trump Campaign.

Separately, on August 2, 2016, Trump campaign chairman Paul Manafort met in New York City with his long-time business associate Konstantin Kilimnik, who the FBI assesses to have ties to Russian intelligence. Kilimnik requested the meeting to deliver in person a peace plan for Ukraine that Manafort acknowledged to the Special Counsel’s Office was a “backdoor” way for Russia to control part of eastern Ukraine; both men believed the plan would require candidate Trump’s assent to succeed (were he to be elected President). They also discussed the status of the Trump Campaign and Manafort’s strategy for winning Democratic votes in Midwestern states. Months before that meeting, Manafort had caused internal polling data to be shared with Kilimnik, and the sharing continued for some period of time after their August meeting. Fall 2016. On October 7, 2016, the media released video of candidate Trump speaking in graphic terms about women years earlier, which was considered damaging to his candidacy. Less than an hour later, WikiLeaks made its second release: thousands of John Podesta’s emails that had been stolen by the GRU in late March 2016. The FBI and other U.S. government institutions were at the time continuing their investigation of suspected Russian government efforts to interfere in the presidential election. That same day, October 7, the Department of Homeland Security and the Office of the Director of National Intelligence issued a joint public statement “that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.” Those “thefts” and the “disclosures” of the hacked materials through online platforms such as WikiLeaks, the statement continued, “are intended to interfere with the US election process.” Post-2016 Election. Immediately after the November 8 election, Russian government officials and prominent Russian businessmen began trying to make inroads into the new administration. The most senior levels of the Russian government encouraged these efforts. The Russian Embassy made contact hours after the election to congratulate the President-Elect and to arrange a call with President Putin. Several Russian businessmen picked up the effort from there. Kirill Dmitriev, the chief executive officer of Russia’s sovereign wealth fund, was among the Russians who tried to make contact with the incoming administration. In early December, a business associate steered Dmitriev to Erik Prince, a supporter of the Trump Campaign and an associate of senior Trump advisor Steve Bannon. Dmitriev and Prince later met face-to-face in January 2017 in the Seychelles and discussed U.S.-Russia relations. During the same

period, another business associate introduced Dmitriev to a friend of Jared Kushner who had not served on the Campaign or the Transition Team. Dmitriev and Kushner’s friend collaborated on a short written reconciliation plan for the United States and Russia, which Dmitriev implied had been cleared through Putin. The friend gave that proposal to Kushner before the inauguration, and Kushner later gave copies to Bannon and incoming Secretary of State Rex Tillerson. On December 29, 2016, then-President Obama imposed sanctions on Russia for having interfered in the election. Incoming National Security Advisor Michael Flynn called Russian Ambassador Sergey Kislyak and asked Russia not to escalate the situation in response to the sanctions. The following day, Putin announced that Russia would not take retaliatory measures in response to the sanctions at that time. Hours later, President-Elect Trump tweeted, “Great move on delay (by V. Putin).” The next day, on December 31, 2016, Kislyak called Flynn and told him the request had been received at the highest levels and Russia had chosen not to retaliate as a result of Flynn’s request. * * * On January 6, 2017, members of the intelligence community briefed President-Elect Trump on a joint assessment—drafted and coordinated among the Central Intelligence Agency, FBI, and National Security Agency—that concluded with high confidence that Russia had intervened in the election through a variety of means to assist Trump’s candidacy and harm Clinton’s. A declassified version of the assessment was publicly released that same day. Between mid-January 2017 and early February 2017, three congressional committees—the House Permanent Select Committee on Intelligence (HPSCI), the Senate Select Committee on Intelligence (SSCI), and the Senate Judiciary Committee (SJC)—announced that they would conduct inquiries, or had already been conducting inquiries, into Russian interference in the election. Then-FBI Director James Comey later confirmed to Congress the existence of the FBI’s investigation into Russian interference that had begun before the election. On March 20, 2017, in open-session testimony before HPSCI, Comey stated: I have been authorized by the Department of Justice to confirm that the FBI, as part of our counterintelligence mission, is

investigating the Russian government’s efforts to interfere in the 2016 presidential election, and that includes investigating the nature of any links between individuals associated with the Trump campaign and the Russian government and whether there was any coordination between the campaign and Russia’s efforts. . . . As with any counterintelligence investigation, this will also include an assessment of whether any crimes were committed. The investigation continued under then-Director Comey for the next seven weeks until May 9, 2017, when President Trump fired Comey as FBI Director— an action which is analyzed in Volume II of the report. On May 17, 2017, Acting Attorney General Rod Rosenstein appointed the Special Counsel and authorized him to conduct the investigation that Comey had confirmed in his congressional testimony, as well as matters arising directly from the investigation, and any other matters within the scope of 28 C.F.R. § 600.4(a), which generally covers efforts to interfere with or obstruct the investigation. President Trump reacted negatively to the Special Counsel’s appointment. He told advisors that it was the end of his presidency, sought to have Attorney General Jefferson (Jeff) Sessions unrecuse from the Russia investigation and to have the Special Counsel removed, and engaged in efforts to curtail the Special Counsel’s investigation and prevent the disclosure of evidence to it, including through public and private contacts with potential witnesses. Those and related actions are described and analyzed in Volume II of the report. * * * THE SPECIAL COUNSEL’S CHARGING DECISIONS In reaching the charging decisions described in Volume I of the report, the Office determined whether the conduct it found amounted to a violation of federal criminal law chargeable under the Principles of Federal Prosecution. See Justice Manual § 9-27.000 et seq. (2018). The standard set forth in the Justice Manual is whether the conduct constitutes a crime; if so, whether admissible evidence would probably be sufficient to obtain and sustain a conviction; and whether prosecution would serve a substantial federal interest that could not be adequately served by prosecution elsewhere or through non-criminal

alternatives. See Justice Manual § 9-27.220. Section V of the report provides detailed explanations of the Office’s charging decisions, which contain three main components. First, the Office determined that Russia’s two principal interference operations in the 2016 U.S. presidential election—the social media campaign and the hacking-and-dumping operations—violated U.S. criminal law. Many of the individuals and entities involved in the social media campaign have been charged with participating in a conspiracy to defraud the United States by undermining through deceptive acts the work of federal agencies charged with regulating foreign influence in U.S. elections, as well as related counts of identity theft. See United States v. Internet Research Agency, et al., No. 18-cr-32 (D.D.C.). Separately, Russian intelligence officers who carried out the hacking into Democratic Party computers and the personal email accounts of individuals affiliated with the Clinton Campaign conspired to violate, among other federal laws, the federal computer-intrusion statute, and they have been so charged. See United States v. Netyksho, et al., No. 18-cr-215 (D.D.C.). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Personal Privacy█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Second, while the investigation identified numerous links between individuals with ties to the Russian government and individuals associated with the Trump Campaign, the evidence was not sufficient to support criminal charges. Among other things, the evidence was not sufficient to charge any Campaign official as an unregistered agent of the Russian government or other Russian principal. And our evidence about the June 9, 2016 meeting and WikiLeaks’s releases of hacked materials was not sufficient to charge a criminal campaign-finance violation. Further, the evidence was not sufficient to charge that any member of the Trump Campaign conspired with representatives of the Russian government to interfere in the 2016 election. Third, the investigation established that several individuals affiliated with the Trump Campaign lied to the Office, and to Congress, about their interactions with Russian-affiliated individuals and related matters. Those lies materially impaired the investigation of Russian election interference. The Office charged

some of those lies as violations of the federal false-statements statute. Former National Security Advisor Michael Flynn pleaded guilty to lying about his interactions with Russian Ambassador Kislyak during the transition period. George Papadopoulos, a foreign policy advisor during the campaign period, pleaded guilty to lying to investigators about, inter alia, the nature and timing of his interactions with Joseph Mifsud, the professor who told Papadopoulos that the Russians had dirt on candidate Clinton in the form of thousands of emails. Former Trump Organization attorney Michael Cohen pleaded guilty to making false statements to Congress about the Trump Moscow project. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ And in February 2019, the U.S. District Court for the District of Columbia found that Manafort lied to the Office and the grand jury concerning his interactions and communications with Konstantin Kilimnik about Trump Campaign polling data and a peace plan for Ukraine. * * * The Office investigated several other events that have been publicly reported to involve potential Russia-related contacts. For example, the investigation established that interactions between Russian Ambassador Kislyak and Trump Campaign officials both at the candidate’s April 2016 foreign policy speech in Washington, D.C., and during the week of the Republican National Convention were brief, public, and non-substantive. And the investigation did not establish that one Campaign official’s efforts to dilute a portion of the Republican Party platform on providing assistance to Ukraine were undertaken at the behest of candidate Trump or Russia. The investigation also did not establish that a meeting between Kislyak and Sessions in September 2016 at Sessions’s Senate office included any more than a passing mention of the presidential campaign. The investigation did not always yield admissible information or testimony, or a complete picture of the activities undertaken by subjects of the investigation. Some individuals invoked their Fifth Amendment right against compelled self-incrimination and were not, in the Office’s judgment, appropriate candidates for grants of immunity. The Office limited its pursuit of other witnesses and information—such as information known to attorneys or individuals claiming to be members of the media—in light of internal

Department of Justice policies. See, e.g., Justice Manual §§ 9-13.400, 13.410. Some of the information obtained via court process, moreover, was presumptively covered by legal privilege and was screened from investigators by a filter (or “taint”) team. Even when individuals testified or agreed to be interviewed, they sometimes provided information that was false or incomplete, leading to some of the false-statements charges described above. And the Office faced practical limits on its ability to access relevant evidence as well— numerous witnesses and subjects lived abroad, and documents were held outside the United States. Further, the Office learned that some of the individuals we interviewed or whose conduct we investigated—including some associated with the Trump Campaign—deleted relevant communications or communicated during the relevant period using applications that feature encryption or that do not provide for long-term retention of data or communications records. In such cases, the Office was not able to corroborate witness statements through comparison to contemporaneous communications or fully question witnesses about statements that appeared inconsistent with other known facts. Accordingly, while this report embodies factual and legal determinations that the Office believes to be accurate and complete to the greatest extent possible, given these identified gaps, the Office cannot rule out the possibility that the unavailable information would shed additional light on (or cast in a new light) the events described in the report.

I. THE SPECIAL COUNSEL’S INVESTIGATION On May 17, 2017, Deputy Attorney General Rod J. Rosenstein—then serving as Acting Attorney General for the Russia investigation following the recusal of former Attorney General Jeff Sessions on March 2, 2016—appointed the Special Counsel “to investigate Russian interference with the 2016 presidential election and related matters.” Office of the Deputy Att’y Gen., Order No. 3915-2017, Appointment of Special Counsel to Investigate Russian Interference with the 2016 Presidential Election and Related Matters, May 17, 2017) (“Appointment Order”). Relying on “the authority vested” in the Acting Attorney General, “including 28 U.S.C. §§ 509, 510, and 515,” the Acting Attorney General ordered the appointment of a Special Counsel “in order to discharge [the Acting Attorney General’s] responsibility to provide supervision and management of the Department of Justice, and to ensure a full and thorough investigation of the Russian government’s efforts to interfere in the 2016 presidential election.” Appointment Order (introduction). “The Special Counsel,” the Order stated, “is authorized to conduct the investigation confirmed by then-FBI Director James B. Comey in testimony before the House Permanent Select Committee on Intelligence on March 20, 2017,” including: i. any links and/or coordination between the Russian government and individuals associated with the campaign of President Donald Trump; and ii. any matters that arose or may arise directly from the investigation; and iii. any other matters within the scope of 28 C.F.R. § 600.4(a). Appointment Order ¶ (b). Section 600.4 affords the Special Counsel “the authority to investigate and prosecute federal crimes committed in the course of, and with intent to interfere with, the Special Counsel’s investigation, such as perjury, obstruction of justice, destruction of evidence, and intimidation of witnesses.” 28 C.F.R. § 600.4(a). The authority to investigate “any matters that arose . . . directly from the investigation,” Appointment Order ¶ (b)(ii), covers similar crimes that may have occurred during the course of the FBI’s confirmed investigation before the Special Counsel’s appointment. “If the Special Counsel believes it is necessary and appropriate,” the Order further provided, “the Special Counsel is authorized to prosecute federal crimes arising from the investigation of these matters.” Id. ¶ (c). Finally, the Acting Attorney General made applicable “Sections 600.4 through 600.10 of Title 28 of the Code of Federal Regulations.” Id. ¶ (d).

The Acting Attorney General further clarified the scope of the Special Counsel’s investigatory authority in two subsequent memoranda. A memorandum dated August 2, 2017, explained that the Appointment Order had been “worded categorically in order to permit its public release without confirming specific investigations involving specific individuals.” It then confirmed that the Special Counsel had been authorized since his appointment to investigate allegations that three Trump campaign officials—Carter Page, Paul Manafort, and George Papadopoulos—“committed a crime or crimes by colluding with Russian government officials with respect to the Russian government’s efforts to interfere with the 2016 presidential election.” The memorandum also confirmed the Special Counsel’s authority to investigate certain other matters, including two additional sets of allegations involving Manafort (crimes arising from payments he received from the Ukrainian government and crimes arising from his receipt of loans from a bank whose CEO was then seeking a position in the Trump Administration); allegations that Papadopoulos committed a crime or crimes by acting as an unregistered agent of the Israeli government; and four sets of allegations involving Michael Flynn, the former National Security Advisor to President Trump. On October 20, 2017, the Acting Attorney General confirmed in a memorandum the Special Counsel’s investigative authority as to several individuals and entities. First, “as part of a full and thorough investigation of the Russian government’s efforts to interfere in the 2016 presidential election,” the Special Counsel was authorized to investigate “the pertinent activities of Michael Cohen, Richard Gates, Personal Privacy█ █ █, Roger Stone, and PP█ █ █ █ █ █ █ █ █” “Confirmation of the authorization to investigate such individuals,” the memorandum stressed, “does not suggest that the Special Counsel has made a determination that any of them has committed a crime.” Second, with respect to Michael Cohen, the memorandum recognized the Special Counsel’s authority to investigate “leads relate[d] to Cohen’s establishment and use of Essential Consultants LLC to, inter alia, receive funds from Russian-backed entities.” Third, the memorandum memorialized the Special Counsel’s authority to investigate individuals and entities who were possibly engaged in “jointly undertaken activity” with existing subjects of the investigation, including Paul Manafort. Finally, the memorandum described an FBI investigation opened before the Special Counsel’s appointment into “allegations that [then-Attorney General Jeff Sessions] made false statements to the United States Senate[,]” and confirmed the Special Counsel’s authority to investigate that matter.

The Special Counsel structured the investigation in view of his power and authority “to exercise all investigative and prosecutorial functions of any United States Attorney.” 28 C.F.R. § 600.6. Like a U.S. Attorney’s Office, the Special Counsel’s Office considered a range of classified and unclassified information available to the FBI in the course of the Office’s Russia investigation, and the Office structured that work around evidence for possible use in prosecutions of federal crimes (assuming that one or more crimes were identified that warranted prosecution). There was substantial evidence immediately available to the Special Counsel at the inception of the investigation in May 2017 because the FBI had, by that time, already investigated Russian election interference for nearly 10 months. The Special Counsel’s Office exercised its judgment regarding what to investigate and did not, for instance, investigate every public report of a contact between the Trump Campaign and Russian-affiliated individuals and entities. The Office has concluded its investigation into links and coordination between the Russian government and individuals associated with the Trump Campaign. Certain proceedings associated with the Office’s work remain ongoing. After consultation with the Office of the Deputy Attorney General, the Office has transferred responsibility for those remaining issues to other components of the Department of Justice and FBI. Appendix D lists those transfers. Two district courts confirmed the breadth of the Special Counsel’s authority to investigate Russia election interference and links and/or coordination with the Trump Campaign. See United States v. Manafort, 312 F. Supp. 3d 60, 79-83 (D.D.C. 2018); United States v. Manafort, 321 F. Supp. 3d 640, 650-655 (E.D. Va. 2018). In the course of conducting that investigation, the Office periodically identified evidence of potential criminal activity that was outside the scope of the Special Counsel’s authority established by the Acting Attorney General. After consultation with the Office of the Deputy Attorney General, the Office referred that evidence to appropriate law enforcement authorities, principally other components of the Department of Justice and to the FBI. Appendix D summarizes those referrals. * * * To carry out the investigation and prosecution of the matters assigned to

him, the Special Counsel assembled a team that at its high point included 19 attorneys—five of whom joined the Office from private practice and 14 on detail or assigned from other Department of Justice components. These attorneys were assisted by a filter team of Department lawyers and FBI personnel who screened materials obtained via court process for privileged information before turning those materials over to investigators; a support staff of three paralegals on detail from the Department’s Antitrust Division; and an administrative staff of nine responsible for budget, finance, purchasing, human resources, records, facilities, security, information technology, and administrative support. The Special Counsel attorneys and support staff were co-located with and worked alongside approximately 40 FBI agents, intelligence analysts, forensic accountants, a paralegal, and professional staff assigned by the FBI to assist the Special Counsel’s investigation. Those “assigned” FBI employees remained under FBI supervision at all times; the matters on which they assisted were supervised by 1 the Special Counsel. During its investigation the Office issued more than 2,800 subpoenas under the auspices of a grand jury sitting in the District of Columbia; executed nearly 500 search-and-seizure warrants; obtained more than 230 orders for communications records under 18 U.S.C. § 2703(d); obtained almost 50 orders authorizing use of pen registers; made 13 requests to foreign governments pursuant to Mutual Legal Assistance Treaties; and interviewed approximately 500 witnesses, including almost 80 before a grand jury. * * * From its inception, the Office recognized that its investigation could identify foreign intelligence and counterintelligence information relevant to the FBI’s broader national security mission. FBI personnel who assisted the Office established procedures to identify and convey such information to the FBI. The FBI’s Counterintelligence Division met with the Office regularly for that purpose for most of the Office’s tenure. For more than the past year, the FBI also embedded personnel at the Office who did not work on the Special Counsel’s investigation, but whose purpose was to review the results of the investigation and to send—in writing—summaries of foreign intelligence and counterintelligence information to FBIHQ and FBI Field Offices. Those communications and other correspondence between the Office and the FBI contain information derived from the investigation, not all of which is contained

in this Volume. This Volume is a summary. It contains, in the Office’s judgment, that information necessary to account for the Special Counsel’s prosecution and declination decisions and to describe the investigation’s main factual results. 1 FBI personnel assigned to the Special Counsel’s Office were required to adhere to all applicable federal law and all Department and FBI regulations, guidelines, and policies. An FBI attorney worked on FBI-related matters for the Office, such as FBI compliance with all FBI policies and procedures, including the FBI’s Domestic Investigations and Operations Guide (DIOG). That FBI attorney worked under FBI legal supervision, not the Special Counsel’s supervision.

II. RUSSIAN “ACTIVE MEASURES” SOCIAL MEDIA CAMPAIGN The first form of Russian election influence came principally from the Internet Research Agency, LLC (IRA), a Russian organization funded by Yevgeniy Viktorovich Prigozhin and companies he controlled, including Concord Management and Consulting LLC and Concord Catering (collectively 2 “Concord”). The IRA conducted social media operations targeted at large U.S. 3 audiences with the goal of sowing discord in the U.S. political system. These operations constituted “active measures” a term that typically refers to operations conducted by Russian security services aimed 4 at influencing the course of international affairs. The IRA and its employees began operations targeting the United States as early as 2014. Using fictitious U.S. personas, IRA employees operated social media accounts and group pages designed to attract U.S. audiences. These groups and accounts, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists. Over time, these social media accounts became a means to reach large U.S. audiences. IRA employees travelled to the United States in mid-2014 on an intelligence-gathering mission to obtain information and photographs for use in their social media posts. IRA employees posted derogatory information about a number of candidates in the 2016 U.S. presidential election. By early to mid-2016, IRA operations included supporting the Trump Campaign and disparaging candidate Hillary Clinton. The IRA made various expenditures to carry out those activities, including buying political advertisements on social media in the names of U.S. persons and entities. Some IRA employees, posing as U.S. persons and without revealing their Russian association, communicated electronically with individuals associated with the Trump Campaign and with other political activists to seek to coordinate political activities, including the staging of 5 political rallies. The investigation did not identify evidence that any U.S. persons knowingly or intentionally coordinated with the IRA’s interference operation. By the end of the 2016 U.S. election, the IRA had the ability to reach

millions of U.S. persons through their social media accounts. Multiple IRA- controlled Facebook groups and Instagram accounts had hundreds of thousands of U.S. participants. IRA-controlled Twitter accounts separately had tens of thousands of followers, including multiple U.S. political figures who retweeted IRA-created content. In November 2017, a Facebook representative testified that Facebook had identified 470 IRA-controlled Facebook accounts that collectively made 80,000 posts between January 2015 and August 2017. Facebook estimated the IRA reached as many as 126 million persons through its Facebook 6 accounts. In January 2018, Twitter announced that it had identified 3,814 IRA- controlled Twitter accounts and notified approximately 1.4 million people 7 Twitter believed may have been in contact with an IRA-controlled account. A. Structure of the Internet Research Agency Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 8 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing 9 Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 10 █ █ █ █ █ █ The organization quickly grew. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 11 █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 12 █ █ █ █ The growth of the organization also led to a more detailed organizational structure. █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 13 █ █ █ █ █ █ █ Two individuals headed the IRA’s management: its general director, Mikhail Bystrov, and its executive director, Mikhail Burchik. Harm to Ongoing 14 Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to 15 Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

As early as the spring of 2014, the IRA began to hide its funding and activities. █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 16 █ █ █ █ █ █ █ The IRA’s U.S. operation are part of a larger set of interlocking operations known as “Project Lakhta,” Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 17 █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ 18 █ B. Funding and Oversight from Concord and Prigozhin Until at least February 2018, Yevgeniy Viktorovich Prigozhin and two Concord companies funded the IRA. Prigozhin is a wealthy Russian businessman who served as the head of Concord. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Prigozhin was sanctioned by the U.S. Treasury Department 19 20 in December 2016, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 21 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Numerous media sources have reported on Prigozhin’s ties to Putin, and the two have appeared 22 together in public photographs. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ ██ █ █ 23 █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 24 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 25 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 26 █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

27 █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 28 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ IRA employees were aware that Prigozhin was involved in the IRA’s U.S. operations, █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 29 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 30 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ In May 2016, IRA employees, claiming to be U.S. social activists and administrators of Facebook groups, recruited U.S. persons to hold signs (including one in front of the White House) that read “Happy 55th Birthday Dear Boss,” as an homage to 31 Prigozhin (whose 55th birthday was on June 1, 2016). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 32 █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ C. The IRA Targets U.S. Elections 1. The IRA Ramps Up U.S. Operations As Early As 2014 The IRA’s U.S. operations sought to influence public opinion through online media and forums. By the spring of 2014, the IRA began to consolidate U.S. operations within a single general department, known internally as the “Translator” department. █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ IRA subdivided the Translator Department into different responsibilities, ranging from operations on different social media platforms to analytics to graphics and IT. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 33 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 34 █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 35 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 36 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 37 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ IRA employees also traveled to the United States on intelligence-gathering missions. In June 2014, four IRA employees applied to the U.S. Department of State to enter the United States, while lying about the purpose of their trip and 38 claiming to be four friends who had met at a party. Ultimately, two IRA employees—Anna Bogacheva and Aleksandra Krylova—received visas and entered the United States on June 4, 2014. Prior traveling, Krylova and Bogacheva compiled itineraries and instructions for the trip. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 39 █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

40 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 41 █ █ █ █ █ █ █ █ █ █ █ █ █ 2. U.S. Operations Through IRA-Controlled Social Media Accounts Dozens of IRA employees were responsible for operating accounts and personas on different U.S. social media platforms. The IRA referred to 42 employees assigned to operate the social media accounts as “specialists.” Starting as early as 2014, the IRA’s U.S. operations included social media 43 specialists focusing on Facebook, YouTube, and Twitter. The IRA later added 44 specialists who operated on Tumblr and Instagram accounts. Initially, the IRA created social media accounts that pretended to be the 45 personal accounts of U.S. persons. By early 2015, the IRA began to create larger social media groups or public social media pages that claimed (falsely) to be affiliated with U.S. political and grassroots organizations. In certain cases, the IRA created accounts that mimicked real U.S. organizations. For example, one IRA-controlled Twitter account, @TEN_GOP, purported to be connected to the 46 Tennessee Republican Party. More commonly, the IRA created accounts in the names of fictitious U.S. organizations and grassroots groups and used these accounts to pose as anti-immigration groups, Tea Party activists, Black Lives Matter protestors, and other U.S. social and political activists. The IRA closely monitored the activity of its social media accounts. █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 47 █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 48 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ By February 2016, internal IRA documents referred to support for the 49 Trump Campaign and opposition to candidate Clinton. For example, HOM█ █ █ █ █ █ █ █ directions to IRA operators Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ “Main idea: Use any opportunity to criticize Hillary [Clinton] and 50 the rest (except Sanders and Trump - we support them).” Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The focus on the U.S. presidential campaign continued throughout 2016. In HOM█ █ █ 2016 internal HOM█ █ █ reviewing the IRA-controlled Facebook group “Secured Borders,” the author criticized the “lower number of posts dedicated to criticizing Hillary Clinton” and reminded the Facebook specialist “it 51 is imperative to intensify criticizing Hillary Clinton.” IRA employees also acknowledged that their work focused on influencing the U.S. presidential election. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 52 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. 3. U.S. Operations Through Facebook Many IRA operations used Facebook accounts created and operated by its specialists. █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 53 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 54 █ █ █ █ █ █ █ █ IRA Facebook groups active during the 2016 campaign covered a range of political issues and included purported conservative groups (with names such as “Being Patriotic,” “Stop All Immigrants,” “Secured Borders,” and “Tea Party News”), purported Black social justice groups (“Black Matters,” “Blacktivist,” and “Don’t Shoot Us”), LGBTQ groups (“LGBT United”), and religious groups (“United Muslims of America”). Throughout 2016, IRA accounts published an increasing number of materials supporting the Trump Campaign and opposing the Clinton Campaign. For example, on May 31, 2016, the operational account “Matt Skiber” began to privately message dozens of pro-Trump Facebook groups asking them to help 55 plan a “pro-Trump rally near Trump Tower.” To reach larger U.S. audiences, the IRA purchased advertisements from Facebook that promoted the IRA groups on the newsfeeds of U.S. audience members. According to Facebook, the IRA purchased over 3,500 56 advertisements, and the expenditures totaled approximately $100,000. During the U.S. presidential campaign, many IRA-purchased advertisements explicitly supported or opposed a presidential candidate or promoted U.S. rallies organized by the IRA (discussed below). As early as March 2016, the IRA purchased advertisements that overtly opposed the Clinton Campaign. For example, on March 18, 2016, the IRA purchased an advertisement depicting candidate Clinton and a caption that read in part, “If one day God lets this liar enter the White House as a president – that day would be a real national 57 tragedy.” Similarly, on April 6, 2016, the IRA purchased advertisements for its account “Black Matters” calling for a “flashmob” of U.S. persons to “take a 58 photo with #HillaryClintonForPrison2016 or #nohillary2016.” IRA-purchased

59 advertisements featuring Clinton were, with very few exceptions, negative. IRA-purchased advertisements referencing candidate Trump largely supported his campaign. The first known IRA advertisement explicitly endorsing the Trump Campaign was purchased on April 19, 2016. The IRA bought an advertisement for its Instagram account “Tea Party News” asking U.S. persons to help them “make a patriotic team of young Trump supporters” by uploading 60 photos with the hashtag “#KIDS4TRUMP.” In subsequent months, the IRA purchased dozens of advertisements supporting the Trump Campaign, predominantly through the Facebook groups “Being Patriotic,” “Stop All Invaders,” and “Secured Borders.” Collectively, the IRA’s social media accounts reached tens of millions of U.S. persons. Individual IRA social media accounts attracted hundreds of thousands of followers. For example, at the time they were deactivated by Facebook in mid-2017, the IRA’s “United Muslims of America” Facebook group had over 300,000 followers, the “Don’t Shoot Us” Facebook group had over 250,000 followers, the “Being Patriotic” Facebook group had over 200,000 followers, and the “Secured Borders” Facebook group had over 130,000 61 followers. According to Facebook, in total the IRA-controlled accounts made over 80,000 posts before their deactivation in August 2017, and these posts reached at least 29 million U.S persons and “may have reached an estimated 126 62 million people.” 4. U.S. Operations Through Twitter A number of IRA employees assigned to the Translator Department served as Twitter specialists. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ 63 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The IRA’s Twitter operations involved two strategies. First, IRA specialists operated certain Twitter accounts to create individual U.S. personas, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 64 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Separately, the IRA operated a network of automated Twitter accounts (commonly referred to as a bot network) that enabled the IRA to amplify existing content on Twitter.

a. Individualized Accounts Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 65 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 66 █ █ █ █ █ █ █ █ █ █ █ █ █ The IRA operated individualized Twitter accounts similar to the operation of its Facebook accounts, by continuously posting original content to the accounts while also communicating with U.S. Twitter users directly (through public tweeting or Twitter’s private messaging). The IRA used many of these accounts to attempt to influence U.S. audiences on the election. Individualized accounts used to influence the U.S. presidential election included @TEN_GOP (described above); @jenn_abrams (claiming to be a Virginian Trump supporter with 70,000 followers); @Pamela_Moore13 (claiming to be a Texan Trump supporter with 70,000 followers); and 67 @America_lst_ (an anti-immigration persona with 24,000 followers). In May 2016, the IRA created the Twitter account @march_for_trump, which promoted 68 IRA-organized rallies in support of the Trump Campaign (described below). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 69 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Using these accounts and others, the IRA provoked reactions from users and the 70 media. Multiple IRA-posted tweets gained popularity. U.S. media outlets also quoted tweets from IRA-controlled accounts and attributed them to the reactions

71 of real U.S. persons. Similarly, numerous high-profile U.S. persons, including 72 73 74 former Ambassador Michael McFaul, Roger Stone, Sean Hannity, and 75 Michael Flynn Jr., retweeted or responded to tweets posted to these IRA- controlled accounts. Multiple individuals affiliated with the Trump Campaign also promoted IRA tweets (discussed below). b. IRA Botnet Activities Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 76 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 77 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 78 █ █ In January 2018, Twitter publicly identified 3,814 Twitter accounts 79 associated with the IRA. According to Twitter, in the ten weeks before the 2016 U.S. presidential election, these accounts posted approximately 175,993 80 tweets, “approximately 8.4% of which were election-related.” Twitter also announced that it had notified approximately 1.4 million people who Twitter 81 believed may have been in contact with an IRA-controlled account. 5. U.S. Operations Involving Political Rallies

The IRA organized and promoted political rallies inside the United States while posing as U.S. grassroots activists. First, the IRA used one of its preexisting social media personas (Facebook groups and Twitter accounts, for example) to announce and promote the event. The IRA then sent a large number of direct messages to followers of its social media account asking them to attend the event. From those who responded with interest in attending, the IRA then sought a U.S. person to serve as the event’s coordinator. In most cases, the IRA account operator would tell the U.S. person that they personally could not attend the event due to some preexisting conflict or because they were somewhere else 82 in the United States. The IRA then further promoted the event by contacting 83 U.S. media about the event and directing them to speak with the coordinator. After the event, the IRA posted videos and photographs of the event to the IRA’s 84 social media accounts. The Office identified dozens of U.S. rallies organized by the IRA. The 85 earliest evidence of a rally was a “confederate rally” in November 2015. The IRA continued to organize rallies even after the 2016 U.S. presidential election. The attendance at rallies varied. Some rallies appear to have drawn few (if any) participants, while others drew hundreds. The reach and success of these rallies was closely monitored Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

IRA Poster for Pennsylvania Rallies organized by the IRA The From June 2016 until the end of the presidential campaign, almost all of the top U.S. rallies organized by the IRA focused on the U.S. election, often promoting section of the Trump Campaign and opposing the Clinton Campaign. Pro-Trump rallies the included three in New York; a series of pro-Trump rallies in Florida in August poster 2016; and a series of pro-Trump rallies in October 2016 in Pennsylvania. The displays Florida rallies drew the attention of the Trump Campaign, which posted about a photograph 86 the Miami rally on candidate Trump’s Facebook account (as discussed below). of a Mmianney of the same IRA employees who oversaw the IRA’s social media worker accounts also conducted the day-to-day recruiting for political rallies inside the followed United States. █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ by █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ text that 87 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ reads, Miners for 6. Targeting and Recruitment of U.S. Persons Trump. Bring As early as 2014, the IRA instructed its employees to target U.S. persons back

who could be used to advance its operational goals. Initially, recruitment focused on U.S. persons who could amplify the content posted by the IRA. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 88 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. IRA employees frequently used Investigative Technique█ █ █ █ Twitter, Facebook, and Instagram to contact and recruit U.S. persons who followed the group. The IRA recruited U.S. persons from across the political spectrum. For example, the IRA targeted the family of █ █ █Personal Privacy█ █ █ █ █ █ █ █ █ █ █ █ and a number of black social justice activists while posing as a 89 grassroots group called “Black Matters US.” In February 2017, the persona “Black Fist” (purporting to want to teach African-Americans to protect themselves when contacted by law enforcement) hired a self-defense instructor in New York to offer classes sponsored by Black Fist. The IRA also recruited moderators of conservative social media groups to promote IRA-generated 90 content, as well as recruited individuals to perform political acts (such as walking around New York City dressed up as Santa Claus with a Trump 91 mask). Harm to Ongoing Matter █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 92 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 93 █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 94 █ █ HOM█ █ █ █ █ as the IRA’s online audience became larger, the IRA tracked U.S. persons with whom they communicated and had successfully tasked (with tasks ranging from organizing rallies to taking pictures with certain

political messages). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 95 █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 7. Interactions and Contacts with the Trump Campaign The investigation identified two different forms of connections between the IRA and members of the Trump Campaign. (The investigation identified no similar connections between the IRA and the Clinton Campaign.) First, on multiple occasions, members and surrogates of the Trump Campaign promoted —typically by linking, retweeting, or similar methods of reposting—pro-Trump or anti-Clinton content published by the IRA through IRA-controlled social media accounts. Additionally, in a few instances, IRA employees represented themselves as U.S. persons to communicate with members of the Trump Campaign in an effort to seek assistance and coordination on IRA-organized political rallies inside the United States. a. Trump Campaign Promotion of IRA Political Materials Among the U.S. “leaders of public opinion” targeted by the IRA were various members and surrogates of the Trump Campaign. In total, Trump Campaign affiliates promoted dozens of tweets, posts, and other political content created by the IRA. - Posts from the IRA-controlled Twitter account @TEN_GOP were cited or retweeted by multiple Trump

Campaign officials and surrogates, including Donald J. 96 97 98 Trump Jr., Eric Trump, Kellyanne Conway, Brad 99 100 Parscale, and Michael T. Flynn. These posts 101 included allegations of voter fraud, as well as allegations that Secretary Clinton had mishandled 102 classified information. - A November 7, 2016 post from the IRA-controlled Twitter account @Pamela_Moore13 was retweeted by 103 Donald J. Trump Jr. - On September 19, 2017, President Trump’s personal account @realDonaldTrump responded to a tweet from the IRA-controlled account @10_gop (the backup account of @TEN_GOP, which had already been deactivated by Twitter). The tweet read: “We love you, 104 Mr. President!”

Screenshot of Trump Facebook Account (from Matt Skiber) The IRA employees monitored the reaction of the Trump Campaign and, later, post Trump Administration officials to their tweets. For example, on August 23, says Thank 2016, the IRA-controlled persona “Matt Skiber” Facebook account sent a you message to a U.S. Tea Party activist, writing that “Mr. Trump posted about our for 105 your event in Miami! This is great!” The IRA employee included a screenshot of support candidate Trump’s Facebook account, which included a post about the August Miami! 20, 2016 political rallies organized by the IRA. My team Hjuastrm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ shared █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ photos █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ from █ █ █yo u█r █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Trump 106 █ █ █ █ █ █ █ █ █ sign waving day, b. Contact with Trump Campaign Officials in Connection to Rallies

Starting in June 2016, the IRA contacted different U.S. persons affiliated with the Trump Campaign in an effort to coordinate pro-Trump IRA-organized rallies inside the United States. In all cases, the IRA contacted the Campaign while claiming to be U.S. political activists working on behalf of a conservative grassroots organization. The IRA’s contacts included requests for signs and other 107 materials to use at rallies, as well as requests to promote the rallies and help 108 coordinate logistics. While certain campaign volunteers agreed to provide the requested support (for example, agreeing to set aside a number of signs), the investigation has not identified evidence that any Trump Campaign official understood the requests were coming from foreign nationals. * * * In sum, the investigation established that Russia interfered in the 2016 presidential election through the “active measures” social media campaign carried out by the IRA, an organization funded by Prigozhin and companies that he controlled. As explained further in Volume I, Section V.A, infra, the Office concluded (and a grand jury has alleged) that Prigozhin, his companies, and IRA employees violated U.S. law through these operations, principally by undermining through deceptive acts the work of federal agencies charged with regulating foreign influence in U.S. elections. 2 The Office is aware of reports that other Russian entities engaged in similar active measures operations targeting the United States. Some evidence collected by the Office corroborates those reports, and the Office has shared that evidence with other offices in the Department of Justice and FBI. 3 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ see also SM-2230634, serial 44 (analysis). The FBI case number cited here, and other FBI case numbers identified in the report, should be treated as law enforcement sensitive given the context. The report contains additional law enforcement sensitive information. 4 As discussed in Part V below, the active measures investigation has resulted in criminal charges against 13 individual Russian nationals and three Russian entities, principally for conspiracy to defraud the United States, in violation of 18 U.S.C. § 371. See Volume I, Section V.A, infra; Indictment, United States v. Internet Research Agency, et al., l:18-cr-32 (D.D.C. Feb. 16, 2018), Doc. 1 (“Internet Research Agency Indictment”). 5 Internet Research Agency Indictment ¶¶ 52, 54, 55(a), 56, 74; Harm to Ongoing Matter█ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 6 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook) (“We estimate that roughly 29 million people were served content in their News Feeds directly from the IRA’s 80,000 posts over the two years. Posts from these Pages were also shared, liked, and followed by people on Facebook, and, as a result, three times more people may have been exposed to a story that originated from the Russian operation. Our best estimate is that approximately 126 million people may have been served content from a Page associated with the IRA at some point during the two-year period.”). The Facebook representative also testified that Facebook had identified 170 Instagram accounts that posted approximately 120,000 pieces of content during that time. Facebook did not offer an estimate of the audience reached via Instagram. 7 Twitter, Update on Twitter’s Review of the 2016 US Election (Jan. 31, 2018). 8 See SM-2230634, serial 92. 9 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 10 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 11 See SM-2230634, serial 86 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 12 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 13 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 14 See, e.g., SM-2230634, serials 9, 113 & 180 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 15 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 16 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ See SM-2230634, serials 131 & 204. 17 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 18 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 19 U.S. Treasury Department, “Treasury Sanctions Individuals and Entities in Connection with Russia’s Occupation of Crimea and the Conflict in Ukraine” (Dec. 20, 2016).

20 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 21 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 22 See, e.g., Neil MacFarquhar, Yevgeny Prigozhin, Russian Oligarch Indicted by U.S., Is Known as “Putin’s Cook”, New York Times (Feb. 16, 2018). 23 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 24 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 25 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ see also SM-2230634, serial 113 HOM█ █ █ █ 26 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 27 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 28 The term “troll” refers to internet users—in this context, paid operatives—who post inflammatory or otherwise disruptive content on social media or other websites. 29 Investigative Technique █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ See SM-2230634, serials 131 & 204. 30 See SM-2230634, serial 156. 31 Internet Research Agency Indictment ¶ 12(b); see also 5/26/16 Facebook Messages, ID 1479936895656747 (United Muslims of America) & Personal Privacy█ █ █ █ █ █ 32 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ see also SM-2230634, serial 189. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. 33 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ See SM-2230634, serial 205. 34 See SM-2230634, serial 204 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ 35 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 36 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

37 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 38 See SM-2230634, serials 150 & 172 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. 39 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 40 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 41 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 42 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 43 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. 44 See, e.g., SM-2230634, serial 179 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 45 See, e.g., Facebook ID 100011390466802 (Alex Anderson); Facebook ID 100009626173204 (Andrea Hansen); Facebook ID 100009728618427 (Gary Williams); Facebook ID 100013640043337 (Lakisha Richardson). 46 The account claimed to be the “Unofficial Twitter of Tennessee Republicans” and made posts that appeared to be endorsements of the state political party. See, e.g., @TEN_GOP, 4/3/16 Tweet (“Tennessee GOP backs @realDonaldTrump period #makeAmericagreatagain #tngop #tennessee #gop”). 47 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 48 See, e.g., SM-2230634 serial 131 HOM█ █ █ █. 49 The IRA posted content about the Clinton candidacy before Clinton officially announced her presidential campaign. IRA-controlled social media accounts criticized Clinton’s record as Secretary of State and promoted various critiques of her candidacy. The IRA also used other techniques. █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ See SM-2230634, serial 70. 50 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 51 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

52 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 53 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 54 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 55 5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP█ █ █ █ █ █ 5/31/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID Personal Privacy█ █ █ █ █ █ 56 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook). 57 3/18/16 Facebook Advertisement ID 6045505152575. 58 4/6/16 Facebook Advertisement ID 6043740225319. 59 See SM-2230634, serial 213 (documenting politically-oriented advertisements from the larger set provided by Facebook). 60 4/19/16 Facebook Advertisement ID 6045151094235. 61 See Facebook ID 1479936895656747 (United Muslims of America); Facebook ID 1157233400960126 (Don’t Shoot); Facebook ID 1601685693432389 (Being Patriotic); Facebook ID 757183957716200 (Secured Borders). Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 62 Social Media Influence in the 2016 U.S. Election, Hearing Before the Senate Select Committee on Intelligence, 115th Cong. 13 (11/1/17) (testimony of Colin Stretch, General Counsel of Facebook). 63 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 64 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 65 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 66 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 67 Other individualized accounts included @MissouriNewsUS (an account with 3,800 followers that posted pro-Sanders and anti-Clinton material). 68 See @march_for_trump, 5/30/16 Tweet (first post from account). 69 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

█ 70 For example, one IRA account tweeted, “To those people, who hate the Confederate flag. Did you know that the flag and the war wasn’t about slavery, it was all about money.” The tweet received over 40,000 responses. @Jenn_Abrams 4/24/17 (2:37 p.m.) Tweet. 71 Josephine Lukito & Chris Wells, Most Major Outlets Have Used Russian Tweets as Sources for Partisan Opinion: Study, Columbia Journalism Review (Mar. 8, 2018); see also Twitter Steps Up to Explain #NewYorkValues to Ted Cruz, Washington Post (Jan. 15, 2016) (citing IRA tweet); People Are Slamming the CIA for Claiming Russia Tried to Help Donald Trump, U.S. News & World Report (Dec. 12, 2016). 72 @McFaul 4/30/16 Tweet (responding to tweet by @Jenn_Abrams). 73 @RogerJStoneJr 5/30/16 Tweet (retweeting @Pamela_Moore13); a@RogerJStoneJr 4/26/16 Tweet (same). 74 @seanhannity 6/21/17 Tweet (retweeting @Pamela_Moore13). 75 @mflynnJR 6/22/17 Tweet (“RT @Jenn_Abrams: This is what happens when you add the voice over of an old documentary about mental illness onto video of SJWs. . .”). 76 A botnet refers to a network of private computers or accounts controlled as a group to send specific automated messages (IAEN). On the Twitter network, botnets can be used to promote and republish (“retweet”) specific tweets or hashtags in order for them to gain larger audiences. 77 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 78 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 79 Eli Rosenberg, Twitter to Tell 677,000 Users they Were Had by the Russians. Some Signs Show the Problem Continues, Washington Post (Jan. 19, 2019). 80 Twitter, “Update on Twitter’s Review of the 2016 US Election” (updated Jan. 31, 2018). Twitter also reported identifying 50,258 automated accounts connected to the Russian government, which tweeted more than a million times in the ten weeks before the election. 81 Twitter, “Update on Twitter’s Review of the 2016 US Election” (updated Jan. 31, 2018). 82 8/20/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP█ █ █ █ █ █. 83 See, e.g., 7/21/16 Email, [email protected] to PP█ █ █ █ █ █; 7/21/16 Email, [email protected] to Personal Privacy█ █ █ █ █ █ 84 @march_for_trump 6/25/16 Tweet (posting photos from rally outside Trump Tower). 85 Instagram ID 2228012168 (Stand For Freedom) 11/3/15 Post (“Good evening buds! Well I am planning to organize a confederate rally [. . .] in Houston on the 14 of November and I want more people to attend.”).

86 The pro-Trump rallies were organized through multiple Facebook, Twitter, and email accounts (IAEN). See, e.g., Facebook ID 100009922908461 (Matt Skiber); Facebook ID 1601685693432389 (Being Patriotic); Twitter Account @march_for_trump; [email protected]. (Rallies were organized in New York on June 25, 2016; Florida on August 20, 2016; and Pennsylvania on October 2, 2016.) 87 Harm to Ongoing Matter█ █ █ █ █ █ █ █ 88 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 89 3/11/16 Facebook Advertisement ID 6045078289928, 5/6/16 Facebook Advertisement ID 6051652423528, 10/26/16 Facebook Advertisement ID 6055238604687; 10/27/16 Facebook Message, ID Personal Privacy█ █ █ & ID 100011698576461 (Taylor Brooks). 90 8/19/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 91 12/8/16 Email, [email protected] to [email protected] (confirming Craigslist advertisement). 92 8/18-19/16 Twitter DMs, @march_for_trump & PP█ █ █ █ █ █ █ █ █ █ █ 93 See, e.g., 11/11-27/16 Facebook Messages, ID 100011698576461 (Taylor Brooks) & IDPersonal Privacy█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ (arranging to pay for plane tickets and for a bull horn). 94 See, e.g., 9/10/16 Facebook Message, ID 100009922908461 (Matt Skiber) & IDPersonal Privacy█ █ █ (discussing payment for rally supplies); 8/18/16 Twitter DM, @march_for_trump to PP█ █ █ (discussing payment for construction materials). 95 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 96 See, e.g., @DonaldJTrumpJr 10/26/16 Tweet (“RT @TEN_GOP: BREAKING Thousands of names changed on voter rolls in Indiana. Police investigating #Voterfraud. #DrainTheSwamp.”); @DonaldJTrumpJr 11/2/16 Tweet (“RT @TEN_GOP: BREAKING: #VoterFraud by counting tens of thousands of ineligible mail in Hillary votes being reported in Broward County, Florida.”); @DonaldJTrumpJr 11/8/16 Tweet (“RT @TEN_GOP: This vet passed away last month before he could vote for Trump. Here he is in his #MAGA hat. #voted #ElectionDay.”). Trump Jr. retweeted additional @TEN_GOP content subsequent to the election. 97 @EricTrump 10/20/16 Tweet (“RT @TEN_GOP: BREAKING Hillary shuts down press conference when asked about DNC Operatives corruption & #VoterFraud #debatenight #TrumpB”). 98 @KellyannePolls 11/6/16 Tweet (“RT @TEN_GOP: Mother of jailed sailor: ‘Hold Hillary to same standards as my son on Classified info’ #hillarysemail #WeinerGate.”). 99 @parscale 10/15/16 Tweet (“Thousands of deplorables chanting to the media: ‘Tell The Truth!’ RT if you are also done w/ biased Media! #Friday Feeling”).

100 @GenFlynn 11/7/16 (retweeting @TEN_GOP post that included in part “@realDonaldTrump & @mike_pence will be our next POTUS & VPOTUS.”). 101 @TEN_GOP 10/11/16 Tweet (“North Carolina finds 2,214 voters over the age of 110!!”). 102 @TEN_GOP (IAEN) 11/6/16 Tweet (“Mother of jailed sailor: ‘Hold Hillary to same standards as my son on classified info #hillaryemail #WeinerGate.’”). 103 @DonaldJTrumpJr 11/7/16 Tweet (“RT @Pamela_Moore13: Detroit residents speak out against the failed policies of Obama, Hillary & democrats . . . . ”). 104 @realDonaldTrump 9/19/17 (7:33 p.m.) Tweet (“THANK YOU for your support Miami! My team just shared photos from your TRUMP SIGN WAVING DAY, yesterday! I love you – and there is no question – TOGETHER, WE WILL MAKE AMERICA GREAT AGAIN!”). 105 8/23/16 Facebook Message, ID 100009922908461 (Matt Skiber) to ID PP█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 106 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 107 See, e.g., 8/16/16 Email, [email protected] to PP█ █ █ @donaldtrump.com (asking for Trump/Pence signs for Florida rally); 8/18/16 Email, [email protected] to PP█ █ █ @donaldtrump.com (asking for Trump/Pence signs for Florida rally); 8/12/16 Email, [email protected] to PP█ █ █ @donaldtrump.com (asking for “contact phone numbers for Trump Campaign affiliates” in various Florida cities and signs). 108 8/15/16 Email, Personal Privacy█ █ █ to [email protected] (asking to add to locations to the “Florida Goes Trump,” list); 8/16/16 Email, Personal Privacy█ █ █ to [email protected] (volunteering to send an email blast to followers).

III. RUSSIAN HACKING AND DUMPING OPERATIONS Beginning in March 2016, units of the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU) hacked the computers and email accounts of organizations, employees, and volunteers supporting the Clinton Campaign, including the email account of campaign chairman John Podesta. Starting in April 2016, the GRU hacked into the computer networks of the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC). The GRU targeted hundreds of email accounts used by Clinton Campaign employees, advisors, and volunteers. In total, the GRU stole hundreds of thousands of documents from the compromised 109 email accounts and networks. The GRU later released stolen Clinton Campaign and DNC documents through online personas, “DCLeaks” and “Guccifer 2.0,” and later through the organization WikiLeaks. The release of the documents was designed and timed to interfere with the 2016 U.S. presidential election and undermine the Clinton Campaign. The Trump Campaign showed interest in the Wikileaks releases and, in the summer and fall of 2016, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ After HOM█ █ █WikiLeaks’s first Clinton-related release HOM█ █ █, the Trump Campaign stayed in contact HOM█ █ █about WikiLeaks’s activities. The investigation was unable to resolve Harm to Ongoing Matter█ █ █ █ █ █ █ WikiLeaks’s release of the stolen Podesta emails on October 7, 2016, the same day a video from years earlier was published of Trump using graphic language about women. A. GRU Hacking Directed at the Clinton Campaign 1. GRU Units Target the Clinton Campaign Two military units of the GRU carried out the computer intrusions into the 110 Clinton Campaign, DNC, and DCCC: Military Units 26165 and 74455. Military Unit 26165 is a GRU cyber unit dedicated to targeting military, political, governmental, and non-governmental organizations outside of Russia, 111 including in the United States. The unit was sub-divided into departments

with different specialties. One department, for example, developed specialized malicious software (“malware”), while another department conducted large-scale 112 spearphishing campaigns. Investigative Technique█ █ █ a bitcoin mining operation to secure bitcoins used to purchase computer infrastructure used in 113 hacking operations. Military Unit 74455 is a related GRU unit with multiple departments that engaged in cyber operations. Unit 74455 assisted in the release of documents stolen by Unit 26165, the promotion of those releases, and the publication of anti-Clinton content on social media accounts operated by the GRU. Officers from Unit 74455 separately hacked computers belonging to state boards of elections, secretaries of state, and U.S. companies that supplied software and 114 other technology related to the administration of U.S. elections. Beginning in mid-March 2016, Unit 26165 had primary responsibility for hacking the DCCC and DNC, as well as email accounts of individuals affiliated 115 with the Clinton Campaign: - Unit 26165 used IT█ █ █ to learn about Investigative Technique█ █ █ different Democratic websites, including democrats.org, hillaryclinton.com, dnc.org, and dccc.org. Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ began before the GRU had obtained any credentials or gained access to these networks, indicating that the later DCCC and DNC 116 intrusions were not crimes of opportunity but rather the result of targeting. - GRU officers also sent hundreds of spearphishing emails to the work and personal email accounts of Clinton Campaign employees and volunteers. Between March 10, 2016 and March 15, 2016, Unit 26165 appears to have sent approximately 90 spearphishing emails to email accounts at hillaryclinton.com. Starting on March 15, 2016, the GRU began targeting Google email accounts used by Clinton Campaign employees, along with a smaller number of dnc.org 117 email accounts. The GRU spearphishing operation enabled it to gain access to numerous email accounts of Clinton Campaign employees and volunteers, including campaign chairman John Podesta, junior volunteers assigned to the Clinton Campaign’s advance team, informal Clinton Campaign advisors, and a DNC

118 employee. GRU officers stole tens of thousands of emails from spearphishing victims, including various Clinton Campaign-related communications. 2. Intrusions into the DCCC and DNC Networks a. Initial Access By no later than April 12, 2016, the GRU had gained access to the DCCC computer network using the credentials stolen from a DCCC employee who had been successfully spearphished the week before. Over the ensuing weeks, the GRU traversed the network, identifying different computers connected to the DCCC network. By stealing network access credentials along the way (including those of IT administrators with unrestricted access to the system), the GRU 119 compromised approximately 29 different computers on the DCCC network. Approximately six days after first hacking into the DCCC network, on April 18, 2016, GRU officers gained access to the DNC network via a virtual private 120 121 network (VPN) connection between the DCCC and DNC networks. Between April 18, 2016 and June 8, 2016, Unit 26165 compromised more than 30 computers on the DNC network, including the DNC mail server and shared 122 file server. b. Implantation of Malware on DCCC and DNC Networks Unit 26165 implanted on the DCCC and DNC networks two types of 123 customized malware, known as “X-Agent” and “X-Tunnel”; Mimikatz, a credential-harvesting tool; and rar.exe, a tool used in these intrusions to compile and compress materials for exfiltration. X-Agent was a multi-function hacking tool that allowed Unit 26165 to log keystrokes, take screenshots, and gather other data about the infected computers (e.g., file directories, operating 124 systems). X-Tunnel was a hacking tool that created an encrypted connection between the victim DCCC/DNC computers and GRU-controlled computers outside the DCCC and DNC networks that was capable of large-scale data 125 transfers. GRU officers then used X-Tunnel to exfiltrate stolen data from the victim computers.

To operate X-Agent and X-Tunnel on the DCCC and DNC networks, Unit 26165 officers set up a group of computers outside those networks to 126 communicate with the implanted malware. The first set of GRU-controlled computers, known by the GRU as “middle servers,” sent and received messages to and from malware on the DNC/DCCC networks. The middle servers, in turn, relayed messages to a second set of GRU-controlled computers, labeled internally by the GRU as an “AMS Panel.” The AMS Panel Investigative Technique█ █ █ █ █ █ █ █ █ served as a nerve center through which GRU officers monitored and directed the malware’s operations on the DNC/DCCC 127 networks. The AMS Panel used to control X-Agent during the DCCC and DNC 128 intrusions was housed on a leased computer located near IT█ █ █ Arizona. 129 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The Arizona-based AMS Panel also stored thousands of files containing keylogging sessions captured through X-Agent. These sessions were captured as GRU officers monitored DCCC and DNC employees’ work on infected computers regularly between April 2016 and June 2016. Data captured in these keylogging sessions included passwords, internal communications between employees, banking information, and sensitive personal information. c. Theft of Documents from DNC and DCCC Networks Officers from Unit 26165 stole thousands of documents from the DCCC and DNC networks, including significant amounts of data pertaining to the 2016 U.S.

federal elections. Stolen documents included internal strategy documents, fundraising data, opposition research, and emails from the work inboxes of DNC 130 employees. The GRU began stealing DCCC data shortly after it gained access to the network. On April 14, 2016 (approximately three days after the initial intrusion) GRU officers downloaded rar.exe onto the DCCC’s document server. The following day, the GRU searched one compromised DCCC computer for files containing search terms that included “Hillary,” “DNC,” “Cruz,” and 131 “Trump.” On April 25, 2016, the GRU collected and compressed PDF and Microsoft documents from folders on the DCCC’s shared file server that 132 pertained to the 2016 election. The GRU appears to have compressed and 133 exfiltrated over 70 gigabytes of data from this file server. The GRU also stole documents from the DNC network shortly after gaining access. On April 22, 2016, the GRU copied files from the DNC network to GRU-controlled computers. Stolen documents included the DNC’s opposition 134 research into candidate Trump. Between approximately May 25, 2016 and June 1, 2016, GRU officers accessed the DNC’s mail server from a GRU- 135 controlled computer leased inside the United States. During these connections, Unit 26165 officers appear to have stolen thousands of emails and 136 attachments, which were later released by WikiLeaks in July 2016. B. Dissemination of the Hacked Materials The GRU’s operations extended beyond stealing materials, and included releasing documents stolen from the Clinton Campaign and its supporters. The GRU carried out the anonymous release through two fictitious online personas that it created—DCLeaks and Guccifer 2.0—and later through the organization WikiLeaks. 1. DCLeaks The GRU began planning the releases at least as early as April 19, 2016, when Unit 26165 registered the domain dcleaks.com through a service that 137 anonymized the registrant. Unit 26165 paid for the registration using a pool 138 of bitcoin that it had mined. The dcleaks.com landing page pointed to

different tranches of stolen documents, arranged by victim or subject matter. Other dcleaks.com pages contained indexes of the stolen emails that were being released (bearing the sender, recipient, and date of the email). To control access and the timing of releases, pages were sometimes password-protected for a period of time and later made unrestricted to the public. Starting in June 2016, the GRU posted stolen documents onto the website dcleaks.com, including documents stolen from a number of individuals associated with the Clinton Campaign. These documents appeared to have originated from personal email accounts (in particular, Google and Microsoft accounts), rather than the DNC and DCCC computer networks. DCLeaks victims included an advisor to the Clinton Campaign, a former DNC employee 139 and Clinton Campaign employee, and four other campaign volunteers. The GRU released through dcleaks.com thousands of documents, including personal identifying and financial information, internal correspondence related to the Clinton Campaign and prior political jobs, and fundraising files and 140 information. GRU officers operated a Facebook page under the DCLeaks moniker, which 141 they primarily used to promote releases of materials. The Facebook page was administered through a small number of preexisting GRU-controlled Facebook 142 accounts. GRU officers also used the DCLeaks Facebook account, the Twitter account @dcleaks_, and the email account [email protected] to communicate privately with reporters and other U.S. persons. GRU officers using the DCLeaks persona gave certain reporters early access to archives of leaked files by sending them links and passwords to pages on the dcleaks.com website that had not yet become public. For example, on July 14, 2016, GRU officers operating under the DCLeaks persona sent a link and password for a non-public 143 DCLeaks webpage to a U.S. reporter via the Facebook account. Similarly, on September 14, 2016, GRU officers sent reporters Twitter direct messages from @dcleaks_, with a password to another non-public part of the dcleaks.com 144 website. The DCLeaks.com website remained operational and public until March 2017.

2. Guccifer 2.0 On June 14, 2016, the DNC and its cyber-response team announced the breach of the DNC network and suspected theft of DNC documents. In the statements, the cyber-response team alleged that Russian state-sponsored actors 145 (which they referred to as “Fancy Bear”) were responsible for the breach. Apparently in response to that announcement, on June 15, 2016, GRU officers using the persona Guccifer 2.0 created a WordPress blog. In the hours leading up to the launch of that WordPress blog, GRU officers logged into a Moscow-based server used and managed by Unit 74455 and searched for a number of specific words and phrases in English, including “some hundred sheets,” “illuminati,” and “worldwide known.” Approximately two hours after the last of those searches, Guccifer 2.0 published its first post, attributing the DNC server hack to a lone Romanian hacker and using several of the unique English words and 146 phrases that the GRU officers had searched for that day. That same day, June 15, 2016, the GRU also used the Guccifer 2.0 WordPress blog to begin releasing to the public documents stolen from the DNC and DCCC computer networks. The Guccifer 2.0 persona ultimately released thousands of documents stolen from the DNC and DCCC in a series of blog 147 posts between June 15, 2016 and October 18, 2016. Released documents included opposition research performed by the DNC (including a memorandum analyzing potential criticisms of candidate Trump), internal policy documents (such as recommendations on how to address politically sensitive issues), analyses of specific congressional races, and fundraising documents. Releases were organized around thematic issues, such as specific states (e.g., Florida and Pennsylvania) that were perceived as competitive in the 2016 U.S. presidential election. Beginning in late June 2016, the GRU also used the Guccifer 2.0 persona to release documents directly to reporters and other interested individuals. Specifically, on June 27, 2016, Guccifer 2.0 sent an email to the news outlet The Smoking Gun offering to provide “exclusive access to some leaked emails linked 148 [to] Hillary Clinton’s staff.” The GRU later sent the reporter a password and link to a locked portion of the dcleaks.com website that contained an archive of emails stolen by Unit 26165 from a Clinton Campaign volunteer in March 149 2016. That the Guccifer 2.0 persona provided reporters access to a restricted

portion of the DCLeaks website tends to indicate that both personas were 150 operated by the same or a closely-related group of people. The GRU continued its release efforts through Guccifer 2.0 into August 2016. For example, on August 15, 2016, the Guccifer 2.0 persona sent a candidate for the U.S. Congress documents related to the candidate’s 151 opponent. On August 22, 2016, the Guccifer 2.0 persona transferred approximately 2.5 gigabytes of Florida-related data stolen from the DCCC to a 152 U.S. blogger covering Florida politics. On August 22, 2016, the Guccifer 2.0 persona sent a U.S. reporter documents stolen from the DCCC pertaining to the 153 Black Lives Matter movement. The GRU was also in contact through the Guccifer 2.0 persona with HOM█ █ █ a former Trump Campaign member Harm to Ongoing Matter█ █ █ █ █ 154 █ █ █ █ █ █ ██ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ In early August 2016, HOM█ █ █ Twitter’s suspension of the Guccifer 2.0 Twitter account. After it was reinstated, GRU officers posing as Guccifer 2.0 wrote HOM█ █ █ via private message, “thank u for writing back . . . do u find anyt[h]ing interesting in the docs i posted?” On August 17, 2016, the GRU added, “please tell me if i can help u anyhow . . . it would be a great pleasure to me.” On September 9, 2016, the GRU—again posing as Guccifer 2.0—referred to a stolen DCCC document posted online and asked HOM “what do u think of the info on the turnout model for the democrats entire presidential campaign.” 155 HOM responded, “pretty standard.” The investigation did not identify evidence of other communications between HOM and Guccifer 2.0. 3. Use of WikiLeaks In order to expand its interference in the 2016 U.S. presidential election, the GRU units transferred many of the documents they stole from the DNC and the chairman of the Clinton Campaign to WikiLeaks. GRU officers used both the DCLeaks and Guccifer 2.0 personas to communicate with WikiLeaks through Twitter private messaging and through encrypted channels, including possibly through WikiLeaks’s private communication system. a. WikiLeaks’s Expressed Opposition Toward the Clinton Campaign

WikiLeaks, and particularly its founder Julian Assange, privately expressed opposition to candidate Clinton well before the first release of stolen documents. In November 2015, Assange wrote to other members and associates of WikiLeaks that “[w]e believe it would be much better for GOP to win . . . Dems+Media+liberals woudl [sic] then form a block to reign in their worst qualities. . . . With Hillary in charge, GOP will be pushing for her worst qualities., dems+media+neoliberals will be mute. . . . She’s a bright, well 156 connected, sadisitic sociopath.” In March 2016, WikiLeaks released a searchable archive of approximately 157 30,000 Clinton emails that had been obtained through FOIA litigation. While designing the archive, one WikiLeaks member explained the reason for building the archive to another associate: [W]e want this repository to become “the place” to search for background on hillary’s plotting at the state department during 2009- 2013. . . . Firstly because its useful and will annoy Hillary, but secondly because we want to be seen to be a resource/player in the US election, because eit [sic] may en[]courage people to send us even more important 158 leaks. b. WikiLeaks’s First Contact with Guccifer 2.0 and DCLeaks Shortly after the GRU’s first release of stolen documents through dcleaks.com in June 2016, GRU officers also used the DCLeaks persona to contact WikiLeaks about possible coordination in the future release of stolen emails. On June 14, 2016, @dcleaks_ sent a direct message to @WikiLeaks, noting, “You announced your organization was preparing to publish more Hillary’s emails. We are ready to support you. We have some sensitive information too, in particular, her financial documents. Let’s do it to ether. What 159 do you think about publishing our info at the same moment? Thank you.” Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Around the same time, WikiLeaks initiated communications with the GRU persona Guccifer 2.0 shortly after it was used to release documents stolen from the DNC. On June 22, 2016, seven days after Guccifer 2.0’s first releases of stolen DNC documents, WikiLeaks used Twitter’s direct message function to

contact the Guccifer 2.0 Twitter account and suggest that Guccifer 2.0 “[s]end any new material [stolen from the DNC] here for us to review and it will have a 160 much higher impact than what you are doing.” On July 6, 2016, WikiLeaks again contacted Guccifer 2.0 through Twitter’s private messaging function, writing, “if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC is approaching and she will solidify bernie supporters behind her after.” The Guccifer 2.0 persona responded, “ok . . . i see.” WikiLeaks also explained, “we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie 161 and hillary is interesting.” c. The GRU’s Transfer of Stolen Materials to WikiLeaks Both the GRU and WikiLeaks sought to hide their communications, which has limited the Office’s ability to collect all of the communications between them. Thus, although it is clear that the stolen DNC and Podesta documents were transferred from the GRU to WikiLeaks, █ █ █Investigative Technique█ █ █ The Office was able to identify when the GRU (operating through its personas Guccifer 2.0 and DCLeaks) transferred some of the stolen documents to WikiLeaks through online archives set up by the GRU. Assange had access to the internet from the Ecuadorian Embassy in London, England. Investigative 162 Technique█ █ █ █ █ █ █ █ █ On July 14, 2016, GRU officers used a Guccifer 2.0 email account to send WikiLeaks an email bearing the subject “big archive” and the message “a new 163 attempt.” The email contained an encrypted attachment with the name “wk 164 dnc link1.txt.gpg.” Using the Guccifer 2.0 Twitter account, GRU officers 165 sent WikiLeaks an encrypted file and instructions on how to open it. On July 18, 2016, WikiLeaks confirmed in a direct message to the Guccifer 2.0 account that it had “the 1Gb or so archive” and would make a release of the stolen 166 documents “this week.” On July 22, 2016, WikiLeaks released over 20,000 167 emails and other documents stolen from the DNC computer networks. The Democratic National Convention began three days later.

Similar communications occurred between WikiLeaks and the GRU- operated persona DCLeaks. On September 15, 2016, @dcleaks wrote to @WikiLeaks, “hi there! I’m from DC Leaks. How could we discuss some submission-related issues? Am trying to reach out to you via your secured chat but getting no response. I’ve got something that might interest you. You won’t 168 be disappointed, I promise.” The WikiLeaks account responded, “Hi there,” without further elaboration. The @dcleaks_ account did not respond immediately. The same day, the Twitter account @guccifer_2 sent @dcleaks_ a direct 169 message, which is the first known contact between the personas. During subsequent communications, the Guccifer 2.0 persona informed DCLeaks that WikiLeaks was trying to contact DCLeaks and arrange for a way to speak 170 through encrypted emails. An analysis of the metadata collected from the WikiLeaks site revealed that 171 the stolen Podesta emails show a creation date of September 19, 2016. Based on information about Assange’s computer and its possible operating system, this date may be when the GRU staged the stolen Podesta emails for transfer to WikiLeaks (as the GRU had previously done in July 2016 for the DNC 172 emails). The WikiLeaks site also released PDFs and other documents taken from Podesta that were attachments to emails in his account; these documents had a creation date of October 2, 2016, which appears to be the date the 173 attachments were separately staged by WikiLeaks on its site. Beginning on September 20, 2016, WikiLeaks and DCLeaks resumed communications in a brief exchange. On September 22, 2016, a DCLeaks email account [email protected] sent an email to a WikiLeaks account with the subject “Submission” and the message “Hi from DCLeaks.” The email 174 contained a PGP-encryted message with the filename “wiki_mail.txt.gpg.” Investigative Technique█ █ █ █ █ █ █ █ █ The email, however, bears a number of similarities to the July 14, 2016 email in which GRU officers used the Guccifer 2.0 persona to give WikiLeaks access to the archive of DNC files. On September 22, 2016 (the same day of DCLeaks’ email to WikiLeaks), the Twitter account @dcleaks sent a single message to @WikiLeaks with the string of characters Investigative Technique█ █ █ █ █ █ █ █ █

The Office cannot rule out that stolen documents were transferred to WikiLeaks through intermediaries who visited during the summer of 2016. For example, public reporting identified Andrew Müller-Maguhn as a WikiLeaks associate who may have assisted with the transfer of these stolen documents to 175 WikiLeaks Investigative Technique█ █ █ █ █ █ █ █ █ Investigative 176 Technique█ █ █ █ █ █ █ █ █ On October 7, 2016, WikiLeaks released the first emails stolen from the Podesta email account. In total, WikiLeaks released 33 tranches of stolen emails between October 7, 2016 and November 7, 2016. The releases included private 177 speeches given by Clinton; internal communications between Podesta and 178 other high-ranking members of the Clinton Campaign; and correspondence 179 related to the Clinton Foundation. In total, WikiLeaks released over 50,000 documents stolen from Podesta’s personal email account. The last-in-time email released from Podesta’s account was dated March 21, 2016, two days after Podesta received a spearphishing email sent by the GRU. d. WikiLeaks Statements Dissembling About the Source of Stolen Materials As reports attributing the DNC and DCCC hacks to the Russian government emerged, WikiLeaks and Assange made several public statements apparently designed to obscure the source of the materials that WikiLeaks was releasing. The file-transfer evidence described above and other information uncovered during the investigation discredit WikiLeaks’s claims about the source of material that it posted. Beginning in the summer of 2016, Assange and WikiLeaks made a number of statements about Seth Rich, a former DNC staff member who was killed in July 2016. The statements about Rich implied falsely that he had been the source of the stolen DNC emails. On August 9, 2016, the @WikiLeaks Twitter account posted: “ANNOUNCE: WikiLeaks has decided to issue a US$20k reward for 180 information leading to conviction for the murder of DNC staffer Seth Rich.” Likewise, on August 25, 2016, Assange was asked in an interview, “Why are you so interested in Seth Rich’s killer?” and responded, “We’re very interested in anything that might be a threat to alleged Wikileaks sources.” The interviewer responded to Assange’s statement by commenting, “I know you don’t want to

reveal your source, but it certainly sounds like you’re suggesting a man who leaked information to WikiLeaks was then murdered.” Assange replied, “If there’s someone who’s potentially connected to our publication, and that person has been murdered in suspicious circumstances, it doesn’t necessarily mean that the two are connected. But it is a very serious matter . . . that type of allegation is 181 very serious, as it’s taken very seriously by us.” After the U.S. intelligence community publicly announced its assessment that Russia was behind the hacking operation, Assange continued to deny that the Clinton materials released by WikiLeaks had come from Russian hacking. According to media reports, Assange told a U.S. congressman that the DNC hack was an “inside job,” and purported to have “physical proof” that Russians 182 did not give materials to Assange. C. Additional GRU Cyber Operations While releasing the stolen emails and documents through DCLeaks, Guccifer 2.0, and WikiLeaks, GRU officers continued to target and hack victims linked to the Democratic campaign and, eventually, to target entities responsible for election administration in several states. 1. Summer and Fall 2016 Operations Targeting Democrat-Linked Victims On July 27 2016, Unit 26165 targeted email accounts connected to candidate Clinton’s personal office PP█ █ █. Earlier that day, candidate Trump made public statements that included the following: “Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing. I think you will probably 183 be rewarded mightily by our press.” The “30,000 emails” were apparently a reference to emails described in media accounts as having been stored on a personal server that candidate Clinton had used while serving as Secretary of State. Within approximately five hours of Trump’s statement, GRU officers targeted for the first time Clinton’s personal office. After candidate Trump’s remarks, Unit 26165 created and sent malicious links targeting 15 email accounts at the domain PP█ █ █ including an email account belonging to Clinton aide PP█ █ █ The investigation did not find evidence of earlier GRU attempts to compromise accounts hosted on this domain. It is unclear how the

184 GRU was able to identify these email accounts, which were not public. Unit 26165 officers also hacked into a DNC account hosted on a cloud- computing service Personal Privacy█ █ █ On September 20, 2016, the GRU began to generate copies of the DNC data using PP█ █ █ function designed to allow users to produce backups of databases (referred to PP█ █ █as “snapshots”). The GRU then stole those snapshots by moving them to PP█ █ █ account that they controlled; from there, the copies were moved to GRU- controlled computers. The GRU stole approximately 300 gigabytes of data from 185 the DNC cloud-based account. 2. Intrusions Targeting the Administration of U.S. Elections In addition to targeting individuals involved in the Clinton Campaign, GRU officers also targeted individuals and entities involved in the administration of the elections. Victims included U.S. state and local entities, such as state boards of elections (SBOEs), secretaries of state, and county governments, as well as 186 individuals who worked for those entities. The GRU also targeted private technology firms responsible for manufacturing and administering election- related software and hardware, such as voter registration software and electronic 187 polling stations. The GRU continued to target these victims through the elections in November 2016. While the investigation identified evidence that the GRU targeted these individuals and entities, the Office did not investigate further. The Office did not, for instance, obtain or examine servers or other relevant items belonging to these victims. The Office understands that the FBI, the U.S. Department of Homeland Security, and the states have separately investigated that activity. By at least the summer of 2016, GRU officers sought access to state and local computer networks by exploiting known software vulnerabilities on websites of state and local governmental entities. GRU officers, for example, targeted state and local databases of registered voters using a technique known as “SQL injection,” by which malicious code was sent to the state or local website in order to run commands (such as exfiltrating the database 188 contents). In one instance in approximately June 2016, the GRU compromised the computer network of the Illinois State Board of Elections by exploiting a vulnerability in the SBOE’s website. The GRU then gained access

189 to a database containing information on millions of registered Illinois voters, and extracted data related to thousands of U.S. voters before the malicious 190 activity was identified. GRU officers Investigative Technique█ █ █ scanned state and local websites for vulnerabilities. For example, over a two-day period in July 2016, GRU officers Investigative Technique█ █ █ for vulnerabilities on websites of more than two dozen states. Investigative Technique█ █ █ Investigative Technique█ █ █ Similar IT█ █ █ for vulnerabilities continued through the election. Unit 74455 also sent spearphishing emails to public officials involved in election administration and personnel at companies involved in voting technology. In August 2016, GRU officers targeted employees of PP█ █ █, a voting technology company that developed software used by numerous U.S. counties to manage voter rolls, and installed malware on the company network. Similarly, in November 2016, the GRU sent spearphishing emails to over 120 email accounts used by Florida county officials responsible for administering the 191 2016 U.S. election. The spearphishing emails contained an attached Word document coded with malicious software (commonly referred to as a Trojan) that 192 permitted the GRU to access the infected computer. The FBI was separately responsible for this investigation. We understand the FBI believes that this operation enabled the GRU to gain access to the network of at least one Florida county government. The Office did not independently verify that belief and, as explained above, did not undertake the investigative steps that would have been necessary to do so. D. Trump Campaign and the Dissemination of Hacked Materials The Trump Campaign showed interest in WikiLeaks’s releases hacked materials throughout the summer and fall of 2016. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 1. HOM█ █ █ a. Background

Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ b. Contacts with the Campaign about WikiLeaks Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 193 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ On June 12, 2016, Assange claimed in a televised interview to “have emails relating to Hillary Clinton which are pending 194 publication,” but provided no additional context. In debriefings with the Office, former deputy campaign chairman Rick Gates said that, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 195 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Gates recalled candidate Trump being 196 generally frustrated that the Clinton emails had not been found. Paul Manafort, who would later become campaign chairman, Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 197 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 198 █ █ █ █ █ █ █ █ Michael Cohen, former executive vice president of the Trump Organization 199 and special counsel to Donald J. Trump, told the Office that he recalled an incident in which he was in candidate Trump’s office in Trump Tower Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 200 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 201 █ █ █ █ █ █ █ Cohen further told the Office that, after WikiLeaks’s subsequent release of stolen DNC emails in July 2016, candidate Trump said to 202 Cohen something to effect of, HOM█ █ █

Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ According to Gates, Manafort expressed excitement about the release HOM█ 203 █ █ █ █ █ Manafort, for his part, told the Office that, shortly after WikiLeaks’s July 22 release, Manafort also spoke with candidate Trump Harm 204 to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 205 Manafort also HOM█ █ █ wanted to be kept apprised of any developments with WikiLeaks and separately told Gates to keep in touch HOM█ █ █ about 206 future WikiLeaks releases. According to Gates, by the late summer of 2016, the Trump Campaign was planning a press strategy, a communications campaign, and messaging based on 207 the possible release of Clinton emails by WikiLeaks. Harm to Ongoing 208 Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ while Trump and Gates were driving to LaGuardia Airport. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █, shortly after the call candidate Trump told Gates that more releases of damaging information would 209 be coming. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 210 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ c. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 211 212 █ Corsi is an author who holds a doctorate in political science In 2016, Corsi also worked for the media outlet WorldNetDaily (WND). Harm to 213 Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

214 █ █ █ █ █ █ █ █ Corsi told the Office during interviews that he “must 215 have” previously discussed Assange with Malloch. █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 216 217 █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ According to Malloch, Corsi asked him to put Corsi in touch with Assange, whom Corsi wished to interview. Malloch recalled that Corsi also suggested that individuals in the “orbit” of U.K. politician Nigel Farage might be able to contact Assange and asked if Malloch knew them. Malloch told Corsi that he would think about 218 the request but made no actual attempt to connect Corsi with Assange. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 219 █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 220 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Malloch stated to investigators that beginning in or about August 2016, he and Corsi had multiple FaceTime discussions about WikiLeaks Harm to Ongoing Matter█ █ █ had made a connection to Assange and that the hacked emails of John Podesta would be released prior to Election Day and would be helpful to the Trump Campaign. In one conversation in or around August or September 2016, Corsi told Malloch that the release of the Podesta emails was 221 coming, after which “we” were going to be in the driver’s seat. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 222 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ 223 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 224 █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █

225 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 226 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ 227 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 228 █ █ █ █ █ █ █ █ █ █ █ █ █ █ ) Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 229 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 230 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ 231 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 232 █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 233 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ 234 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 235 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 236 █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ 237 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 238 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ d. WikiLeaks’s October 7, 2016 Release of Stolen Podesta Emails On October 7, 2016, four days after the Assange press conference HOM█ █ █, the Washington Post published an Access Hollywood video that captured comments by candidate Trump some years earlier and that was expected to

239 adversely affect the Campaign. Less than an hour after the video’s publication, WikiLeaks released the first set of emails stolen by the GRU from the account of Clinton Campaign chairman John Podesta. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 240 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 241 █ █ █ █ █ █ █ █ █ █ █ █ █. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 242 █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 243 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Corsi said that, because he had no direct means of communicating with WikiLeaks, he told members of the news site WND—who were participating on a conference call with him that day—to 244 reach Assange immediately. Corsi claimed that the pressure was enormous and recalled telling the conference call the Access Hollywood tape was 245 coming. Corsi stated that he was convinced that his efforts had caused 246 WikiLeaks to release the emails when they did. In a later November 2018 interview, Corsi stated that he thought that he had told people on a WND conference call about the forthcoming tape and had sent out a tweet asking whether anyone could contact Assange, but then said that maybe he had done 247 nothing. The Office investigated Corsi’s allegations about the events of October 7, 248 2016 but found little corroboration for his allegations about the day. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 249 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 250 █ █ █ █ █ █ █ █ However, the phone records themselves do not indicate that the conversation was with any of the reporters who broke the Access Hollywood story, and the Office has not otherwise been able to identify the substance of the conversation. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █

█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 251 █. However, the Office has not identified any conference call participant, or anyone who spoke to Corsi that day, who says that they received non-public information about the tape from Corsi or acknowledged having contacted a member of WikiLeaks on October 7, 2016 after a conversation with Corsi. e. Donald Trump Jr. Interaction with WikiLeaks Donald Trump Jr. had direct electronic communications with WikiLeaks during the campaign period. On September 20, 2016, an individual named Jason Fishbein sent WikiLeaks the password for an unlaunched website focused on 252 Trump’s “unprecedented and dangerous” ties to Russia, PutinTrump.org. WikiLeaks publicly tweeted: ‘“Let’s bomb Iraq’ Progress for America PAC to launch “PutinTrump.org’ at 9:30am. Oops pw is ‘putintrump’ putintrump.org.” Several hours later, WikiLeaks sent a Twitter direct message to Donald Trump Jr., “A PAC run anti-Trump site putintrump.org is about to launch. The PAC is a recycled pro-Iraq war PAC. We have guessed the password. It is ‘putintrump.’ 253 See ‘About’ for who is behind it. Any comments?” Several hours later, Trump Jr. emailed a variety of senior campaign staff: Guys I got a weird Twitter DM from wikileaks. See below. I tried the password and it works and the about section they reference contains the next pic in terms of who is behind it. Not sure if this is anything but it seems like it’s really wikileaks asking me as I follow them and it is a DM. Do you know the people mentioned and what the conspiracy they are looking for could be? These are just screen shots but it’s a fully built out page claiming to be a PAC let me know your thoughts and if we want 254 to look into it. Trump Jr. attached a screenshot of the “About” page for the unlaunched site PutinTrump.org. The next day (after the website had launched publicly), Trump Jr. sent a direct message to WikiLeaks: “Off the record, I don’t know who that is 255 but I’ll ask around. Thanks.” On October 3, 2016, WikiLeaks sent another direct message to Trump Jr., asking “you guys” to help disseminate a link alleging candidate Clinton had

advocated using a drone to target Julian Assange. Trump Jr. responded that he already “had done so,” and asked, “what’s behind this Wednesday leak I keep 256 reading about?” WikiLeaks did not respond. On October 12, 2016, WikiLeaks wrote again that it was “great to see you and your dad talking about our publications. Strongly suggest your dad tweets 257 this link if he mentions us wlsearch.tk.” WikiLeaks wrote that the link would help Trump in “digging through” leaked emails and stated, “we just released 258 Podesta emails Part 4.” Two days later, Trump Jr. publicly tweeted the 259 wlsearch.tk link. 2. Other Potential Campaign Interest in Russian Hacked Materials Throughout 2016, the Trump Campaign expressed interest in Hillary Clinton’s private email server and whether approximately 30,000 emails from that server had in fact been permanently destroyed, as reported by the media. Several individuals associated with the Campaign were contacted in 2016 about various efforts to obtain the missing Clinton emails and other stolen material in support of the Trump Campaign. Some of these contacts were met with skepticism, and nothing came of them; others were pursued to some degree. The investigation did not find evidence that the Trump Campaign recovered any such Clinton emails, or that these contacts were part of a coordinated effort between Russia and the Trump Campaign. a. Henry Oknyansky (a/k/a Henry Greenberg) In the spring of 2016, Trump Campaign advisor Michael Caputo learned through a Florida-based Russian business partner that another Florida-based Russian, Henry Oknyansky (who also went by the name Henry Greenberg), claimed to have information pertaining to Hillary Clinton. Caputo notified Roger Stone and brokered communication between Stone and Oknyansky. Oknyansky 260 and Stone set up a May 2016 in-person meeting. Oknyansky was accompanied to the meeting by Alexei Rasin, a Ukrainian associate involved in Florida real estate. At the meeting, Rasin offered to sell Stone derogatory information on Clinton that Rasin claimed to have obtained while working for Clinton. Rasin claimed to possess financial statements

demonstrating Clinton’s involvement in money laundering with Rasin’s companies. According to Oknyansky, Stone asked if the amounts in question totaled millions of dollars but was told it was closer to hundreds of thousands. Stone refused the offer, stating that Trump would not pay for opposition 261 research. Oknyansky claimed to the Office that Rasin’s motivation was financial. According to Oknyansky, Rasin had tried unsuccessfully to shop the Clinton information around to other interested parties, and Oknyansky would receive a 262 cut if the information was sold. Rasin is noted in public source documents as the director and/or registered agent for a number of Florida companies, none of which appears to be connected to Clinton. The Office found no other evidence that Rasin worked for Clinton or any Clinton-related entities. In their statements to investigators, Oknyansky and Caputo had contradictory recollections about the meeting. Oknyansky claimed that Caputo accompanied Stone to the meeting and provided an introduction, whereas Caputo did not tell us that he had attended and claimed that he was never told what information Oknyansky offered. Caputo also stated that he was unaware Oknyansky sought to be paid for the information until Stone informed him after 263 the fact. The Office did not locate Rasin in the United States, although the Office confirmed Rasin had been issued a Florida driver’s license. The Office otherwise was unable to determine the content and origin of the information he purportedly offered to Stone. Finally, the investigation did not identify evidence of a connection between the outreach or the meeting and Russian interference efforts. b. Campaign Efforts to Obtain Deleted Clinton Emails After candidate Trump stated on July 27, 2016, that he hoped Russia would “find the 30,000 emails that are missing,” Trump asked individuals affiliated 264 with his Campaign to find the deleted Clinton emails. Michael Flynn—who would later serve as National Security Advisor in the Trump Administration— recalled that Trump made this request repeatedly, and Flynn subsequently 265 contacted multiple people in an effort to obtain the emails.

Barbara Ledeen and Peter Smith were among the people contacted by Flynn. Ledeen, a long-time Senate staffer who had previously sought the Clinton emails, provided updates to Flynn about her efforts throughout the summer of 266 2016. Smith, an investment advisor who was active in Republican politics, 267 also attempted to locate and obtain the deleted Clinton emails. Ledeen began her efforts to obtain the Clinton emails before Flynn’s request, 268 as early as December 2015. On December 3, 2015, she emailed Smith a proposal to obtain the emails, stating, “Here is the proposal I briefly mentioned to you. The person I described to you would be happy to talk with you either in person or over the phone. The person can get the emails which 1. Were classified and 2. Were purloined by our enemies. That would demonstrate what needs to be 269 demonstrated.” Attached to the email was a 25-page proposal stating that the “Clinton email server was, in all likelihood, breached long ago,” and that the Chinese, Russian, and Iranian intelligence services could “re-assemble the server’s email 270 content.” The proposal called for a three-phase approach. The first two phases consisted of open-source analysis. The third phase consisted of checking with certain intelligence sources “that have access through liaison work with various foreign services” to determine if any of those services had gotten to the server. The proposal noted, “Even if a single email was recovered and the providence [sic] of that email was a foreign service, it would be catastrophic to the Clinton campaign[.]” Smith forwarded the email to two colleagues and 271 wrote, “we can discuss to whom it should be referred.” On December 16, 2015, Smith informed Ledeen that he declined to participate in her “initiative.” According to one of Smith’s business associates, Smith believed Ledeen’s 272 initiative was not viable at that time. Just weeks after Trump’s July 2016 request to find the Clinton emails, however, Smith tried to locate and obtain the emails himself. He created a company, raised tens of thousands of dollars, and recruited security experts and business associates. Smith made claims to others involved in the effort (and those from whom he sought funding) that he was in contact with hackers with “ties and affiliations to Russia” who had access to the emails, and that his efforts 273 were coordinated with the Trump Campaign.

On August 28, 2016, Smith sent an email from an encrypted account with the subject “Sec. Clinton’s unsecured private email server” to an undisclosed list of recipients, including Campaign co-chairman Sam Clovis. The email stated that Smith was “[j]ust finishing two days of sensitive meetings here in DC with involved groups to poke and probe on the above. It is clear that the Clinton’s home-based, unprotected server was hacked with ease by both State-related players, and private mercenaries. Parties with varying interests, are circling to 274 release ahead of the election.” On September 2, 2016, Smith directed a business associate to establish KLS 275 Research LLC in furtherance of his search for the deleted Clinton emails. One of the purposes of KLS Research was to manage the funds Smith raised in 276 support of his initiative. KLS Research received over $30,000 during the presidential campaign, although Smith represented that he raised even more 277 money. Smith recruited multiple people for his initiative, including security experts 278 to search for and authenticate the emails. In early September 2016, as part of his recruitment and fundraising effort, Smith circulated a document stating that his initiative was “in coordination” with the Trump Campaign, “to the extent 279 permitted as an independent expenditure organization.” The document listed multiple individuals affiliated with the Trump Campaign, including Flynn, 280 Clovis, Bannon, and Kellyanne Conway. The investigation established that Smith communicated with at least Flynn and Clovis about his search for the 281 deleted Clinton emails, but the Office did not identify evidence that any of the listed individuals initiated or directed Smith’s efforts. In September 2016, Smith and Ledeen got back in touch with each other about their respective efforts. Ledeen wrote to Smith, “wondering if you had some more detailed reports or memos or other data you could share because we have come a long way in our efforts since we last visited. . . . We would need as much technical discussion as possible so we could marry it against the new data 282 we have found and then could share it back to you ‘your eyes only.’” Ledeen claimed to have obtained a trove of emails (from what she described as the “dark web”) that purported to be the deleted Clinton emails. Ledeen

wanted to authenticate the emails and solicited contributions to fund that effort. Erik Prince provided funding to hire a tech advisor to ascertain the authenticity of the emails. According to Prince, the tech advisor determined that the emails 283 were not authentic. A backup of Smith’s computer contained two files that had been downloaded from WikiLeaks and that were originally attached to emails received by John Podesta. The files on Smith’s computer had creation dates of October 2, 2016, which was prior to the date of their release by WikiLeaks. Forensic examination, however, established that the creation date did not reflect when the files were downloaded to Smith’s computer. (It appears the creation date was when WikiLeaks staged the document for release, as discussed in 284 Volume I, Section III.B.3.c, supra. ) The investigation did not otherwise identify evidence that Smith obtained the files before their release by WikiLeaks. Smith continued to send emails to an undisclosed recipient list about Clinton’s deleted emails until shortly before the election. For example, on October 28, 2016, Smith wrote that there was a “tug-of-war going on within WikiLeaks over its planned releases in the next few days,” and that WikiLeaks “has maintained that it will save its best revelations for last, under the theory this 285 allows little time for response prior to the U.S. election November 8.” An attachment to the email claimed that WikiLeaks would release “All 33k deleted Emails” by “November 1st.” No emails obtained from Clinton’s server were subsequently released. Smith drafted multiple emails stating or intimating that he was in contact with Russian hackers. For example, in one such email, Smith claimed that, in August 2016, KLS Research had organized meetings with parties who had access to the deleted Clinton emails, including parties with “ties and affiliations 286 to Russia.” The investigation did not identify evidence that any such meetings occurred. Associates and security experts who worked with Smith on the initiative did not believe that Smith was in contact with Russian hackers and 287 were aware of no such connection. The investigation did not establish that Smith was in contact with Russian hackers or that Smith, Ledeen, or other individuals in touch with the Trump Campaign ultimately obtained the deleted Clinton emails.

* * * In sum, the investigation established that the GRU hacked into email accounts of persons affiliated with the Clinton Campaign, as well as the computers of the DNC and DCCC. The GRU then exfiltrated data related to the 2016 election from these accounts and computers, and disseminated that data through fictitious online personas (DCLeaks and Guccifer 2.0) and later through WikiLeaks. The investigation also established that the Trump Campaign displayed interest in the WikiLeaks releases, and that Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ As explained in Volume I, Section V.B, infra, the evidence was sufficient to support computer- intrusion (and other) charges against GRU officers for their role in election- related hacking. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 109 As discussed in Section V below, our Office charged 12 GRU officers for crimes arising from the hacking of these computers, principally with conspiring to commit computer intrusions, in violation of 18 U.S.C. §§ 1030 and 371. See Volume I, Section V.B, infra; Indictment, United States v. Netyksho, No. 1:18- cr-215 (D.D.C. July 13, 2018), Doc. 1 (“Netyksho Indictment”). 110 Netyksho Indictment ¶ 1. 111 Separate from this Office’s indictment of GRU officers, in October 2018 a grand jury sitting in the Western District of Pennsylvania returned an indictment charging certain members of Unit 26165 with hacking the U.S. Anti-Doping Agency, the World Anti-Doping Agency, and other international sport associations. United States v. Aleksei Sergeyevich Morenets, No. 18-263 (W.D. Pa.). 112 A spearphishing (IAEN) email is designed to appear as though it originates from a trusted source, and solicits information to enable the sender to gain access to an account or network, or causes the recipient to download malware that enables the sender to gain access to an account or network. Netyksho Indictment ¶ 10. 113 Bitcoin mining (IAEN) consists of unlocking new bitcoins by solving computational problems. IT█ █ █ kept its newly mined coins in an account on the bitcoin exchange platform CEX.io. To make purchases, the GRU routed funds into other accounts through transactions designed to obscure the source of funds. Netyksho Indictment ¶ 62. 114 Netyksho Indictment ¶ 69. 115 Netyksho Indictment ¶ 9.

116 See SM-2589105, serials 144 & 495. 117 Investigative Technique█ █ █ █ █ █ █ █ █ 118 Investigative Technique█ █ █ 119 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ 120 A VPN extends a private network, allowing users to send and receive data across public networks (such as the internet) as if the connecting computer was directly connected to the private network. The VPN in this case had been created to give a small number of DCCC employees access to certain databases housed on the DNC network. Therefore, while the DCCC employees were outside the DNC’s private network, they could access parts of the DNC network from their DCCC computers (IAEN). 121 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ SM-2589105- HACK, serial 5. 122 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ M-2589105- HACK, serial 5. 123 “Malware” is short for malicious software (IAEN), and here refers to software designed to allow a third party to infiltrate a computer without the consent or knowledge of the computer’s user or operator. 124 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 125 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 126 In connection with these intrusions, the GRU used computers (IAEN) (virtual private networks, dedicated servers operated by hosting companies, etc.) that it leased from third-party providers located all over the world. The investigation identified rental agreements and payments for computers located in, inter alia, Investigative Technique█ █ █ all of which were used in the operations targeting the U.S. election. 127 Netyksho Indictment ¶ 25. 128 Netyksho Indictment ¶ 24(c). 129 Netyksho Indictment ¶ 24(b). 130 Netyksho Indictment ¶¶ 27-29; Investigative Technique█ █ █ 131 Investigative Technique█ █ █ 132 Investigative Technique█ █ █ █ █ █ 133 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 134 Investigative Technique█ █ █ █ █ █ SM-2589105-HACK, serial 5. Investigative Technique█ █ █ █ █ █

135 Investigative Technique█ █ █ █ █ █ █ █ █ █ See SM-2589105-GJ, serial 649. As part of its investigation, the FBI later received images of DNC servers and copies of relevant traffic logs. Netyksho Indictment ¶¶ 28-29. 136 Netyksho Indictment ¶ 29. The last-in-time DNC email released by WikiLeaks was dated May 25, 2016, the same period of time during which the GRU gained access to the DNC’s email server. Netyksho Indictment ¶ 45. 137 Netyksho Indictment ¶ 35. Approximately a week before the registration of dcleaks.com, the same actors attempted to register the website electionleaks.com using the same domain registration service. Investigative Technique█ █ █ █ █ █ 138 See SM-2589105, serial 181; Netyksho Indictment ¶ 21(a). 139 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 140 See, e.g., Internet Archive, “https://dcleaks.com/” (archive date Nov. 10, 2016). Additionally, DCLeaks released documents relating to Personal Privacy█ █ █ █ █ █ █ █ █, emails belonging to PP█ █ █ █ █ █, and emails from 2015 relating to Republican Party employees (under the portfolio name “The United States Republican Party”). “The United States Republican Party” portfolio contained approximately 300 emails from a variety of GOP members, PACs, campaigns, state parties, and businesses dated between May and October 2015. According to open-source reporting, these victims shared the same Tennessee- based web-hosting company, called Smartech Corporation. William Bastone, RNC E-Mail Was, In Fact, Hacked By Russians, The Smoking Gun (Dec. 13, 2016). 141 Netyksho Indictment ¶ 38. 142 See, e.g., Facebook Account 100008825623541 (Alice Donovan). 143 7/14/16 Facebook Message, ID 793058100795341 (DC Leaks) to ID Personal Privacy█ █ █ █ 144 See, e.g., 9/14/16 Twitter DM, @dcleaks_ to Personal Privacy█ █ █ █ █ █ █ █ █; 9/14/16 Twitter DM, @dcleaks_ to Personal Privacy█ █ █ █ █ █ █ █ █. The messages read: “Hi https://t.co/QTvKUjQcOx pass: KvFsg%*14@gPgu& enjoy ;).” 145 Dmitri Alperovitch, Bears in the Midst: Intrusion into the Democratic National Committee, CrowdStrike Blog (June 14, 2016). CrowdStrike updated its post after the June 15, 2016 post by Guccifer 2.0 claiming responsibility for the intrusion. 146 Netyksho Indictment ¶¶ 41-42. 147 Releases of documents on the Guccifer 2.0 blog occurred on June 15, 2016; June 20, 2016; June 21, 2016; July 6, 2016; July 14, 2016; August 12, 2016; August 15, 2016; August 21, 2016; August 31, 2016; September 15, 2016; September 23, 2016; October 4, 2016; and October 18, 2016. 148 6/27/16 Email, [email protected] to Personal Privacy█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ (subject “leaked emails”); IT█ █ █ █ █ █ █ █ █. 149 6/27/16 Email, [email protected] to Personal Privacy█ █ █ (subject “leaked emails”); IT█ █ █;

see also 6/27/16 Email, [email protected] to Personal Privacy█ █ █ (subject “leaked emails”); IT█ █ █ (claiming DCLeaks was a “Wikileaks sub project”). 150 Before sending the reporter the link and password to the closed DCLeaks website, and in an apparent effort to deflect attention from the fact that DCLeaks and Guccifer 2.0 were operated by the same organization (IAEN), the Guccifer 2.0 persona sent the reporter an email stating that DCLeaks was a “Wikileaks sub project” and that Guccifer 2.0 had asked DCLeaks to release the leaked emails with “closed access” to give reporters a preview of them. 151 Netyksho Indictment ¶ 43(a). 152 Netyksho Indictment ¶ 43(b). 153 Netyksho Indictment ¶ 43(c). 154 HOM█ █ █ 155 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ 156 11/19/15 Twitter Group Chat, Group ID 594242937858486276, @WikiLeaks et al. Assange also wrote that, “GOP will generate a lot opposition [sic], including through dumb moves. Hillary will do the same thing, but co-opt the liberal opposition and the GOP opposition. Hence hillary has greater freedom to start wars than the GOP and has the will to do so.” Id. 157 WikiLeaks, “Hillary Clinton Email Archive,” available at https://wikileaks.org/clinton-emails/. 158 3/14/16 Twitter DM, @WikiLeaks to PP█ █ █ Less than two weeks earlier, the same account had been used to send a private message opposing the idea of Clinton “in whitehouse with her bloodlutt and amitions [sic] of empire with hawkish liberal-interventionist appointees.” 11/19/15 Twitter Group Chat, Group ID 594242937858486276, @WikiLeaks et al. 159 6/14/16 Twitter DM, @dcleaks_ to @WikiLeaks. 160 Netyksho Indictment ¶ 47(a). 161 7/6/16 Twitter DMs, @WikiLeaks & @guccifer_2. 162 Investigative Technique█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 163 This was not the GRU’s first attempt at transferring data to WikiLeaks. On June 29, 2016, the GRU used a Guccifer 2.0 email account to send a large encrypted file to a WikiLeaks email account. 6/29/16 Email, [email protected] IT█ █ █ █ █ █ █ █ █ (The email appears to have been undelivered.) 164 See SM-2589105-DCLEAKS, serial 28 (analysis). 165 6/27/16 Twitter DM, @Guccifer_2 to @WikiLeaks. 166 7/18/16 Twitter DM, @Guccifer_2 & @WikiLeaks.

167 “DNC Email Archive,” WikiLeaks (Jul. 22, 2016), available at https://wikileaks.org/dnc-emails. 168 9/15/16 Twitter DM, @dcleaks_ to @WikiLeaks. 169 9/15/16 Twitter DM, @guccifer_2 to @dcleaks_. 170 See SM-2589105-DCLEAKS, serial 28; 9/15/16 Twitter DM, @Guccifer_2 & @WikiLeaks. 171 See SM-2284941, serials 63 & 64 Investigative Technique█ █ █ █ █ █ █ █ █ 172 Investigative Technique█ █ █ █ █ █ █ █ █ At the time, certain Apple operating systems used a setting that left a downloaded file’s creation date the same as the creation date shown on the host computer. This would explain why the creation date on WikiLeaks’s version of the files was still September 19, 2016. See SM-2284941, serial 62 Investigative Technique█ █ █ █ █ █ █ █ █ 173 When WikiLeaks saved attachments separately from the stolen emails (IAEN), its computer system appears to have treated each attachment as a new file and given it a new creation date. See SM- 2284941, serials 63 & 64. 174 See 9/22/16 Email, [email protected] IT█ █ █ █ █ █ 175 Ellen Nakashima et al., A German Hacker Offers a Rare Look Inside the Secretive World of Julian Assange and WikiLeaks, Washington Post (Jan. 17, 2018). 176 Investigative Technique█ █ █ █ █ █ 177 Personal Privacy█ █ █ █ █ █ 178 Personal Privacy█ █ █ █ █ █ 179 Netyksho Indictment ¶ 43. 180 @WikiLeaks 8/9/16 Tweet. 181 See Assange: “Murdered DNC Staffer Was ‘Potential’ WikiLeaks Source,” Fox News (Aug. 25, 2016)(containing video of Assange interview by Megyn Kelly). 182 M. Raju & Z. Cohen, A GOP Congressman’s Lonely Quest Defending Julian Assange, CNN (May 23, 2018). 183 “Donald Trump on Russian & Missing Hillary Clinton Emails,” YouTube Channel C-SPAN, Posted 7/27/16, available at https://www.youtube.com/watch?v=3kxG8uJUsWU (starting at 0:41). 184 Investigative Technique█ █ █ █ █ █ 185 Netyksho Indictment ¶ 34; see also SM-2589105-HACK, serial 29 Investigative Technique█ █ █. 186 Netyksho Indictment ¶ 69.

187 Netyksho Indictment ¶ 69; Investigative Technique█ █ █ █ █ █ 188 Investigative Technique█ █ █ █ █ █ 189 Investigative Technique█ █ █ █ █ █ 190 Investigative Technique█ █ █ █ █ █ 191 Netyksho Indictment ¶ 76; Investigative Technique█ █ █ █ █ █ 192 Investigative Technique█ █ █ █ █ █ 193 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 194 See Mahita Gajanan, Julian Assange Timed DNC Email Release for Democratic Convention, Time (July 27, 2016) (quoting the June 12, 2016 television interview). 195 In February 2018, Gates pleaded guilty, pursuant to a plea agreement, to a superseding criminal information charging him with conspiring to defraud and commit multiple offenses (i.e., tax fraud, failure to report foreign bank accounts, and acting as an unregistered agent of a foreign principal) against the United States, as well as making false statements to our Office. Superseding Criminal Information, United States v. Richard W. Gates III, l:17-cr-201 (D.D.C. Feb. 23, 2018), Doc. 195 (“Gates Superseding Criminal Information”); Plea Agreement, United States v. Richard W. Gates III, 1:17-cr-201 (D.D.C. Feb. 23, 2018), Doc. 205 (“Gates Plea Agreement”). Gates has provided information and in-court testimony that the Office has deemed to be reliable. 196 Gates 10/25/18 302, at 1-2. 197 As explained further in Volume I, Section IV.A.8, infra, Manafort entered into a plea agreement with our Office. We determined that he breached the agreement by being untruthful in proffer sessions and before the grand jury (IAEN). We have generally recounted his version of events in this report only when his statements are sufficiently corroborated to be trustworthy; to identify issues on which Manafort’s untruthful responses may themselves be of evidentiary value; or to provide Manafort’s explanations for certain events, even when we were unable to determine whether that explanation was credible. His account appears here principally because it aligns with those of other witnesses. 198 Grand Jury█ █ █ █ █ █ █ █ █ 199 In November 2018, Cohen pleaded guilty pursuant to a plea agreement to a single-count information charging him with making false statements to Congress, in violation of 18 U.S.C. § 1001(a) & (c). He had previously pleaded guilty to several other criminal charges brought by the U.S. Attorney’s Office in the Southern District of New York, after a referral from this Office. In the months leading up to his false-statements guilty plea, Cohen met with our Office on multiple occasions for interviews and provided information that the Office has generally assessed to be reliable and that is included in this report. 200 HOM█ █ █ █ █ █ 201 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

202 Cohen 9/18/18 302, at 10. Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ 203 Gates 10/25/18 302 (serial 241), at 4. 204 Grand Jury█ █ █ █ █ █ █ █ █ 205 Grand Jury█ █ █ █ █ █ █ █ █ 206 Grand Jury█ █ █ █ █ █ █ █ █ 207 Gates 4/10/18 302, at 3; Gates 4/11/18 302, at 1-2 (SM-2180998); Gates 10/25/18 302, at 2. 208 HOM█ █ █ █ █ █ █ █ █ 209 Gates 10/25/18 302 (serial 241), at 4. 210 HOM█ █ █ █ █ █ █ █ █ 211 HOM█ █ █ █ █ █ █ █ █ 212 Corsi first rose to public prominence in August 2004 when he published his book Unfit for Command: Swift Boat Veterans Speak Out Against John Kerry. In the 2008 election cycle, Corsi gained prominence for being a leading proponent of the allegation that Barack Obama was not born in the United States. Corsi told the Office that Donald Trump expressed interest in his writings, and that he spoke with Trump on the phone on at least six occasions. Corsi 9/6/18 302, at 3. 213 Corsi 10/31/18 302, at 2; Grand Jury█ █ █ █ █ █ Corsi was first interviewed on September 6, 2018 at the Special Counsel’s offices in Washington, D.C. He was accompanied by counsel throughout the interview. Corsi was subsequently interviewed on September 17, 2018; September 21, 2018; October 31, 2018; November 1, 2018; and November 2, 2018. Counsel was present for all interviews, and the interviews beginning on September 21, 2018 were conducted pursuant to a proffer agreement that precluded affirmative use of his statements against him in limited circumstances. 214 HOM█ █ █ █ █ █ █ █ █ █ █ █ 215 Corsi 10/31/18 302, at 4. 216 HOM█ █ █ █ █ █ █ █ █ █ █ █ 217 HOM█ █ █ █ █ █ █ █ █ █ █ █ 218 Grand Jury█ █ █ Malloch denied ever communicating with Assange or WikiLeaks, stating that he did not pursue the request to contact Assange because he believed he had no connections to Assange. Grand Jury█ █ █ 219 HOM█ █ █

220 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 221 Grand Jury█ █ █ █ █ █ █ █ █ █ █ ██ █ █ █ █ █ █ █ █ 222 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ 223 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 224 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 225 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 226 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 227 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 228 HOM█ █ █ 229 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 230 Harm to Ongoing Matter█ █ █ █ █ 231 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 232 HOM█ █ █ 233 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 234 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 235 Harm to Ongoing Matter 236 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 237 HOM█ █ █ 238 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 239 Candidate Trump can be heard off camera making graphic statements about women. 240 HOM█ █ █ █ █ █ █ █ █ 241 HOM█ █ █ █ █ █ █ █ █ 242 HOM█ █ █ █ █ █ █ █ █

243 HOM█ █ █ █ █ █ █ █ █ 244 In a later November 2018 interview, Corsi stated Harm to Ongoing Matter█ █ █ █ █ █ █ █ that he believed Malloch was on the call but then focused on other individuals who were on the call- invitation, which Malloch was not. (Separate travel records show that at the time of the call, Malloch was aboard a transatlantic flight). Corsi at one point stated that after WikiLeaks’s release of stolen emails on October 7, 2016, he concluded Malloch had gotten in contact with Assange. Corsi 11/1/18 302, at 6. 245 During the same interview, Corsi also suggested that he may have sent out public tweets because he knew Assange was reading his tweets. Our Office was unable to find evidence of any such tweets. 246 Corsi 9/21/18 302, at 6-7. 247 Corsi 11/1/18 302, at 6. 248 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ 249 Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 250 HOM█ █ █ █ Grand Jury█ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 251 HOM█ █ █ Grand Jury█ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ Harm to Ongoing Matter█ █ █ █ █ █ █ █ █ █ █ 252 9/20/16 Twitter DM, @JasonFishbein to @WikiLeaks; see JF00587 (9/21/16 Messages, PP█ █ █ @jabber.cryptoparty.is & PP█ █ █ @jabber.cryptoparty.is); Fishbein 9/5/18 302, at 4. When interviewed by our Office, Fishbein produced what he claimed to be logs from a chatroom (IAEN) in which the participants discussed U.S. politics; one of the other participants had posted the website and password that Fishbein sent to WikiLeaks. 253 9/20/16 Twitter DM, @WikiLeaks to @DonaldJTrumpJr. 254 TRUMPORG_28_000629-33 (9/21/16 Email, Trump Jr. to Conway et al. (subject “Wikileaks”)). 255 9/21/16 Twitter DM, @DonaldJTrumpJr to @WikiLeaks. 256 10/3/16 Twitter DMs, @DonaldJTrumpJr & @WikiLeaks. 257 At the time, the link took users to a WikiLeaks archive of stolen Clinton Campaign documents. 258 10/12/16 Twitter DM, @WikiLeaks to @DonaldJTrumpJr. 259 @DonaldJTrumpJr 10/14/16 (6:34 a.m.) Tweet. 260 Caputo 5/2/18 302, at 4; Oknyansky 7/13/18 302, at l. 261 Oknyansky 7/13/18 302, at 1-2. 262 Oknyansky 7/13/18 302, at 2.

263 Caputo 5/2/18 302, at 4; Oknyansky 7/13/18 302, at l. 264 Flynn 4/25/18 302, at 5-6; Flynn 5/1/18 302, at 1-3. 265 Flynn 5/1/18 302, at l-3. 266 Flynn 4/25/18 302, at 7; Flynn 5/4/18 302, at 1-2; Flynn 11/29/17 302, at 7-8. 267 Flynn 11/29/17 302, at 7. 268 Szobocsan 3/29/17 302, at 1. 269 12/3/15 Email, Ledeen to Smith. 270 12/3/15 Email, Ledeen to Smith (attachment). 271 12/3/15 Email, Smith to Szobocsan & Safron. 272 Szobocsan 3/29/18 302, at 1. 273 8/31/16 Email, Smith to Smith. 274 8/28/16 Email, Smith to Smith. 275 Incorporation papers of KLS Research LLC, 7/26/17 Grand Jury█ █ █ Szobocsan 3/29/18 302, at 2. 276 Szobocsan 3/29/18 302, at 3. 277 Financial Institution Record of Peter Smith and KLS Research LLC, 10/31/17 █ █ █ █ █ █ █ █ █Grand Jury█ █ █ Sept. 9, 2016). 10/11/16 Email, Smith to Personal Privacy█ █ █ 278 Tait 8/22/17 302, at 3; York 7/12/17 302, at 1-2; York 11/22/17 302, at 1. 279 York 7/13/17 302 (attachment KLS Research, LLC, “Clinton Email Reconnaissance Initiative,” Sept. 9, 2016). 280 The same recruitment document listed Jerome Corsi under “Independent Groups/Organizations/Individuals,” and described him as an “established author and writer from the right on President Obama and Sec. Clinton.” 281 Flynn 11/29/17 302, at 7-8; 10/15/16 Email, Smith to Flynn et al.; 8/28/16 Email, Smith to Smith (bcc: Clovis et al.). 282 9/16/16 Email, Ledeen to Smith. 283 Prince 4/4/18 302, at 4-5. 284 The forensic analysis of Smith’s computer devices found that Smith used an older Apple operating

system that would have preserved that October 2, 2016 creation date when it was downloaded (no matter what day it was in fact downloaded by Smith). See Volume I, Section III.B.3.c, supra. The Office tested this theory in March 2019 by downloading the two files found on Smith’s computer from WikiLeaks’s site using the same Apple operating system on Smith’s computer; both files were successfully downloaded and retained the October 2, 2016 creation date. See SM-2284941 (IAEN), serial 62. 285 10/28/16 Email, Smith to Smith. 286 8/31/16 Email, Smith to Smith. 287 Safron 3/20/18 302, at 3; Szobocsan 3/29/18 302, at 6.

IV. RUSSIAN GOVERNMENT LINKS TO AND CONTACTS WITH THE TRUMP CAMPAIGN The Office identified multiple contacts—“links,” in the words of the Appointment Order—between Trump Campaign officials and individuals with ties to the Russian government. The Office investigated whether those contacts constituted a third avenue of attempted Russian interference with or influence on the 2016 presidential election. In particular, the investigation examined whether these contacts involved or resulted in coordination or a conspiracy with the Trump Campaign and Russia, including with respect to Russia providing assistance to the Campaign in exchange for any sort of favorable treatment in the future. Based on the available information, the investigation did not establish such coordination. This Section describes the principal links between the Trump Campaign and individuals with ties to the Russian government, including some contacts with Campaign officials or associates that have been publicly reported to involve Russian contacts. Each subsection begins with an overview of the Russian contact at issue and then describes in detail the relevant facts, which are generally presented in chronological order, beginning with the early months of the Campaign and extending through the post-election, transition period. A. Campaign Period (September 2015 – November 8, 2016) Russian-government-connected individuals and media entities began showing interest in Trump’s campaign in the months after he announced his 288 candidacy in June 2015. Because Trump’s status as a public figure at the time was attributable in large part to his prior business and entertainment dealings, this Office investigated whether a business contact with Russia-linked individuals and entities during the campaign period—the Trump Tower Moscow project, see Volume I, Section IV.A.1, infra—led to or involved coordination of election assistance. Outreach from individuals with ties to Russia continued in the spring and summer of 2016, when Trump was moving toward—and eventually becoming— the Republican nominee for President. As set forth below, the Office also evaluated a series of links during this period: outreach to two of Trump’s then-

recently named foreign policy advisors, including a representation that Russia had “dirt” on Clinton in the form of thousands of emails (Volume I, Sections IV.A.2 & IV.A.3); dealings with a D.C.-based think tank that specializes in Russia and has connections with its government (Volume I, Section IV.A.4); a meeting at Trump Tower between the Campaign and a Russian lawyer promising dirt on candidate Clinton that was “part of Russia and its government’s support for [Trump]” (Volume I, Section IV.A.5); events at the Republican National Convention (Volume I, Section IV.A.6); post-Convention contacts between Trump Campaign officials and Russia’s ambassador to the United States (Volume I, Section IV.A.7); and contacts through campaign chairman Paul Manafort, who had previously worked for a Russian oligarch and a pro-Russian political party in Ukraine (Volume I, Section IV.A.8). 1. Trump Tower Moscow Project The Trump Organization has pursued and completed projects outside the United States as part of its real estate portfolio. Some projects have involved the acquisition and ownership (through subsidiary corporate structures) of property. In other cases, the Trump Organization has executed licensing deals with real estate developers and management companies, often local to the country where 289 the project was located. Between at least 2013 and 2016, the Trump Organization explored a similar licensing deal in Russia involving the construction of a Trump-branded property in Moscow. The project, commonly referred to as a “Trump Tower Moscow” or “Trump Moscow” project, anticipated a combination of commercial, hotel, and residential properties all within the same building. Between 2013 and June 2016, several employees of the Trump Organization, including then-president of the organization Donald J. Trump, pursued a Moscow deal with several Russian counterparties. From the fall of 2015 until the middle of 2016, Michael Cohen spearheaded the Trump Organization’s pursuit of a Trump Tower Moscow project, including by reporting on the project’s status to candidate Trump and 290 other executives in the Trump Organization. a. Trump Tower Moscow Venture with the Crocus Group (2013-2014) The Trump Organization and the Crocus Group, a Russian real estate conglomerate owned and controlled by Aras Agalarov, began discussing a

Russia-based real estate project shortly after the conclusion of the 2013 Miss 291 Universe pageant in Moscow. Donald J. Trump Jr. served as the primary negotiator on behalf of the Trump Organization; Emin Agalarov (son of Aras Agalarov) and Irakli “Ike” Kaveladze represented the Crocus Group during 292 293 negotiations, with the occasional assistance of Robert Goldstone. In December 2013, Kaveladze and Trump Jr. negotiated and signed 294 preliminary terms of an agreement for the Trump Tower Moscow project. On December 23, 2013, after discussions with Donald J. Trump, the Trump Organization agreed to accept an arrangement whereby the organization received 295 a flat 3.5% commission on all sales, with no licensing fees or incentives. The 296 parties negotiated a letter of intent during January and February 2014. From January 2014 through November 2014, the Trump Organization and Crocus Group discussed development plans for the Moscow project. Some time before January 24, 2014, the Crocus Group sent the Trump Organization a proposal for a 800-unit, 194-meter building to be constructed at an Agalarov- owned site in Moscow called “Crocus City,” which had also been the site of the 297 Miss Universe pageant. In February 2014, Ivanka Trump met with Emin 298 Agalarov and toured the Crocus City site during a visit to Moscow. From March 2014 through July 2014, the groups discussed “design standards” and 299 other architectural elements. For example, in July 2014, members of the Trump Organization sent Crocus Group counterparties questions about the “demographics of these prospective buyers” in the Crocus City area, the development of neighboring parcels in Crocus City, and concepts for redesigning 300 portions of the building. In August 2014, the Trump Organization requested specifications for a competing Marriott-branded tower being built in Crocus 301 City. Beginning in September 2014, the Trump Organization stopped responding 302 in a timely fashion to correspondence and proposals from the Crocus Group. Communications between the two groups continued through November 2014 with decreasing frequency; what appears to be the last communication is dated 303 November 24, 2014. The project appears not to have developed past the planning stage, and no construction occurred.

b. Communications with I.C. Expert Investment Company and Giorgi Rtskhiladze (Summer and Fall 2015) In the late summer of 2015, the Trump Organization received a new inquiry about pursuing a Trump Tower project in Moscow. In approximately September 2015, Felix Sater, a New York-based real estate advisor, contacted Michael Cohen, then-executive vice president of the Trump Organization and special 304 counsel to Donald J. Trump. Sater had previously worked with the Trump Organization and advised it on a number of domestic and international projects. Sater had explored the possibility of a Trump Tower project in Moscow while working with the Trump Organization and therefore knew of the organization’s 305 general interest in completing a deal there. Sater had also served as an informal agent of the Trump Organization in Moscow previously and had accompanied Ivanka Trump and Donald Trump Jr. to Moscow in the mid- 306 2000s. Sater contacted Cohen on behalf of I.C. Expert Investment Company (I.C. Expert), a Russian real-estate development corporation controlled by Andrei 307 Vladimirovich Rozov. Sater had known Rozov since approximately 2007 and, in 2014, had served as an agent on behalf of Rozov during Rozov’s 308 purchase of a building in New York City. Sater later contacted Rozov and proposed that I.C. Expert pursue a Trump Tower Moscow project in which I.C. Expert would license the name and brand from the Trump Organization but construct the building on its own. Sater worked on the deal with Rozov and 309 another employee of I.C. Expert. Cohen was the only Trump Organization representative to negotiate directly with I.C. Expert or its agents. In approximately September 2015, Cohen obtained approval to negotiate with I.C. Expert from candidate Trump, who was then president of the Trump Organization. Cohen provided updates directly to Trump about the project throughout 2015 and into 2016, assuring him the project was 310 continuing. Cohen also discussed the Trump Moscow project with Ivanka Trump as to design elements (such as possible architects to use for the 311 project ) and Donald J. Trump Jr. (about his experience in Moscow and 312 possible involvement in the project ) during the fall of 2015.

Also during the fall of 2015, Cohen communicated about the Trump Moscow proposal with Giorgi Rtskhiladze, a business executive who previously had been involved in a development deal with the Trump Organization in 313 Batumi, Georgia. Cohen stated that he spoke to Rtskhiladze in part because Rtskhiladze had pursued business ventures in Moscow, including a licensing 314 deal with the Agalarov-owned Crocus Group. On September 22, 2015, Cohen forwarded a preliminary design study for the Trump Moscow project to Rtskhiladze, adding “I look forward to your reply about this spectacular project in Moscow.” Rtskhiladze forwarded Cohen’s email to an associate and wrote, “[i]f we could organize the meeting in New York at the highest level of the Russian Government and Mr. Trump this project would definitely receive the 315 worldwide attention.” On September 24, 2015, Rtskhiladze sent Cohen an attachment that he described as a proposed “[l]etter to the Mayor of Moscow from Trump org,” explaining that “[w]e need to send this letter to the Mayor of Moscow (second guy in Russia) he is aware of the potential project and will pledge his 316 support.” In a second email to Cohen sent the same day, Rtskhiladze provided a translation of the letter, which described the Trump Moscow project as a “symbol of stronger economic, business and cultural relationships between New York and Moscow and therefore United States and the Russian 317 Federation.” On September 27, 2015, Rtskhiladze sent another email to Cohen, proposing that the Trump Organization partner on the Trump Moscow project with “Global Development Group LLC,” which he described as being 318 controlled by Michail Posikhin, a Russian architect, and Simon Nizharadze. Cohen told the Office that he ultimately declined the proposal and instead 319 continued to work with I.C. Expert, the company represented by Felix Sater. c. Letter of Intent and Contacts to Russian Government (October 2015- January 2016) i. Trump Signs the Letter of Intent on behalf of the Trump Organization Between approximately October 13, 2015 and November 2, 2015, the Trump Organization (through its subsidiary Trump Acquisition, LLC) and I.C.

Expert completed a letter of intent (LOI) for a Trump Moscow property. The LOI, signed by Trump for the Trump Organization and Rozov on behalf of I.C. Expert, was “intended to facilitate further discussions” in order to “attempt to enter into a mutually acceptable agreement” related to the Trump-branded 320 project in Moscow. The LOI contemplated a development with residential, hotel, commercial, and office components, and called for “[a]pproximately 250 first class, luxury residential condominiums,” as well as “[o]ne first class, luxury hotel consisting of approximately 15 floors and containing not fewer than 150 321 hotel rooms.” For the residential and commercial portions of the project, the Trump Organization would receive between 1% and 5% of all condominium 322 323 sales, plus 3% of all rental and other revenue. For the project’s hotel portion, the Trump Organization would receive a base fee of 3% of gross operating revenues for the first five years and 4% thereafter, plus a separate 324 incentive fee of 20% of operating profit. Under the LOI, the Trump Organization also would receive a $4 million “up-front fee” prior to 325 groundbreaking. Under these terms, the Trump Organization stood to earn substantial sums over the lifetime of the project, without assuming significant 326 liabilities or financing commitments. On November 3, 2015, the day after the Trump Organization transmitted the LOI, Sater emailed Cohen suggesting that the Trump Moscow project could be used to increase candidate Trump’s chances at being elected, writing: Buddy our boy can become President of the USA and we can engineer it. I will get all of Putins team to buy in on this, I will manage this process. . . . Michael, Putin gets on stage with Donald for a ribbon cutting for Trump Moscow, and Donald owns the republican nomination. And possibly beats Hillary and our boy is in. . . . We will manage this process better than anyone. You and I will get Donald and Vladimir on a 327 stage together very shortly. That the game changer. Later that day, Sater followed up: Donald doesn’t stare down, he negotiates and understands the economic issues and Putin only want to deal with a pragmatic leader, and a successful business man is a good candidate for someone who knows how to negotiate. “Business, politics, whatever it all is the same for

someone who knows how to deal” I think I can get Putin to say that at the Trump Moscow press conference. If he says it we own this election. Americas most difficult adversary agreeing that Donald is a good guy to negotiate. . . . We can own this election. Michael my next steps are very sensitive with Putins very very close people, we can pull this off. Michael lets go. 2 boys from Brooklyn getting a USA president elected. 328 This is good really good. According to Cohen, he did not consider the political import of the Trump Moscow project to the 2016 U.S. presidential election at the time. Cohen also did not recall candidate Trump or anyone affiliated with the Trump Campaign discussing the political implications of the Trump Moscow project with him. However, Cohen recalled conversations with Trump in which the candidate suggested that his campaign would be a significant “infomercial” for Trump- 329 branded properties. ii. Post-LOI Contacts with Individuals in Russia Given the size of the Trump Moscow project, Sater and Cohen believed the project required approval (whether express or implicit) from the Russian national 330 government, including from the Presidential Administration of Russia. Sater stated that he therefore began to contact the Presidential Administration through 331 another Russian business contact. In early negotiations with the Trump Organization, Sater had alluded to the need for government approval and his attempts to set up meetings with Russian officials. On October 12, 2015, for example, Sater wrote to Cohen that “all we need is Putin on board and we are golden,” and that a “meeting with Putin and top deputy is tentatively set for the 332 14th [of October]. ” Grand Jury█ █ █ █ █ █ this meeting was being coordinated by associates in Russia and that he had no direct interaction with the 333 Russian government. Approximately a month later, after the LOI had been signed, Lana Erchova emailed Ivanka Trump on behalf of Erchova’s then-husband Dmitry Klokov, to 334 offer Klokov’s assistance to the Trump Campaign. Klokov was at that time

Director of External Communications for PJSC Federal Grid Company of Unified Energy System, a large Russian electricity transmission company, and had been previously employed as an aide and press secretary to Russia’s energy 335 minister. Ivanka Trump forwarded the email to Cohen. He told the Office that, after receiving this inquiry, he had conducted an internet search for Klokov’s name and concluded (incorrectly) that Klokov was a former Olympic 336 weightlifter. Between November 18 and 19, 2015, Klokov and Cohen had at least one telephone call and exchanged several emails. Describing himself in emails to Cohen as a “trusted person” who could offer the Campaign “political synergy” and “synergy on a government level,” Klokov recommended that Cohen travel to Russia to speak with him and an unidentified intermediary. Klokov said that those conversations could facilitate a later meeting in Russia between the 337 candidate and an individual Klokov described as “our person of interest.” In an email to the Office, Erchova later identified the “person of interest” as 338 Russian President Vladimir Putin. In the telephone call and follow-on emails with Klokov, Cohen discussed his desire to use a near-term trip to Russia to do site surveys and talk over the Trump Moscow project with local developers. Cohen registered his willingness also to meet with Klokov and the unidentified intermediary, but was emphatic that all meetings in Russia involving him or candidate Trump—including a possible meeting between candidate Trump and Putin—would need to be “in conjunction with the development and an official visit” with the Trump Organization 339 receiving a formal invitation to visit. (Klokov had written previously that 340 “the visit [by candidate Trump to Russia] has to be informal.”) Klokov had also previously recommended to Cohen that he separate their negotiations over a possible meeting between Trump and “the person of interest” 341 from any existing business track. Re-emphasizing that his outreach was not done on behalf of any business, Klokov added in second email to Cohen that, if publicized well, such a meeting could have “phenomenal” impact “in a business dimension” and that the “person of interest[’s]” “most important support” could have significant ramifications for the “level of projects and their capacity.” Klokov concluded by telling Cohen that there was “no bigger warranty in any 342 project than [the] consent of the person of interest.” Cohen rejected the

proposal, saying that “[c]urrently our LOI developer is in talks with VP’s Chief 343 of Staff and arranging a formal invite for the two to meet.” This email appears to be their final exchange, and the investigation did not identify evidence that Cohen brought Klokov’s initial offer of assistance to the Campaign’s attention or that anyone associated with the Trump Organization or the Campaign dealt with Klokov at a later date. Cohen explained that he did not pursue the proposed meeting because he was already working on the Moscow Project with Sater, who Cohen understood to have his own connections to the 344 Russian government. By late December 2015, however, Cohen was complaining that Sater had not been able to use those connections to set up the promised meeting with Russian government officials. Cohen told Sater that he was “setting up the 345 meeting myself.” On January 11, 2016, Cohen emailed the office of Dmitry Peskov, the Russian government’s press secretary, indicating that he desired contact with Sergei Ivanov, Putin’s chief of staff. Cohen erroneously used the email address “[email protected]” instead of 346 “[email protected],” so the email apparently did not go through. On January 14, 2016, Cohen emailed a different address ([email protected]) with the following message: Dear Mr. Peskov, Over the past few months, I have been working with a company based in Russia regarding the development of a Trump Tower-Moscow project in Moscow City. Without getting into lengthy specifics, the communication between our two sides has stalled. As this project is too important, I am hereby requesting your assistance. I respectfully request someone, preferably you; contact me so that I might discuss the specifics as well as arranging meetings with the appropriate individuals. I thank you in advance for your assistance and look forward to hearing 347 from you soon. Two days later, Cohen sent an email to [email protected], repeating 348 his request to speak with Sergei Ivanov.

Cohen testified to Congress, and initially told the Office, that he did not recall receiving a response to this email inquiry and that he decided to terminate any further work on the Trump Moscow project as of January 2016. Cohen later admitted that these statements were false. In fact, Cohen had received (and recalled receiving) a response to his inquiry, and he continued to work on and 349 update candidate Trump on the project through as late as June 2016. On January 20, 2016, Cohen received an email from Elena Poliakova, Peskov’s personal assistant. Writing from her personal email account, Poliakova stated that she had been trying to reach Cohen and asked that he call her on the 350 personal number that she provided. Shortly after receiving Poliakova’s email, 351 Cohen called and spoke to her for 20 minutes. Cohen described to Poliakova his position at the Trump Organization and outlined the proposed Trump Moscow project, including information about the Russian counterparty with which the Trump Organization had partnered. Cohen requested assistance in moving the project forward, both in securing land to build the project and with financing. According to Cohen, Poliakova asked detailed questions and took 352 notes, stating that she would need to follow up with others in Russia. Cohen could not recall any direct follow-up from Poliakova or from any other representative of the Russian government, nor did the Office identify any evidence of direct follow-up. However, the day after Cohen’s call with Poliakova, Sater texted Cohen, asking him to “[c]all me when you have a few 353 minutes to chat . . . It’s about Putin they called today.” Sater then sent a draft 354 invitation for Cohen to visit Moscow to discuss the Trump Moscow project, along with a note to “[t]ell me if the letter is good as amended by me or make 355 whatever changes you want and send it back to me.” After a further round of edits, on January 25, 2016, Sater sent Cohen an invitation—signed by Andrey Ryabinskiy of the company MHJ—to travel to “Moscow for a working visit” about the “prospects of development and the construction business in Russia,” “the various land plots available suited for construction of this enormous Tower,” and “the opportunity to co-ordinate a follow up visit to Moscow by Mr. 356 Donald Trump.” According to Cohen, he elected not to travel at the time because of concerns about the lack of concrete proposals about land plots that 357 could be considered as options for the project.

d. Discussions about Russia Travel by Michael Cohen or Candidate Trump (December 2015-June 2016) i. Sater’s Overtures to Cohen to Travel to Russia The late January communication was neither the first nor the last time that Cohen contemplated visiting Russia in pursuit of the Trump Moscow project. Beginning in late 2015, Sater repeatedly tried to arrange for Cohen and candidate Trump, as representatives of the Trump Organization, to travel to Russia to meet with Russian government officials and possible financing partners. In December 2015, Sater sent Cohen a number of emails about logistics 358 for traveling to Russia for meetings. On December 19, 2015, Sater wrote: 359 Please call me I have Evgeney [Dvoskin] on the other line. [ ] He needs a copy of your and Donald’s passports they need a scan of every page of the passports. Invitations & Visas will be issued this week by VTB Bank to discuss financing for Trump Tower Moscow. Politically neither Putins office nor Ministry of Foreign Affairs cannot issue invite, so they are inviting commercially/ business. VTB is Russia’s 2 biggest bank and VTB Bank CEO Andrey Kostin, will be at all meetings with Putin so that it is a business meeting not political. We will be invited to 360 Russian consulate this week to receive invite & have visa issued. 361 In response, Cohen texted Sater an image of his own passport. Cohen told the Office that at one point he requested a copy of candidate Trump’s passport from Rhona Graff, Trump’s executive assistant at the Trump Organization, and 362 that Graff later brought Trump’s passport to Cohen’s office. The investigation did not, however, establish that the passport was forwarded to 363 Sater. Into the spring of 2016, Sater and Cohen continued to discuss a trip to Moscow in connection with the Trump Moscow project. On April 20, 2016, 364 Sater wrote Cohen, “[t]he People wanted to know when you are coming?” On May 4, 2016, Sater followed up: I had a chat with Moscow. ASSUMING the trip does happen the question

is before or after the convention. I said I believe, but don’t know for sure, that’s it’s probably after the convention. Obviously the pre-meeting trip (you only) can happen anytime you want but the 2 big guys where [sic] the question. I said I would confirm and revert. . . . Let me know about If I was right by saying I believe after Cleveland and also when you want to 365 speak to them and possibly fly over. Cohen responded, “My trip before Cleveland. Trump once he becomes the 366 nominee after the convention.” The day after this exchange, Sater tied Cohen’s travel to Russia to the St. Petersburg International Economic Forum (“Forum”), an annual event attended by prominent Russian politicians and businessmen. Sater told the Office that he was informed by a business associate that Peskov wanted to invite Cohen to the 367 Forum. On May 5, 2016, Sater wrote to Cohen: Peskov would like to invite you as his guest to the St. Petersburg Forum which is Russia’s Davos it’s June 16-19. He wants to meet there with you and possibly introduce you to either Putin or Medvedev, as they are not sure if 1 or both will be there. This is perfect. The entire business class of Russia will be there as well. He said anything you want to discuss including dates and subjects are on the 368 table to discuss[.] The following day, Sater asked Cohen to confirm those dates would work for 369 him to travel; Cohen wrote back, “[w]orks for me.” On June 9, 2016, Sater sent Cohen a notice that he (Sater) was completing the badges for the Forum, adding, “Putin is there on the 17th very strong chance 370 you will meet him as well.” On June 13, 2016, Sater forwarded Cohen an invitation to the Forum signed by the Director of the Roscongress Foundation, 371 the Russian entity organizing the Forum. Sater also sent Cohen a Russian 372 visa application and asked him to send two passport photos. According to Cohen, the invitation gave no indication that Peskov had been involved in inviting him. Cohen was concerned that Russian officials were not actually involved or were not interested in meeting with him (as Sater had alleged), and 373 so he decided not to go to the Forum. On June 14, 2016, Cohen met Sater in

the lobby of the Trump Tower in New York and informed him that he would not 374 be traveling at that time. ii. Candidate Trump’s Opportunities to Travel to Russia The investigation identified evidence that, during the period the Trump Moscow project was under consideration, the possibility of candidate Trump visiting Russia arose in two contexts. First, in interviews with the Office, Cohen stated that he discussed the subject of traveling to Russia with Trump twice: once in late 2015; and again in 375 spring 2016. According to Cohen, Trump indicated a willingness to travel if it would assist the project significantly. On one occasion, Trump told Cohen to speak with then-campaign manager Corey Lewandowski to coordinate the candidate’s schedule. Cohen recalled that he spoke with Lewandowski, who suggested that they speak again when Cohen had actual dates to evaluate. Cohen indicated, however, that he knew that travel prior to the Republican National Convention would be impossible given the candidate’s preexisting commitments 376 to the Campaign. Second, like Cohen, Trump received and turned down an invitation to the St. Petersburg International Economic Forum. In late December 2015, Mira Duma —a contact of Ivanka Trump’s from the fashion industry—first passed along invitations for Ivanka Trump and candidate Trump from Sergei Prikhodko, a 377 Deputy Prime Minister of the Russian Federation. On January 14, 2016, Rhona Graff sent an email to Duma stating that Trump was “honored to be asked to participate in the highly prestigious” Forum event, but that he would “have to decline” the invitation given his “very grueling and full travel schedule” as a 378 presidential candidate. Graff asked Duma whether she recommended that Graff “send a formal note to the Deputy Prime Minister” declining his invitation; 379 Duma replied that a formal note would be “great.” It does not appear that Graff prepared that note immediately. According to 380 written answers from President Trump, Graff received an email from Deputy Prime Minister Prikhodko on March 17, 2016, again inviting Trump to 381 participate in the 2016 Forum in St. Petersburg. Two weeks later, on March

31, 2016, Graff prepared for Trump’s signature a two-paragraph letter declining 382 the invitation. The letter stated that Trump’s “schedule has become extremely demanding” because of the presidential campaign, that he “already ha[d] several commitments in the United States” for the time of the Forum, but that he otherwise “would have gladly given every consideration to attending such an 383 important event.” Graff forwarded the letter to another executive assistant at the Trump Organization with instructions to print the document on letterhead for 384 Trump to sign. At approximately the same time that the letter was being prepared, Robert Foresman—a New York-based investment banker—began reaching out to Graff to secure an in-person meeting with candidate Trump. According to Foresman, he had been asked by Anton Kobyakov, a Russian presidential aide involved 385 with the Roscongress Foundation, to see if Trump could speak at the Forum. Foresman first emailed Graff on March 31, 2016, following a phone introduction brokered through Trump business associate Mark Burnett (who produced the television show The Apprentice). In his email, Foresman referenced his long- standing personal and professional expertise in Russia and Ukraine, his work setting up an early “private channel” between Vladimir Putin and former U.S. President George W. Bush, and an “approach” he had received from “senior Kremlin officials” about the candidate. Foresman asked Graff for a meeting with the candidate, Corey Lewandowski, or “another relevant person” to discuss this and other “concrete things” Foresman felt uncomfortable discussing over 386 “unsecure email.” On April 4, 2016, Graff forwarded Foresman’s meeting 387 request to Jessica Macchia, another executive assistant to Trump. With no response forthcoming, Foresman twice sent reminders to Graff— 388 first on April 26 and again on April 30, 2016. Graff sent an apology to Foresman and forwarded his April 26 email (as well as his initial March 2016 389 email) to Lewandowski. On May 2, 2016, Graff forwarded Foresman’s April 30 email—which suggested an alternative meeting with Donald Trump Jr. or Eric Trump so that Foresman could convey to them information that “should be conveyed to [the candidate] personally or [to] someone [the candidate] 390 absolutely trusts”—to policy advisor Stephen Miller. No communications or other evidence obtained by the Office indicate that

the Trump Campaign learned that Foresman was reaching out to invite the candidate to the Forum or that the Campaign otherwise followed up with Foresman until after the election, when he interacted with the Transition Team as 391 he pursued a possible position in the incoming Administration. When interviewed by the Office, Foresman denied that the specific “approach” from “senior Kremlin officials” noted in his March 31, 2016 email was anything other than Kobyakov’s invitation to Roscongress. According to Foresman, the “concrete things” he referenced in the same email were a combination of the invitation itself, Foresman’s personal perspectives on the invitation and Russia policy in general, and details of a Ukraine plan supported by a U.S. think tank (EastWest Institute). Foresman told the Office that Kobyakov had extended similar invitations through him to another Republican presidential candidate and one other politician. Foresman also said that Kobyakov had asked Foresman to invite Trump to speak after that other presidential candidate withdrew from the 392 race and the other politician’s participation did not work out. Finally, Foresman claimed to have no plans to establish a back channel involving Trump, stating the reference to his involvement in the Bush-Putin back channel was meant to burnish his credentials to the Campaign. Foresman commented that he had not recognized any of the experts announced as Trump’s foreign policy team in March 2016, and wanted to secure an in-person meeting with the candidate to share his professional background and policy views, including that Trump 393 should decline Kobyakov’s invitation to speak at the Forum. 2. George Papadopoulos George Papadopoulos was a foreign policy advisor to the Trump Campaign 394 from March 2016 to early October 2016. In late April 2016, Papadopoulos was told by London-based professor Joseph Mifsud, immediately after Mifsud’s return from a trip to Moscow, that the Russian government had obtained “dirt” on candidate Clinton in the form of thousands of emails. One week later, on May 6, 2016, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information that would be damaging to candidate Clinton. Papadopoulos shared information about Russian “dirt” with people outside of the Campaign, and the Office investigated whether he also provided it to a Campaign official. Papadopoulos and the Campaign officials with whom he

interacted told the Office that they did not recall that Papadopoulos passed them the information. Throughout the relevant period of time and for several months thereafter, Papadopoulos worked with Mifsud and two Russian nationals to arrange a meeting between the Campaign and the Russian government. That meeting never came to pass. a. Origins of Campaign Work In March 2016, Papadopoulos became a foreign policy advisor to the Trump 395 Campaign. As early as the summer of 2015, he had sought a role as a policy advisor to the Campaign but, in a September 30, 2015 email, he was told that the 396 Campaign was not hiring policy advisors. In late 2015, Papadopoulos obtained a paid position on the campaign of Republican presidential candidate 397 Ben Carson. Although Carson remained in the presidential race until early March 2016, Papadopoulos had stopped actively working for his campaign by early February 398 2016. At that time, Papadopoulos reached out to a contact at the London Centre of International Law Practice (LCILP), which billed itself as a “unique institution . . . comprising high-level professional international law practitioners, dedicated to the advancement of global legal knowledge and the practice of 399 international law.” Papadopoulos said that he had finished his role with the 400 Carson campaign and asked if LCILP was hiring. In early February, 401 Papadopoulos agreed to join LCILP and arrived in London to begin work. As he was taking his position at LCILP, Papadopoulos contacted Trump campaign manager Corey Lewandowski via LinkedIn and emailed campaign 402 official Michael Glassner about his interest in joining the Trump Campaign. On March 2, 2016, Papadopoulos sent Glassner another message reiterating his 403 interest. Glassner passed along word of Papadopoulos’s interest to another campaign official, Joy Lutes, who notified Papadopoulos by email that she had been told by Glassner to introduce Papadopoulos to Sam Clovis, the Trump 404 Campaign’s national co-chair and chief policy advisor. At the time of Papadopoulos’s March 2 email, the media was criticizing the Trump Campaign for lack of experienced foreign policy or national security

405 advisors within its ranks. To address that issue, senior Campaign officials 406 asked Clovis to put a foreign policy team together on short notice. After receiving Papadopoulos’s name from Lutes, Clovis performed a Google search on Papadopoulos, learned that he had worked at the Hudson Institute, and 407 believed that he had credibility on energy issues. On March 3, 2016, Clovis arranged to speak with Papadopoulos by phone to discuss Papadopoulos joining the Campaign as a foreign policy advisor, and on March 6, 2016, the two 408 spoke. Papadopoulos recalled that Russia was mentioned as a topic, and he understood from the conversation that Russia would be an important aspect of 409 the Campaign’s foreign policy. At the end of the conversation, Clovis offered Papadopoulos a role as a foreign policy advisor to the Campaign, and 410 Papadopoulos accepted the offer. b. Initial Russia-Related Contacts Approximately a week after signing on as a foreign policy advisor, 411 Papadopoulos traveled to Rome, Italy, as part of his duties with LCILP. The purpose of the trip was to meet officials affiliated with Link Campus University, 412 a for-profit institution headed by a former Italian government official. During the visit, Papadopoulos was introduced to Joseph Mifsud. Mifsud is a Maltese national who worked as a professor at the London 413 Academy of Diplomacy in London, England. Although Mifsud worked out of London and was also affiliated with LCILP, the encounter in Rome was the 414 first time that Papadopoulos met him. Mifsud maintained various Russian contacts while living in London, as described further below. Among his contacts 415 was IT█ █ █ █ █ █, a one-time employee of the IRA, the entity that carried out the Russian social media campaign (see Volume I, Section II, supra). In January and February 2016, Mifsud and IT█ █ █ █ █ █ discussed IT█ █ █ █ █ █ possibly meeting in Russia. The investigation did not identify evidence of them meeting. Later, in the spring of 2016, IT█ █ █ █ █ █ was also in contact IT█ █ █ █ █ █ that was linked to an employee of the Russian Ministry of Defense, and that account had overlapping contacts with a group of Russian military-controlled Facebook accounts that included accounts used to promote the DCLeaks releases in the course of the GRU’s hack-and-release operations

(see Volume I, Section III.B.1, supra). According to Papadopoulos, Mifsud at first seemed uninterested in 416 Papadopoulos when they met in Rome. After Papadopoulos informed Mifsud about his role in the Trump Campaign, however, Mifsud appeared to take greater 417 interest in Papadopoulos. The two discussed Mifsud’s European and Russian contacts and had a general discussion about Russia; Mifsud also offered to introduce Papadopoulos to European leaders and others with contacts to the 418 Russian government. Papadopoulos told the Office that Mifsud’s claim of substantial connections with Russian government officials interested Papadopoulos, who thought that such connections could increase his importance 419 as a policy advisor to the Trump Campaign. 420 On March 17, 2016, Papadopoulos returned to London. Four days later, candidate Trump publicly named him as a member of the foreign policy and national security advisory team chaired by Senator Jeff Sessions, describing 421 Papadopoulos as “an oil and energy consultant” and an “[e]xcellent guy.” 422 On March 24, 2016, Papadopoulos met with Mifsud in London. Mifsud was accompanied by a Russian female named Olga Polonskaya. Mifsud introduced Polonskaya as a former student of his who had connections to 423 Vladimir Putin. Papadopoulos understood at the time that Polonskaya may 424 have been Putin’s niece but later learned that this was not true. During the meeting, Polonskaya offered to help Papadopoulos establish contacts in Russia 425 and stated that the Russian ambassador in London was a friend of hers. Based on this interaction, Papadopoulos expected Mifsud and Polonskaya to 426 introduce him to the Russian ambassador in London, but that did not occur. Following his meeting with Mifsud, Papadopoulos sent an email to members of the Trump Campaign’s foreign policy advisory team. The subject line of the 427 message was “Meeting with Russian leadership--including Putin.” The message stated in pertinent part: I just finished a very productive lunch with a good friend of mine, Joseph Mifsud, the director of the London Academy of Diplomacy--who introduced me to both Putin’s niece and the Russian Ambassador in

428 London--who also acts as the Deputy Foreign Minister. The topic of the lunch was to arrange a meeting between us and the Russian leadership to discuss U.S.-Russia ties under President Trump. They are keen to host us in a “neutral” city, or directly in Moscow. They said the leadership, including Putin, is ready to meet with us and Mr. Trump should there be interest. Waiting for everyone’s thoughts on 429 moving forward with this very important issue. Papadopoulos’s message came at a time when Clovis perceived a shift in the Campaign’s approach toward Russia—from one of engaging with Russia through the NATO framework and taking a strong stance on Russian aggression in Ukraine, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 430 █ █ Clovis’s response to Papadopoulos, however, did not reflect that shift. Replying to Papadopoulos and the other members of the foreign policy advisory team copied on the initial email, Clovis wrote: This is most informative. Let me work it through the campaign. No commitments until we see how this plays out. My thought is that we probably should not go forward with any meetings with the Russians until we have had occasion to sit with our NATO allies, especially France, Germany and Great Britain. We need to reassure our allies that we are not going to advance anything with Russia until we have everyone on the same page. 431 More thoughts later today. Great work. c. March 31 Foreign Policy Team Meeting The Campaign held a meeting of the foreign policy advisory team with Senator Sessions and candidate Trump approximately one week later, on March 432 31, 2016, in Washington, D.C. The meeting—which was intended to 433 generate press coverage for the Campaign —took place at the Trump 434 International Hotel. Papadopoulos flew to Washington for the event. At the meeting, Senator Sessions sat at one end of an oval table, while Trump sat at the

other. As reflected in the photograph below (which was posted to Trump’s Instagram account), Papadopoulos sat between the two, two seats to Sessions’s left: March 31, 2016 Meeting of Foreign Policy Team, with Papadopoulos (Fourth from Right of Candidate Trump) During the meeting, each of the newly announced foreign policy advisors introduced themselves and briefly described their areas of experience or 435 expertise. Papadopoulos spoke about his previous work in the energy sector 436 and then brought up a potential meeting with Russian officials. Specifically, Papadopoulos told the group that he had learned through his contacts in London that Putin wanted to meet with candidate Trump and that these connections could 437 help arrange that meeting. Trump and Sessions both reacted to Papadopoulos’s statement. Papadopoulos and Campaign advisor J.D. Gordon—who told investigators in an interview that he had a “crystal clear” recollection of the meeting—have stated that Trump was interested in and receptive to the idea of a meeting with 438 Putin. Papadopoulos understood Sessions to be similarly supportive of his 439 efforts to arrange a meeting. Gordon and two other attendees, however, recall that Sessions generally opposed the proposal, though they differ in their accounts 440 of the concerns he voiced or the strength of the opposition he expressed.

d. George Papadopoulos Learns That Russia Has “Dirt” in the Form of Clinton Emails Whatever Sessions’s precise words at the March 31 meeting, Papadopoulos did not understand Sessions or anyone else in the Trump Campaign to have directed that he refrain from making further efforts to arrange a meeting between the Campaign and the Russian government. To the contrary, Papadopoulos told the Office that he understood the Campaign to be supportive of his efforts to 441 arrange such a meeting. Accordingly, when he returned to London, 442 Papadopoulos resumed those efforts. Throughout April 2016, Papadopoulos continued to correspond with, meet 443 with, and seek Russia contacts through Mifsud and, at times, Polonskaya. For example, within a week of her initial March 24 meeting with him, Polonskaya attempted to send Papadopoulos a text message—which email exchanges show to have been drafted or edited by Mifsud—addressing 444 Papadopoulos’s “wish to engage with the Russian Federation.” When Papadopoulos learned from Mifsud that Polonskaya had tried to message him, he 445 sent her an email seeking another meeting. Polonskaya responded the next day that she was “back in St. Petersburg” but “would be very pleased to support [Papadopoulos’s] initiatives between our two countries” and “to meet [him] 446 again.” Papadopoulos stated in reply that he thought “a good step” would be to introduce him to “the Russian Ambassador in London,” and that he would like to talk to the ambassador, “or anyone else you recommend, about a potential 447 foreign policy trip to Russia.” Mifsud, who had been copied on the email exchanges, replied on the morning of April 11, 2016. He wrote, “This is already been agreed. I am flying to Moscow on the 18th for a Valdai meeting, plus other meetings at the Duma. 448 We will talk tomorrow.” The two bodies referenced by Mifsud are part of or associated with the Russian government: the Duma is a Russian legislative 449 assembly, while “Valdai” refers to the Valdai Discussion Club, a Moscow- 450 based group that “is close to Russia’s foreign-policy establishment.” 451 Papadopoulos thanked Mifsud and said that he would see him “tomorrow.” For her part, Polonskaya responded that she had “already alerted my personal

links to our conversation and your request,” that “we are all very excited the possibility of a good relationship with Mr. Trump,” and that “[t]he Russian Federation would love to welcome him once his candidature would be officially 452 announced.” Papadopoulos’s and Mifsud’s mentions of seeing each other “tomorrow” referenced a meeting that the two had scheduled for the next morning, April 12, 2016, at the Andaz Hotel in London. Papadopoulos acknowledged the meeting 453 during interviews with the Office, and records from Papadopoulos’s UK cellphone and his internet-search history all indicate that the meeting took 454 place. 455 Following the meeting, Mifsud traveled as planned to Moscow. On April 18, 2016, while in Russia, Mifsud introduced Papadopoulos over email to Ivan 456 Timofeev, a member of the Russian International Affairs Council (RIAC). Mifsud had described Timofeev as having connections with the Russian Ministry 457 of Foreign Affairs (MFA), the executive entity in Russia responsible for 458 Russian foreign relations. Over the next several weeks, Papadopoulos and Timofeev had multiple conversations over Skype and email about setting “the groundwork” for a “potential” meeting between the Campaign and Russian 459 government officials. Papadopoulos told the Office that, on one Skype call, he believed that his conversation with Timofeev was being monitored or supervised by an unknown third party, because Timofeev spoke in an official 460 manner and Papadopoulos heard odd noises on the line. Timofeev also told Papadopoulos in an April 25, 2016 email that he had just spoken “to Igor Ivanov[,] the President of RIAC and former Foreign Minister of Russia,” and 461 conveyed Ivanov’s advice about how best to arrange a “Moscow visit.” 462 After a stop in Rome, Mifsud returned to England on April 25, 2016. The next day, Papadopoulos met Mifsud for breakfast at the Andaz Hotel (the 463 same location as their last meeting). During that meeting, Mifsud told Papadopoulos that he had met with high-level Russian government officials during his recent trip to Moscow. Mifsud also said that, on the trip, he learned that the Russians had obtained “dirt” on candidate Hillary Clinton. As Papadopoulos later stated to the FBI, Mifsud said that the “dirt” was in the form

464 of “emails of Clinton,” and that they “have thousands of emails.” On May 6, 2016, 10 days after that meeting with Mifsud, Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information that would be damaging to 465 Hillary Clinton. e. Russia-Related Communications With The Campaign While he was discussing with his foreign contacts a potential meeting of campaign officials with Russian government officials, Papadopoulos kept campaign officials apprised of his efforts. On April 25, 2016, the day before Mifsud told Papadopoulos about the emails, Papadopoulos wrote to senior policy advisor Stephen Miller that “[t]he Russian government has an open invitation by Putin for Mr. Trump to meet him when he is ready,” and that “[t]he advantage of being in London is that these governments tend to speak a bit more openly in 466 ‘neutral’ cities.” On April 27, 2016, after his meeting with Mifsud, Papadopoulos wrote a second message to Miller stating that “some interesting messages [were] coming in from Moscow about a trip when the time is 467 right.” The same day, Papadopoulos sent a similar email to campaign manager Corey Lewandowski, telling Lewandowski that Papadopoulos had “been receiving a lot of calls over the last month about Putin wanting to host 468 [Trump] and the team when the time is right.” Papadopoulos’s Russia-related communications with Campaign officials continued throughout the spring and summer of 2016. On May 4, 2016, he forwarded to Lewandowski an email from Timofeev raising the possibility of a meeting in Moscow, asking Lewandowski whether that was “something we want 469 to move forward with.” The next day, Papadopoulos forwarded the same Timofeev email to Sam Clovis, adding to the top of the email “Russia 470 update.” He included the same email in a May 21, 2016 message to senior Campaign official Paul Manafort, under the subject line “Request from Russia to meet Mr. Trump,” stating that “Russia has been eager to meet Mr. Trump for 471 quite sometime and have been reaching out to me to discuss.” Manafort forwarded the message to another Campaign official, without including Papadopoulos, and stated: “Let[’]s discuss. We need someone to communicate

that [Trump] is not doing these trips. It should be someone low level in the 472 Campaign so as not to send any signal.” On June 1, 2016, Papadopoulos replied to an earlier email chain with Lewandowski about a Russia visit, asking if Lewandowski “want[ed] to have a 473 call about this topic” and whether “we were following up with it.” After Lewandowski told Papadopoulos to “connect with” Clovis because he was “running point,” Papadopoulos emailed Clovis that “the Russian MFA” was 474 asking him “if Mr. Trump is interested in visiting Russia at some point.” Papadopoulos wrote in an email that he “[w]anted to pass this info along to you for you to decide what’s best to do with it and what message I should send (or to 475 ignore).” 476 After several email and Skype exchanges with Timofeev, Papadopoulos sent one more email to Lewandowski on June 19, 2016, Lewandowski’s last day 477 as campaign manager. The email stated that “[t]he Russian ministry of foreign affairs” had contacted him and asked whether, if Mr. Trump could not travel to Russia, a campaign representative such as Papadopoulos could attend 478 meetings. Papadopoulos told Lewandowski that he was “willing to make the trip off the record if it’s in the interest of Mr. Trump and the campaign to meet 479 specific people.” Following Lewandowski’s departure from the Campaign, Papadopoulos communicated with Clovis and Walid Phares, another member of the foreign policy advisory team, about an off-the-record meeting between the Campaign and Russian government officials or with Papadopoulos’s other Russia 480 connections, Mifsud and Timofeev. Papadopoulos also interacted directly with Clovis and Phares in connection with the summit of the Transatlantic Parliamentary Group on Counterterrorism (TAG), a group for which Phares was 481 co-secretary general. On July 16, 2016, Papadopoulos attended the TAG summit in Washington, D.C., where he sat next to Clovis (as reflected in the 482 photograph below).

George Papadopoulos (far right) and Sam Clovis (second from right) Although Clovis claimed to have no recollection of attending the TAG 483 summit, Papadopoulos remembered discussing Russia and a foreign policy 484 trip with Clovis and Phares during the event. Papadopoulos’s recollection is consistent with emails sent before and after the TAG summit. The pre-summit messages included a July 11, 2016 email in which Phares suggested meeting 485 Papadopoulos the day after the summit to chat, and a July 12 message in the same chain in which Phares advised Papadopoulos that other summit attendees 486 “are very nervous about Russia. So be aware.” Ten days after the summit, Papadopoulos sent an email to Mifsud listing Phares and Clovis as other 487 “participants” in a potential meeting at the London Academy of Diplomacy. Finally, Papadopoulos’s recollection is also consistent with handwritten 488 notes from a journal that he kept at the time. Those notes, which are reprinted in part below, appear to refer to potential September 2016 meetings in London with representatives of the “office of Putin,” and suggest that Phares, Clovis, and Papadopoulos (“Walid/Sam me”) would attend without the official 489 backing of the Campaign (“no official letter/no message from Trump”).

The Later communications indicate that Clovis determined that he (Clovis) could handwritten not travel. On August 15, 2016, Papadopoulos emailed Clovis that he had script reads, received requests from multiple foreign governments, “even Russia[],” for September “closed door workshops/consultations abroad,” and asked whether there was still (boxed). 490 Have interest for Clovis, Phares, and Papadopoulos “to go on that trip.” Clovis an copied Phares on his response, which said that he could not “travel before the exploratory election” but that he “would encourage [Papadopoulos] and Walid to make the meeting 491 to trips, if it is feasible.” (slashed) or Papadopoulos was dismissed from the Trump Campaign in early October lose. 2016, after an interview he gave to the Russian news agency Interfax generated In September 492 adverse publicity. – if allowed f. Trump Campaign Knowledge of “Dirt” they will blast Papadopoulos admitted telling at least one individual outside of the Mr.

Campaign—specifically, the then-Greek foreign minister—about Russia’s 493 obtaining Clinton-related emails. In addition, a different foreign government informed the FBI that, 10 days after meeting with Mifsud in late April 2016, Papadopoulos suggested that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information that would be damaging to Hillary 494 Clinton. (This conversation occurred after the GRU spearphished Clinton Campaign chairman John Podesta and stole his emails, and the GRU hacked into the DCCC and DNC, see Volume I, Sections III.A & III.B, supra.) Such disclosures raised questions about whether Papadopoulos informed any Trump Campaign official about the emails. When interviewed, Papadopoulos and the Campaign officials who interacted with him told the Office that they could not recall Papadopoulos’s sharing the information that Russia had obtained “dirt” on candidate Clinton in the form of emails or that Russia could assist the Campaign through the anonymous release of information about Clinton. Papadopoulos stated that he could not clearly recall having told anyone on the Campaign and wavered about whether he accurately remembered an incident in which Clovis had been upset after hearing 495 Papadopoulos tell Clovis that Papadopoulos thought “they have her emails.” The Campaign officials who interacted or corresponded with Papadopoulos have similarly stated, with varying degrees of certainty, that he did not tell them. Senior policy advisor Stephen Miller, for example, did not remember hearing anything from Papadopoulos or Clovis about Russia having emails of or dirt on 496 candidate Clinton. Clovis stated that he did not recall anyone, including Papadopoulos, having given him non-public information that a foreign 497 government might be in possession of material damaging to Hillary Clinton. 498 Grand Jury█ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 499 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . No documentary evidence, and nothing in the email accounts or other communications facilities reviewed by the Office, shows that Papadopoulos shared this information with the Campaign. g. Additional George Papadopoulos Contact

The Office investigated another Russia-related contact with Papadopoulos. The Office was not fully able to explore the contact because the individual at issue—Sergei Millian—remained out of the country since the inception of our investigation and declined to meet with members of the Office despite our repeated efforts to obtain an interview. Papadopoulos first connected with Millian via LinkedIn on July 15, 2016, 500 shortly after Papadopoulos had attended the TAG Summit with Clovis. Millian, an American citizen who is a native of Belarus, introduced himself “as president of [the] New York-based Russian American Chamber of Commerce,” and claimed that through that position he had “insider knowledge and direct 501 access to the top hierarchy in Russian politics.” Papadopoulos asked 502 503 Timofeev whether he had heard of Millian. Although Timofeev said no, 504 Papadopoulos met Millian in New York City. The meetings took place on 505 July 30 and August 1, 2016. Afterwards, Millian invited Papadopoulos to attend—and potentially speak at—two international energy conferences, 506 including one that was to be held in Moscow in September 2016. Papadopoulos ultimately did not attend either conference. On July 31, 2016, following his first in-person meeting with Millian, Papadopoulos emailed Trump Campaign official Bo Denysyk to say that he had been contacted “by some leaders of Russian-American voters here in the US about their interest in voting for Mr. Trump,” and to ask whether he should “put 507 you in touch with their group (US-Russia chamber of commerce).” Denysyk thanked Papadopoulos “for taking the initiative,” but asked him to “hold off with outreach to Russian-Americans” because “too many articles” had already portrayed the Campaign, then-campaign chairman Paul Manafort, and candidate 508 Trump as “being pro-Russian.” On August 23, 2016, Millian sent a Facebook message to Papadopoulos promising that he would “share with you a disruptive technology that might be 509 instrumental in your political work for the campaign.” Papadopoulos claimed 510 to have no recollection of this matter. On November 9, 2016, shortly after the election, Papadopoulos arranged to meet Millian in Chicago to discuss business opportunities, including potential

511 work with Russian “billionaires who are not under sanctions.” The meeting took place on November 14, 2016, at the Trump Hotel and Tower in 512 Chicago. According to Papadopoulos, the two men discussed partnering on business deals, but Papadopoulos perceived that Millian’s attitude toward him changed when Papadopoulos stated that he was only pursuing private-sector 513 opportunities and was not interested in a job in the Administration. The two remained in contact, however, and had extended online discussions about 514 possible business opportunities in Russia. The two also arranged to meet at a Washington, D.C. bar when both attended Trump’s inauguration in late January 515 2017. 3. Carter Page Carter Page worked for the Trump Campaign from January 2016 to September 2016. He was formally and publicly announced as a foreign policy 516 advisor by the candidate in March 2016. Page had lived and worked in Russia, and he had been approached by Russian intelligence officers several years before he volunteered for the Trump Campaign. During his time with the Campaign, Page advocated pro-Russia foreign policy positions and traveled to Moscow in his personal capacity. Russian intelligence officials had formed relationships with Page in 2008 and 2013 and Russian officials may have focused on Page in 2016 because of his affiliation with the Campaign. However, the investigation did not establish that Page coordinated with the Russian government in its efforts to interfere with the 2016 presidential election. a. Background Before he began working for the Campaign in January 2016, Page had substantial prior experience studying Russian policy issues and living and working in Moscow. From 2004 to 2007, Page was the deputy branch manager 517 of Merrill Lynch’s Moscow office. There, he worked on transactions involving the Russian energy company Gazprom and came to know Gazprom’s 518 deputy chief financial officer, Sergey Yatsenko. In 2008, Page founded Global Energy Capital LLC (GEC), an investment management and advisory firm focused on the energy sector in emerging

519 markets. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 520 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The company otherwise had no sources of income, and Page was forced to draw down his life 521 savings to support himself and pursue his business venture. Page asked Yatsenko to work with him at GEC as a senior advisor on a contingency basis, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 522 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . In 2008, Page met Alexander Bulatov, a Russian government official who 523 worked at the Russian Consulate in New York. Page later learned that Bulatov was a Russian intelligence officer, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 524 █ █ █ . In 2013, Victor Podobnyy, another Russian intelligence officer working covertly in the United States under diplomatic cover, formed a relationship with 525 Page. Podobnyy met Page at an energy symposium in New York City and 526 began exchanging emails with him. Podobnyy and Page also met in person on multiple occasions, during which Page offered his outlook on the future of the energy industry and provided documents to Podobnyy about the energy 527 business. In a recorded conversation on April 8, 2013, Podobnyy told another intelligence officer that Page was interested in business opportunities in 528 Russia. In Podobnyy’s words, Page “got hooked on Gazprom thinking that if they have a project, he could . . . rise up. Maybe he can. . . . [I]t’s obvious that he 529 wants to earn lots of money.” Podobnyy said that he had led Page on by “feed[ing] him empty promises” that Podobnyy would use his Russian business 530 connections to help Page. Podobnyy told the other intelligence officer that his method of recruiting foreign sources was to promise them favors and then 531 discard them once he obtained relevant information from them. In 2015, Podobnyy and two other Russian intelligence officers were charged 532 with conspiracy to act as an unregistered agent of a foreign government. The criminal complaint detailed Podobnyy’s interactions with and conversations 533 about Page, who was identified only as “Male-1.” Based on the criminal

complaint’s description of the interactions, Page was aware that he was the 534 individual described as “Male-1.” Page later spoke with a Russian government official at the United Nations General Assembly and identified himself so that the official would understand he was “Male-1” from the 535 Podobnyy complaint. Page told the official that he “didn’t do anything” Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 536 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . In interviews with the FBI before the Office’s opening, Page acknowledged that he understood that the individuals he had associated with were members of the Russian intelligence services, but he stated that he had only provided immaterial non-public information to them and that he did not view this 537 relationship as a backchannel. Page told investigating agents that “the more 538 immaterial non-public information I give them, the better for this country.” b. Origins of and Early Campaign Work In January 2016, Page began volunteering on an informal, unpaid basis for the Trump Campaign after Ed Cox, a state Republican Party official, introduced 539 Page to Trump Campaign officials. Page told the Office that his goal in working on the Campaign was to help candidate Trump improve relations with 540 Russia. To that end, Page emailed Campaign officials offering his thoughts on U.S.-Russia relations, prepared talking points and briefing memos on Russia, and proposed that candidate Trump meet with President Vladimir Putin in 541 Moscow. In communications with Campaign officials, Page also repeatedly touted his high-level contacts in Russia and his ability to forge connections between candidate Trump and senior Russian governmental officials. For example, on January 30, 2016, Page sent an email to senior Campaign officials stating that he had “spent the past week in Europe and ha[d] been in discussions with some individuals with close ties to the Kremlin” who recognized that Trump could 542 have a “game-changing effect . . . in bringing the end of the new Cold War.” The email stated that “[t]hrough [his] discussions with these high level contacts,” Page believed that “a direct meeting in Moscow between Mr[.] Trump and Putin

543 could be arranged.” Page closed the email by criticizing U.S. sanctions on 544 Russia. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 545 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ On March 21, 2016, candidate Trump formally and publicly identified Page as a member of his foreign policy team to advise on Russia and the energy 546 sector. Over the next several months, Page continued providing policy- related work product to Campaign officials. For example, in April 2016, Page provided feedback on an outline for a foreign policy speech that the candidate 547 gave at the Mayflower Hotel, see Volume I, Section IV.A.4, infra. In May 2016, Page prepared an outline of an energy policy speech for the Campaign and then traveled to Bismarck, North Dakota, to watch the candidate deliver the 548 speech. Chief policy advisor Sam Clovis expressed appreciation for Page’s 549 work and praised his work to other Campaign officials. c. Carter Page’s July 2016 Trip To Moscow Page’s affiliation with the Trump Campaign took on a higher profile and drew the attention of Russian officials after the candidate named him a foreign policy advisor. As a result, in late April 2016, Page was invited to give a speech at the July 2016 commencement ceremony at the New Economic School (NES) 550 in Moscow. The NES commencement ceremony generally featured high- profile speakers; for example, President Barack Obama delivered a 551 commencement address at the school in 2009. NES officials told the Office that the interest in inviting Page to speak at NES was based entirely on his status 552 as a Trump Campaign advisor who served as the candidate’s Russia expert. Andrej Krickovic, an associate of Page’s and assistant professor at the Higher School of Economics in Russia, recommended that NES rector Shlomo Weber invite Page to give the commencement address based on his connection to the 553 Trump Campaign. Denis Klimentov, an employee of NES, said that when Russians learned of Page’s involvement in the Trump Campaign in March 2016, 554 the excitement was palpable. Weber recalled that in summer 2016 there was substantial interest in the Trump Campaign in Moscow, and he felt that bringing 555 a member of the Campaign to the school would be beneficial.

Page was eager to accept the invitation to speak at NES, and he sought 556 approval from Trump Campaign officials to make the trip to Russia. On May 16, 2016, while that request was still under consideration, Page emailed Clovis, J.D. Gordon, and Walid Phares and suggested that candidate Trump take his 557 place speaking at the commencement ceremony in Moscow. On June 19, 2016, Page followed up again to request approval to speak at the NES event and to reiterate that NES “would love to have Mr. Trump speak at this annual 558 celebration” in Page’s place. Campaign manager Corey Lewandowski responded the same day, saying, “If you want to do this, it would be out side [sic] of your role with the DJT for President campaign. I am certain Mr. Trump 559 will not be able to attend.” In early July 2016, Page traveled to Russia for the NES events. On July 5, 560 2016, Denis Klimentov, copying his brother, Dmitri Klimentov, emailed Maria Zakharova, the Director of the Russian Ministry of Foreign Affairs’ Information and Press Department, about Page’s visit and his connection to the 561 Trump Campaign. Denis Klimentov said in the email that he wanted to draw 562 the Russian government’s attention to Page’s visit in Moscow. His message to Zakharova continued: “Page is Trump’s adviser on foreign policy. He is a known businessman; he used to work in Russia. . . . If you have any questions, I 563 will be happy to help contact him.” Dmitri Klimentov then contacted Russian Press Secretary Dmitry Peskov about Page’s visit to see if Peskov wanted to 564 introduce Page to any Russian government officials. The following day, Peskov responded to what appears to have been the same Denis Klimentov- Zakharova email thread. Peskov wrote, “I have read about [Page]. Specialists say that he is far from being the main one. So I better not initiate a meeting in the 565 Kremlin.” On July 7, 2016, Page delivered the first of his two speeches in Moscow at 566 NES. In the speech, Page criticized the U.S. government’s foreign policy toward Russia, stating that “Washington and other Western capitals have impeded potential progress through their often hypocritical focus on ideas such 567 as democratization, inequality, corruption and regime change.” On July 8, 568 2016, Page delivered a speech during the NES commencement. After Page delivered his commencement address, Russian Deputy Prime Minister and NES

board member Arkady Dvorkovich spoke at the ceremony and stated that the 569 sanctions the United States had imposed on Russia had hurt the NES. Page and Dvorkovich shook hands at the commencement ceremony, and Weber recalled that Dvorkovich made statements to Page about working together in the 570 future. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 571 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . Page said that, during his time in Moscow, he met with friends and associates he knew from when he lived in Russia, including Andrey Baranov, a former Gazprom employee who had become the head of investor relations at 572 Rosneft, a Russian energy company. Page stated that he and Baranov talked 573 about “immaterial non-public” information. Page believed he and Baranov discussed Rosneft president Igor Sechin, and he thought Baranov might have 574 mentioned the possibility of a sale of a stake in Rosneft in passing. Page recalled mentioning his involvement in the Trump Campaign with Baranov, 575 although he did not remember details of the conversation. Page also met with individuals from Tatneft, a Russian energy company, to discuss possible business 576 deals, including having Page work as a consultant. On July 8, 2016, while he was in Moscow, Page emailed several Campaign officials and stated he would send “a readout soon regarding some incredible insights and outreach I’ve received from a few Russian legislators and senior 577 members of the Presidential Administration here.” On July 9, 2016, Page emailed Clovis, writing in pertinent part: Russian Deputy Prime minister and NES board member Arkady Dvorkovich also spoke before the event. In a private conversation, Dvorkovich expressed strong support for Mr. Trump and a desire to work together toward devising better solutions in response to the vast range of current international problems. Based on feedback from a diverse array of other sources close to the Presidential Administration, it was readily apparent that this sentiment is widely held at all levels of 578 government. Despite these representations to the Campaign, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █

579 █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 580 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 581 █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 582 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The Office was unable to obtain additional evidence or testimony about who Page may have met or communicated with in Moscow; thus, Page’s activities in Russia—as described in his emails with the Campaign—were not fully explained. d. Later Campaign Work and Removal from the Campaign In July 2016, after returning from Russia, Page traveled to the Republican 583 National Convention in Cleveland. While there, Page met Russian Ambassador to the United States Sergey Kislyak; that interaction is described in 584 Volume I, Section IV.A.6.a, infra. Page later emailed Campaign officials with feedback he said he received from ambassadors he had met at the Convention, and he wrote that Ambassador Kislyak was very worried about candidate 585 Clinton’s world views. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 586 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ . Following the Convention, Page’s trip to Moscow and his advocacy for pro- Russia foreign policy drew the media’s attention and began to generate substantial press coverage. The Campaign responded by distancing itself from Page, describing him as an “informal foreign policy advisor” who did “not speak 587 for Mr. Trump or the campaign.” On September 23, 2016, Yahoo! News reported that U.S. intelligence officials were investigating whether Page had opened private communications with senior Russian officials to discuss U.S. 588 sanctions policy under a possible Trump Administration. A Campaign spokesman told Yahoo! News that Page had “no role” in the Campaign and that 589 the Campaign was “not aware of any of his activities, past or present.” On 590 September 24, 2016, Page was formally removed from the Campaign. Although Page had been removed from the Campaign, after the election he

591 sought a position in the Trump Administration. On November 14, 2016, he submitted an application to the Transition Team that inflated his credentials and experiences, stating that in his capacity as a Trump Campaign foreign policy advisor he had met with “top world leaders” and “effectively responded to diplomatic outreach efforts from senior government officials in Asia, Europe, the 592 Middle East, Africa, [and] the Americas.” Page received no response from the Transition Team. When Page took a personal trip to Moscow in December 2016, he met again with at least one Russian government official. That interaction and a discussion of the December trip are set forth in Volume I, Section IV.B.6, infra. 4. Dimitri Simes and the Center for the National Interest Members of the Trump Campaign interacted on several occasions with the Center for the National Interest (CNI), principally through its President and Chief Executive Officer, Dimitri Simes. CNI is a think tank with expertise in and connections to the Russian government. Simes was born in the former Soviet Union and immigrated to the United States in the 1970s. In April 2016, candidate Trump delivered his first speech on foreign policy and national security at an event hosted by the National Interest, a publication affiliated with CNI. Then-Senator Jeff Sessions and Russian Ambassador Kislyak both attended the event and, as a result, it gained some attention in relation to Sessions’s confirmation hearings to become Attorney General. Sessions had various other contacts with CNI during the campaign period on foreign-policy matters, including Russia. Jared Kushner also interacted with Simes about Russian issues during the campaign. The investigation did not identify evidence that the Campaign passed or received any messages to or from the Russian government through CNI or Simes. a. CNI and Dimitri Simes Connect with the Trump Campaign CNI is a Washington-based non-profit organization that grew out of a center 593 founded by former President Richard Nixon. CNI describes itself “as a voice for strategic realism in U.S. foreign policy,” and publishes a bi-monthly foreign 594 policy magazine, the National Interest. CNI is overseen by a board of directors and an advisory council that is largely honorary and whose members at the relevant time included Sessions, who served as an advisor to candidate

595 Trump on national security and foreign policy issues. Dimitri Simes is president and CEO of CNI and the publisher and CEO of 596 the National Interest. Simes was born in the former Soviet Union, emigrated to the United States in the early 1970s, and joined CNI’s predecessor after 597 working at the Carnegie Endowment for International Peace. Simes personally has many contacts with current and former Russian government 598 officials, as does CNI collectively. As CNI stated when seeking a grant from the Carnegie Corporation in 2015, CNI has “unparalleled access to Russian 599 officials and politicians among Washington think tanks,” in part because CNI has arranged for U.S. delegations to visit Russia and for Russian delegations to 600 visit the United States as part of so-called “Track II” diplomatic efforts. On March 14, 2016, CNI board member Richard Plepler organized a luncheon for CNI and its honorary chairman, Henry Kissinger, at the Time 601 Warner Building in New York. The idea behind the event was to generate 602 interest in CNI’s work and recruit new board members for CNI. Along with Simes, attendees at the event included Jared Kushner, son-in-law of candidate 603 Trump. Kushner told the Office that the event came at a time when the Trump Campaign was having trouble securing support from experienced foreign policy professionals and that, as a result, he decided to seek Simes’s assistance 604 during the March 14 event. 605 Simes and Kushner spoke again on a March 24, 2016 telephone call, three days after Trump had publicly named the team of foreign policy advisors 606 that had been put together on short notice. On March 31, 2016, Simes and Kushner had an in-person, one-on-one meeting in Kushner’s New York 607 office. During that meeting, Simes told Kushner that the best way to handle foreign-policy issues for the Trump Campaign would be to organize an advisory group of experts to meet with candidate Trump and develop a foreign policy 608 approach that was consistent with Trump’s voice. Simes believed that 609 Kushner was receptive to that suggestion. Simes also had contact with other individuals associated with the Trump Campaign regarding the Campaign’s foreign policy positions. For example, on

June 17, 2016, Simes sent J.D. Gordon an email with a “memo to Senator Sessions that we discussed at our recent meeting” and asked Gordon to both read it and share it with Sessions. The memorandum proposed building a “small and carefully selected group of experts” to assist Sessions with the Campaign, operating under the assumption “that Hillary Clinton is very vulnerable on national security and foreign policy issues.” The memorandum outlined key 610 issues for the Campaign, including a “new beginning with Russia.” b. National Interest Hosts a Foreign Policy Speech at the Mayflower Hotel During both their March 24 phone call and their March 31 in-person meeting, Simes and Kushner discussed the possibility of CNI hosting a foreign 611 policy speech by candidate Trump. Following those conversations, Simes agreed that he and others associated with CNI would provide behind-the-scenes input on the substance of the foreign-policy speech and that CNI officials would coordinate the logistics of the speech with Sessions and his staff, including 612 Sessions’s chief of staff, Rick Dearborn. In mid-April 2016, Kushner put Simes in contact with senior policy advisor Stephen Miller and forwarded to Simes an outline of the foreign-policy speech 613 that Miller had prepared. Simes sent back to the Campaign bullet points with ideas for the speech that he had drafted with CNI Executive Director Paul 614 Saunders and board member Richard Burt. Simes received subsequent draft outlines from Miller, and he and Saunders spoke to Miller by phone about 615 substantive changes to the speech. It is not clear, however, whether CNI officials received an actual draft of the speech for comment; while Saunders recalled having received an actual draft, Simes did not, and the emails that CNI 616 produced to this Office do not contain such a draft. After board members expressed concern to Simes that CNl’s hosting the speech could be perceived as an endorsement of a particular candidate, CNI decided to have its publication, the National Interest, serve as the host and to 617 have the event at the National Press Club. Kushner later requested that the event be moved to the Mayflower Hotel, which was another venue that Simes had mentioned during initial discussions with the Campaign, in order to address

618 concerns about security and capacity. On April 25, 2016, Saunders booked event rooms at the Mayflower to host 619 both the speech and a VIP reception that was to be held beforehand. Saunders understood that the reception—at which invitees would have the 620 chance to meet· candidate Trump—would be a small event. Saunders decided who would attend by looking at the list of CNI’s invitees to the speech 621 itself and then choosing a subset for the reception. CNI’s invitees to the 622 reception included Sessions and Kislyak. The week before the speech Simes had informed Kislyak that he would be invited to the speech, and that he would 623 have the opportunity to meet Trump. When the pre-speech reception began on April 27, a receiving line was 624 quickly organized so that attendees could meet Trump. Sessions first stood next to Trump to introduce him to the members of Congress who were in 625 attendance. After those members had been introduced, Simes stood next to Trump and introduced him to the CNI invitees in attendance, including 626 Kislyak. Simes perceived the introduction to be positive and friendly, but 627 thought it clear that Kislyak and Trump had just met for the first time. Kislyak also met Kushner during the pre-speech reception. The two shook hands and chatted for a minute or two, during which Kushner recalled Kislyak saying, 628 “we like what your candidate is saying . . . it’s refreshing.” Several public reports state that, in addition to speaking to Kushner at the pre-speech reception, Kislyak also met or conversed with Sessions at that 629 time. Sessions stated to investigators, however, that he did not remember any 630 such conversation. Nor did anyone else affiliated with CNI or the National Interest specifically recall a conversation or meeting between Sessions and 631 Kislyak at the pre-speech reception. It appears that, if a conversation occurred at the pre-speech reception, it was a brief one conducted in public view, similar to the exchange between Kushner and Kislyak. The Office found no evidence that Kislyak conversed with either Trump or Sessions after the speech, or would have had the opportunity to do so. Simes, for 632 example, did not recall seeing Kislyak at the post-speech luncheon, and the

only witness who accounted for Sessions’s whereabouts stated that Sessions may 633 have spoken to the press after the event but then departed for Capitol Hill. Saunders recalled, based in part on a food-related request he received from a Campaign staff member, that Trump left the hotel a few minutes after the speech 634 to go to the airport. c. Jeff Sessions’s Post-Speech Interactions with CNI In the wake of Sessions’s confirmation hearings as Attorney General, questions arose about whether Sessions’s campaign-period interactions with CNI apart from the Mayflower speech included any additional meetings with Ambassador Kislyak or involved Russian-related matters. With respect to Kislyak contacts, on May 23, 2016, Sessions attended CNI’s Distinguished 635 Service Award dinner at the Four Seasons Hotel in Washington, D.C. Sessions attended a pre-dinner reception and was seated at one of two head 636 tables for the event. A seating chart prepared by Saunders indicates that Sessions was scheduled to be seated next to Kislyak, who appears to have 637 responded to the invitation by indicating he would attend the event. Sessions, however, did not remember seeing, speaking with, or sitting next to Kislyak at 638 the dinner. Although CNI board member Charles Boyd said he may have 639 seen Kislyak at the dinner, Simes, Saunders, and Jacob Heilbrunn—editor of the National Interest—all had no recollection of seeing Kislyak at the May 23 640 event. Kislyak also does not appear in any of the photos from the event that the Office obtained. In the summer of 2016, CNI organized at least two dinners in Washington, 641 D.C. for Sessions to meet with experienced foreign policy professionals. The dinners included CNI-affiliated individuals, such as Richard Burt and Zalmay Khalilzad, a former U.S. ambassador to Afghanistan and Iraq and the person 642 who had introduced Trump before the April 27, 2016 foreign-policy speech. 643 Khalilzad also met with Sessions one-on-one separately from the dinners. At the dinners and in the meetings, the participants addressed U.S. relations with Russia, including how U.S. relations with NATO and European countries 644 affected U.S. policy toward Russia. But the discussions were not exclusively

645 focused on Russia. Khalilzad, for example, recalled discussing “nation- 646 building” and violent extremism with Sessions. In addition, Sessions asked Saunders (of CNI) to draft two memoranda not specific to Russia: one on Hillary 647 Clinton’s foreign policy shortcomings and another on Egypt. d. Jared Kushner’s Continuing Contacts with Simes Between the April 2016 speech at the Mayflower Hotel and the presidential 648 election, Jared Kushner had periodic contacts with Simes. Those contacts consisted of both in-person meetings and phone conversations, which concerned how to address issues relating to Russia in the Campaign and how to move forward with the advisory group of foreign policy experts that Simes had 649 proposed. Simes recalled that he, not Kushner, initiated all conversations about Russia, and that Kushner never asked him to set up back-channel 650 conversations with Russians. According to Simes, after the Mayflower speech in late April, Simes raised the issue of Russian contacts with Kushner, advised that it was bad optics for the Campaign to develop hidden Russian contacts, and told Kushner both that the Campaign should not highlight Russia 651 as an issue and should handle any contacts with Russians with care. Kushner 652 generally provided a similar account of his interactions with Simes. Among the Kushner-Simes meetings was one held on August 17, 2016, at Simes’s request, in Kushner’s New York office. The meeting was to address foreign policy advice that CNI was providing and how to respond to the Clinton 653 Campaign’s Russia-related attacks on candidate Trump. In advance of the meeting, Simes sent Kushner a “Russia Policy Memo” laying out “what Mr. 654 Trump may want to say about Russia.” In a cover email transmitting that memo and a phone call to set up the meeting, Simes mentioned “a well- documented story of highly questionable connections between Bill Clinton” and the Russian government, “parts of [which]” (according to Simes) had even been “discussed with the CIA and the FBI in the late 1990s and shared with the 655 [Independent Counsel] at the end of the Clinton presidency.” Kushner forwarded the email to senior Trump Campaign officials Stephen Miller, Paul 656 Manafort, and Rick Gates, with the note “suggestion only.” Manafort subsequently forwarded the email to his assistant and scheduled a meeting with

657 Simes. (Manafort was on the verge of leaving the Campaign by the time of the scheduled meeting with Simes, and Simes ended up meeting only with Kushner). During the August 17 meeting, Simes provided Kushner the Clinton-related 658 information that he had promised. Simes told Kushner that, Personal Privacy█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 659 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Simes claimed that he had received this information from former CIA and Reagan White House official Fritz Ermarth, who claimed to have learned it from U.S. intelligence sources, not from 660 Russians. Simes perceived that Kushner did not find the information to be of interest 661 or use to the Campaign because it was, in Simes’s words, “old news.” When interviewed by the Office, Kushner stated that he believed that there was little chance of something new being revealed about the Clintons given their long career as public figures, and that he never received from Simes information that 662 could be “operationalized” for the Trump Campaign. Despite Kushner’s reaction, Simes believed that he provided the same information at a small group 663 meeting of foreign policy experts that CNI organized for Sessions. 5. June 9, 2016 Meeting at Trump Tower On June 9, 2016, senior representatives of the Trump Campaign met in Trump Tower with a Russian attorney expecting to receive derogatory information about Hillary Clinton from the Russian government. The meeting was proposed to Donald Trump Jr. in an email from Robert Goldstone, at the request of his then-client Emin Agalarov, the son of Russian real-estate developer Aras Agalarov. Goldstone relayed to Trump Jr. that the “Crown prosecutor of Russia . . . offered to provide the Trump Campaign with some official documents and information that would incriminate Hillary and her dealings with Russia” as “part of Russia and its government’s support for Mr. Trump.” Trump Jr. immediately responded that “if it’s what you say I love it,” and arranged the meeting through a series of emails and telephone calls. Trump Jr. invited campaign chairman Paul Manafort and senior advisor Jared Kushner to attend the meeting, and both attended. Members of the

Campaign discussed the meeting before it occurred, and Michael Cohen recalled that Trump Jr. may have told candidate Trump about an upcoming meeting to receive adverse information about Clinton, without linking the meeting to Russia. According to written answers submitted by President Trump, he has no recollection of learning of the meeting at the time, and the Office found no documentary evidence showing that he was made aware of the meeting—or its Russian connection—before it occurred. The Russian attorney who spoke at the meeting, Natalia Veselnitskaya, had previously worked for the Russian government and maintained a relationship with that government throughout this period of time. She claimed that funds derived from illegal activities in Russia were provided to Hillary Clinton and other Democrats. Trump Jr. requested evidence to support those claims, but Veselnitskaya did not provide such information. She and her associates then turned to a critique of the origins of the Magnitsky Act, a 2012 statute that imposed financial and travel sanctions on Russian officials and that resulted in a retaliatory ban on adoptions of Russian children. Trump Jr. suggested that the issue could be revisited when and if candidate Trump was elected. After the election, Veselnitskaya made additional efforts to follow up on the meeting, but the Trump Transition Team did not engage. a. Setting Up the June 9 Meeting i. Outreach to Donald Trump Jr. Aras Agalarov is a Russian real-estate developer with ties to Putin and other members of the Russian government, including Russia’s Prosecutor General, 664 Yuri Chaika. Aras Agalarov is the president of the Crocus Group, a Russian enterprise that holds substantial Russian government construction contracts and that—as discussed above, Volume I, Section IV.A.I, supra—worked with Trump in connection with the 2013 Miss Universe pageant in Moscow and a potential 665 Trump Moscow real-estate project. The relationship continued over time, as the parties pursued the Trump Moscow project in 2013-2014 and exchanged 666 gifts and letters in 2016. For example, in April 2016, Trump responded to a 667 letter from Aras Agalarov with a handwritten note. Aras Agalarov expressed interest in Trump’s campaign, passed on “congratulations” for winning in the

primary and—according to one email drafted by Goldstone—an “offer” of his “support and that of many of his important Russian friends and colleagues[,] 668 especially with reference to U.S./Russian relations.” On June 3, 2016, Emin Agalarov called Goldstone, Emin’s then- 669 publicist. Goldstone is a music and events promoter who represented Emin 670 Agalarov from approximately late 2012 until late 2016. While representing Emin Agalarov, Goldstone facilitated the ongoing contact between the Trumps and the Agalarovs—including an invitation that Trump sent to Putin to attend the 671 2013 Miss Universe Pageant in Moscow. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 672 █ █ █ █ . Goldstone understood Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ a Russian political connection, and Emin Agalarov indicated that the attorney 673 was a prosecutor. Goldstone recalled that the information that might interest the Trumps involved Hillary Clinton Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 674 Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 675 █ █ █ █ █ The Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ mentioned by Emin 676 Agalarov was Natalia Veselnitskaya. From approximately 1998 until 2001, Veselnitskaya worked as a prosecutor for the Central Administrative District of 677 the Russian Prosecutor’s Office, and she continued to perform government- related work and maintain ties to the Russian government following her 678 departure. She lobbied and testified about the Magnitsky Act, which imposed financial sanctions and travel restrictions on Russian officials and which was named for a Russian tax specialist who exposed a fraud and later died in a 679 Russian prison. Putin called the statute “a purely political, unfriendly act,” and Russia responded by barring a list of current and former U.S. officials from entering Russia and by halting the adoption of Russian children by U.S.

680 681 citizens. Veselnitskaya performed legal work for Denis Katsyv, the son of Russian businessman Peter Katsyv, and for his company Prevezon Holdings Ltd., which was a defendant in a civil-forfeiture action alleging the laundering of 682 proceeds from the fraud exposed by Magnitsky. She also appears to have been involved in an April 2016 approach to a U.S. congressional delegation in Moscow offering “confidential information” from “the Prosecutor General of Russia” about “interactions between certain political forces in our two 683 countries.” Shortly after his June 3 call with Emin Agalarov, Goldstone emailed Trump 684 Jr. The email stated: Good morning Emin just called and asked me to contact you with something very interesting. The Crown prosecutor of Russia met with his father Aras this morning and in their meeting offered to provide the Trump campaign with some official documents and information that would incriminate Hillary and her dealings with Russia and would be very useful to your father. This is obviously very high level and sensitive information but is part of Russia and its government’s support for Mr. Trump-helped along by Aras and Emin. What do you think is the best way to handle this information and would you be able to speak to Emin about it directly? I can also send this info to your father via Rhona, but it is ultra sensitive so wanted to send to you first. Best Rob Goldstone Within minutes of this email, Trump Jr. responded, emailing back: “Thanks Rob I appreciate that. I am on the road at the moment but perhaps I just speak to Emin first. Seems we have some time and if it’s what you say I love it especially later in the summer. Could we do a call first thing next week when I am 685 back?” Goldstone conveyed Trump Jr.’s interest to Emin Agalarov, emailing 686 that Trump Jr. “wants to speak personally on the issue.” On June 6, 2016, Emin Agalarov asked Goldstone if there was “[a]ny news,” and Goldstone explained that Trump Jr. was likely still traveling for the 687 “final elections . . . where [T]rump will be ‘crowned’ the official nominee.” On the same day, Goldstone again emailed Trump Jr. and asked when Trump Jr. 688 was “free to talk with Emin about this Hillary info.” Trump Jr. asked if they could “speak now,” and Goldstone arranged a call between Trump Jr. and Emin

689 Agalarov. On June 6 and June 7, Trump Jr. and Emin Agalarov had multiple 690 brief calls. Also on June 6, 2016, Aras Agalarov called Ike Kaveladze and asked him to 691 attend a meeting in New York with the Trump Organization. Kaveladze is a Georgia-born, naturalized U.S. citizen who worked in the United States for the 692 Crocus Group and reported to Aras Agalarov. Kaveladze told the Office that, in a second phone call on June 6, 2016, Aras Agalarov asked Kaveladze if he knew anything about the Magnitsky Act, and Aras sent him a short synopsis for the meeting and Veselnitskaya’s business card. According to Kaveladze, Aras Agalarov said the purpose of the meeting was to discuss the Magnitsky Act, and 693 he asked Kaveladze to translate. ii. Awareness of the Meeting Within the Campaign On June 7, Goldstone emailed Trump Jr. and said that “Emin asked that I schedule a meeting with you and [t]he Russian government attorney who is 694 flying over from Moscow.” Trump Jr. replied that Manafort (identified as the 695 “campaign boss”), Jared Kushner, and Trump Jr. would likely attend. Goldstone was suprised to learn that Trump Jr., Manafort, and Kushner would 696 attend. Kaveladze Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ “puzzled” by the list of attendees and that he checked with one of Emin Agalarov’s assistants, Roman Beniaminov, who said that the purpose of the meeting was for 697 Veselnitskaya to convey “negative information on Hillary Clinton.” 698 Beniaminov, however, stated that he did not recall having known or said that. Early on June 8, 2016 Kushner emailed his assistant, asking her to discuss a 699 3:00 p.m. meeting the following day with Trump Jr. Later that day, Trump Jr. forwarded the entirety of his email correspondence regarding the meeting with Goldstone to Manafort and Kushner, under the subject line “FW: Russia - Clinton - private and confidential,” adding a note that the “[m]eeting got moved 700 to 4 tomorrow at my offices.” Kushner then sent his assistant a second email, 701 informing her that the “[m]eeting with don jr is 4pm now.” Manafort 702 responded, “See you then. P. ”

Rick Gates, who was the deputy campaign chairman, stated during interviews with the Office that in the days before June 9, 2016 Trump Jr. announced at a regular morning meeting of senior campaign staff and Trump family members that he had a lead on negative information about the Clinton 703 Foundation. Gates believed that Trump Jr. said the information was coming from a group in Kyrgyzstan and that he was introduced to the group by a 704 friend. Gates recalled that the meeting was attended by Trump Jr., Eric Trump, Paul Manafort, Hope Hicks, and, joining late, Ivanka Trump and Jared Kushner. According to Gates, Manafort warned the group that the meeting likely 705 would not yield vital information and they should be careful. Hicks denied 706 any knowledge of the June 9 meeting before 2017, and Kushner did not 707 recall if the planned June 9 meeting came up at all earlier that week. Michael Cohen recalled being in Donald J. Trump’s office on June 6 or 7 when Trump Jr. told his father that a meeting to obtain adverse information about 708 Clinton was going forward. Cohen did not recall Trump Jr. stating that the 709 meeting was connected to Russia. From the tenor of the conversation, Cohen believed that Trump Jr. had previously discussed the meeting with his father, 710 although Cohen was not involved in any such conversation. In an interview with the Senate Judiciary Committee, however, Trump Jr. stated that he did not 711 inform his father about the emails or the upcoming meeting. Similarly, neither Manafort nor Kushner recalled anyone informing candidate Trump of the 712 meeting, including Trump Jr. President Trump has stated to this Office, in written answers to questions, that he has “no recollection of learning at the time” that his son, Manafort, or “Kushner was considering participating in a meeting in June 2016 concerning potentially negative information about Hillary 713 Clinton.” b. The Events of June 9, 2016 i. Arrangements for the Meeting Veselnitskaya was in New York on June 9, 2016, for appellate proceedings 714 in the Prevezon civil forfeiture litigation. That day, Veselnitskaya called

Rinat Akhmetshin, a Soviet-born U.S. lobbyist, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ and when she learned that he was in New York, invited him to 715 lunch. Akhmetshin told the Office that he had worked on issues relating to 716 the Magnitsky Act and had worked on the Prevezon litigation. Kaveladze and Anatoli Samochornov, a Russian-born translator who had assisted Veselnitskaya with Magnitsky-related lobbying and the Prevezon case, also attended the 717 lunch. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Veselnitskaya said she was meeting Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ and asked 718 Akhmetshin what she should tell him. According to several participants in the lunch, Veselnitskaya showed Akhmetshin a document alleging financial misconduct by Bill Browder and the Ziff brothers (Americans with business in Russia), and those individuals subsequently making political donations to the 719 DNC. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 720 █ █ 721 The group then went to Trump Tower for the meeting. ii. Conduct of the Meeting Trump Jr., Manafort, and Kushner participated on the Trump side, while Kaveladze, Samochomov, Akhmetshin, and Goldstone attended with 722 Veselnitskaya. The Office spoke to every participant except Veselnitskaya and Trump Jr., the latter of whom declined to be voluntarily interviewed by the Office Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 723 The meeting lasted approximately 20 minutes. Grand Jury█ █ █ █ █ 724 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █Goldstone recalled that Trump Jr. invited Veselnitskaya to begin but did not say anything about the subject of the 725 meeting. Participants agreed that Veselnitskaya stated that the Ziff brothers had broken Russian laws and had donated their profits to the DNC or the Clinton 726 Campaign. She asserted that the Ziff brothers had engaged in tax evasion and 727 money laundering in both the United States and Russia. Grand Jury█ █ █ 728 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ According to

Akhmetshin, Trump Jr. asked follow-up questions about how the alleged payments could be tied specifically to the Clinton Campaign, but Veselnitskaya indicated that she could not trace the money once it entered the United 729 States. Kaveladze similarly recalled that Trump Jr. asked what they have on Clinton, and Kushner became aggravated and asked “[w]hat are we doing 730 here?” Akhmetshin then spoke about U.S. sanctions imposed under the Magnitsky 731 Act and Russia’s response prohibiting U.S. adoption of Russian children. Several participants recalled that Trump Jr. commented that Trump is a private 732 citizen, and there was nothing they could do at that time. Trump Jr. also said 733 that they could revisit the issue if and when they were in government. Notes that Manafort took on his phone reflect the general flow of the conversation, 734 although not all of its details. At some point in the meeting, Kushner sent an iMessage to Manafort stating “waste of time,” followed immediately by two separate emails to assistants at Kushner Companies with requests that they call him to give him an excuse to 735 leave. Samochornov recalled that Kushner departed the meeting before it concluded; Veselnitskaya recalled the same when interviewed by the press in 736 July 2017. Veselnitskaya’s press interviews and written statements to Congress differ materially from other accounts. In a July 2017 press interview, Veselnitskaya claimed that she has no connection to the Russian government and had not referred to any derogatory information concerning the Clinton Campaign when 737 she met with Trump Campaign officials. Veselnitskaya’s November 2017 written submission to the Senate Judiciary Committee stated that the purpose of the June 9 meeting was not to connect with “the Trump Campaign” but rather to have “a private meeting with Donald Trump Jr.—a friend of my good acquaintance’s son on the matter of assisting me or my colleagues in informing the Congress members as to the criminal nature of manipulation and interference 738 with the legislative activities of the US Congress.” In other words, Veselnitskaya claimed her focus was on Congress and not the Campaign. No witness, however, recalled any reference to Congress during the meeting. Veselnitskaya also maintained that she “attended the meeting as a lawyer of

Denis Katsyv,” the previously mentioned owner of Prevezon Holdings, but she 739 did not “introduce [her]self in this capacity.” In a July 2017 television interview, Trump Jr. stated that while he had no way to gauge the reliability, credibility, or accuracy of what Goldstone had stated was the purpose of the meeting, if “someone has information on our opponent 740 . . . maybe this is something. I should hear them out.” Trump Jr. further stated in September 2017 congressional testimony that he thought he should 741 “listen to what Rob and his colleagues had to say.” Depending on what, if any, information was provided, Trump Jr. stated he could then “consult with counsel to make an informed decision as to whether to give it any further 742 consideration.” 743 After the June 9 meeting concluded, Goldstone apologized to Trump Jr. According to Goldstone, he told Trump Jr. Grand Jury█ █ █ █ █ █ █ █ █ █ 744 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ and told Emin Agalarov in a phone call that the meeting was about adoption Grand Jury█ █ █ █ █ █ █ █ █ █ █ 745 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ 746 █ █ █ █ █ █ █ █ █ █ █ █ █ █ Aras Agalarov asked Kaveladze to report in after the meeting, but before Kaveladze could call, Aras Agalarov called 747 him. With Veselnitskaya next to him, Kaveladze reported that the meeting had gone well, but he later told Aras Agalarov that the meeting about the Magnitsky Act had been a waste of time because it was not with lawyers and 748 they were “preaching to the wrong crowd.” c. Post-June 9 Events Veselnitskaya and Aras Agalarov made at least two unsuccessful attempts after the election to meet with Trump representatives to convey similar 749 information about Browder and the Magnitsky Act. On November 23, 2016, Kaveladze emailed Goldstone about setting up another meeting “with T people” 750 and sent a document bearing allegations similar to those conveyed on June 9. Kaveladze followed up with Goldstone, stating that “Mr. A,” which Goldstone 751 understood to mean Aras Agalarov, called to ask about the meeting.

Goldstone emailed the document to Rhona Graff, saying that “Aras Agalarov has asked me to pass on this document in the hope it can be passed on to the appropriate team. If needed, a lawyer representing the case is in New York 752 currently and happy to meet with any member of his transition team.” According to Goldstone, around January 2017, Kaveladze contacted him again 753 to set up another meeting, but Goldstone did not make the request. The investigation did not identify evidence of the transition team following up. Participants in the June 9, 2016 meeting began receiving inquiries from attorneys representing the Trump Organization starting in approximately June 754 2017. On approximately June 2, 2017, Goldstone spoke with Alan Garten, general counsel of the Trump Organization, about his participation in the June 9 755 meeting. The same day, Goldstone emailed Veselnitskaya’s name to Garten, identifying her as the “woman who was the attorney who spoke at the meeting 756 from Moscow. ” Later in June 2017, Goldstone participated in a lengthier call with Garten and Alan Futerfas, outside counsel for the Trump Organization 757 (and, subsequently, personal counsel for Trump Jr.). On June 27, 2017, Goldstone emailed Emin Agalarov with the subject “Trump attorneys” and stated that he was “interviewed by attorneys” about the June 9 meeting who were “concerned because it links Don Jr. to officials from Russia—which he has 758 always denied meeting.” Goldstone stressed that he “did say at the time this 759 was an awful idea and a terrible meeting.” Emin Agalarov sent a screenshot 760 of the message to Kaveladze. The June 9 meeting became public in July 2017. In a July 9, 2017 text message to Emin Agalarov, Goldstone wrote “I made sure I kept you and your 761 father out of [t]his story,” and “[i]f contacted I can do a dance and keep you 762 out of it.” Goldstone added, “FBI now investigating,” and “I hope this favor 763 was worth for your dad—it could blow up.” On July 12, 2017 Emin Agalarov complained to Kaveladze that his father, Aras, “never listens” to him 764 and that their relationship with “mr T has been thrown down the drain.” The next month, Goldstone commented to Emin Agalarov about the volume of publicity the June 9 meeting had generated, stating that his “reputation [was] basically destroyed by this dumb meeting which your father insisted on even 765 though Ike and Me told him would be bad news and not to do.” Goldstone

added, “I am not able to respond out of courtesy to you and your father. So am 766 painted as some mysterious link to Putin.” After public reporting on the June 9 meeting began, representatives from the Trump Organization again reached out to participants. On July 10, 2017, Futerfas sent Goldstone an email with a proposed statement for Goldstone to issue, which read: As the person who arranged the meeting, I can definitively state that the statements I have read by Donald Trump Jr. are 100% accurate. The meeting was a complete waste of time and Don was never told Ms. Veselnitskaya’s name prior to the meeting. Ms. Veselnitskaya mostly talked about the Magnitsky Act and Russian adoption laws and the meeting lasted 20 to 30 minutes at most. There was never any follow up 767 and nothing ever came of the meeting. Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ the statement drafted by Trump Organization representatives was Grand Jury█ █ 768 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ He proposed a different statement, asserting that he had been asked “by [his] client in Moscow - Emin Agalarov - to facilitate a meeting between a Russian attorney (Natalia Veselnitzkaya [sic]) and Donald Trump Jr. The lawyer had apparently stated that she had some information regarding funding to the DNC from Russia, which she 769 believed Mr. Trump Jr. might find interesting.” Goldstone never released 770 either statement. On the Russian end, there were also communications about what participants should say about the June 9 meeting. Specifically, the organization that hired Samochornov—an anti-Magnitsky Act group controlled by Veselnitskaya and the owner of Prevezon—offered to pay $90,000 of 771 Samochornov’s legal fees. At Veselnitskaya’s request, the organization sent Samochornov a transcript of a Veselnitskaya press interview, and Samochornov understood that the organization would pay his legal fees only if he made 772 statements consistent with Veselnitskaya’s. Samochornov declined, telling 773 the Office that he did not want to perjure himself. The individual who conveyed Veselnitskaya’s request to Samochornov stated that he did not expressly condition payment on following Veselnitskaya’s answers but, in

hindsight, recognized that by sending the transcript, Samochornov could have interpreted the offer of assistance to be conditioned on his not contradicting 774 Veselnitskaya’s account. Volume II, Section II.G, infra, discusses interactions between President Trump, Trump Jr., and others in June and July 2017 regarding the June 9 meeting. 6. Events at the Republican National Convention Trump Campaign officials met with Russian Ambassador Sergey Kislyak during the week of the Republican National Convention. The evidence indicates that those interactions were brief and non-substantive. During platform committee meetings immediately before the Convention, J.D. Gordon, a senior Campaign advisor on policy and national security, diluted a proposed amendment to the Republican Party platform expressing support for providing “lethal” assistance to Ukraine in response to Russian aggression. Gordon requested that platform committee personnel revise the proposed amendment to state that only “appropriate” assistance be provided to Ukraine. The original sponsor of the “lethal” assistance amendment stated that Gordon told her (the sponsor) that he was on the phone with candidate Trump in connection with his request to dilute the language. Gordon denied making that statement to the sponsor, although he acknowledged it was possible he mentioned having previously spoken to the candidate about the subject matter. The investigation did not establish that Gordon spoke to or was directed by the candidate to make that proposal. Gordon said that he sought the change because he believed the proposed language was inconsistent with Trump’s position on Ukraine. a. Ambassador Kislyak’s Encounters with Senator Sessions and J.D. Gordon the Week of the RNC In July 2016, Senator Sessions and Gordon spoke at the Global Partners in Diplomacy event, a conference co-sponsored by the State Department and the Heritage Foundation held in Cleveland, Ohio the same week as the Republican 775 National Convention (RNC or “Convention”). Approximately 80 foreign ambassadors to the United States, including Kislyak, were invited to the 776 conference.

On July 20, 2016, Gordon and Sessions delivered their speeches at the 777 conference. In his speech, Gordon stated in pertinent part that the United 778 States should have better relations with Russia. During Sessions’s speech, he took questions from the audience, one of which may have been asked by 779 Kislyak. When the speeches concluded, several ambassadors lined up to 780 greet the speakers. Gordon shook hands with Kislyak and reiterated that he 781 had meant what he said in the speech about improving U.S.-Russia relations. Sessions separately spoke with between six and 12 ambassadors, including 782 Kislyak. Although Sessions stated during interviews with the Office that he had no specific recollection of what he discussed with Kislyak, he believed that the two spoke for only a few minutes and that they would have exchanged 783 pleasantries and said some things about U.S.-Russia relations. Later that evening, Gordon attended a reception as part of the 784 conference. Gordon ran into Kislyak as the two prepared plates of food, and 785 they decided to sit at the same table to eat. They were joined at that table by the ambassadors from Azerbaijan and Kazakhstan, and by Trump Campaign 786 advisor Carter Page. As they ate, Gordon and Kislyak talked for what Gordon estimated to have been three to five minutes, during which Gordon again mentioned that he meant what he said in his speech about improving U.S.-Russia 787 relations. b. Change to Republican Party Platform In preparation for the 2016 Convention, foreign policy advisors to the Trump Campaign, working with the Republican National Committee, reviewed the 2012 Convention’s foreign policy platform to identify divergence between 788 the earlier platform and candidate Trump’s positions. The Campaign team discussed toning down language from the 2012 platform that identified Russia as the country’s number one threat, given the candidate’s belief that there needed to 789 be better U.S. relations with Russia. The RNC Platform Committee sent the 2016 draft platform to the National Security and Defense Platform Subcommittee on July 10, 2016, the evening before its first meeting to propose 790 amendments.

Although only delegates could participate in formal discussions and vote on the platform, the Trump Campaign could request changes, and members of the 791 Trump Campaign attended committee meetings. John Mashburn, the Campaign’s policy director, helped oversee the Campaign’s involvement in the 792 platform committee meetings. He told the Office that he directed Campaign staff at the Convention, including J.D. Gordon, to take a hands-off approach and only to challenge platform planks if they directly contradicted Trump’s 793 wishes. On July 11, 2016, delegate Diana Denman submitted a proposed platform 794 amendment that included provision of armed support for Ukraine. The amendment described Russia’s “ongoing military aggression” in Ukraine and announced “support” for “maintaining (and, if warranted, increasing) sanctions against Russia until Ukraine’s sovereignty and territorial integrity are fully restored” and for “providing lethal defensive weapons to Ukraine’s armed forces 795 and greater coordination with NATO on defense planning.” Gordon reviewed 796 the proposed platform changes, including Denman’s. Gordon stated that he flagged this amendment because of Trump’s stated position on Ukraine, which Gordon personally heard the candidate say at the March 31 foreign policy meeting—namely, that the Europeans should take primary responsibility for any assistance to Ukraine, that there should be improved U.S.-Russia relations, and 797 that he did not want to start World War III over that region. Gordon told the Office that Trump’s statements on the campaign trail following the March meeting underscored those positions to the point where Gordon felt obliged to 798 object to the proposed platform change and seek its dilution. On July 11, 2016, at a meeting of the National Security and Defense 799 Platform Subcommittee, Denman offered her amendment. Gordon and another Campaign staffer, Matt Miller, approached a committee co-chair and 800 asked him to table the amendment to permit further discussion. Gordon’s concern with the amendment was the language about providing “lethal defensive 801 weapons to Ukraine.” Miller did not have any independent basis to believe that this language contradicted Trump’s views and relied on Gordon’s 802 recollection of the candidate’s views.

According to Denman, she spoke with Gordon and Matt Miller, and they told her that they had to clear the language and that Gordon was “talking to New 803 York.” Denman told others that she was asked by the two Trump Campaign staffers to strike “lethal defense weapons” from the proposal but that she 804 refused. Denman recalled Gordon saying that he was on the phone with 805 candidate Trump, but she was skeptical whether that was true. Gordon denied having told Denman that he was on the phone with Trump, although he acknowledged it was possible that he mentioned having previously spoken to the 806 candidate about the subject matter. Gordon’s phone records reveal a call to Sessions’s office in Washington that afternoon, but do not include calls directly 807 to a number associated with Trump. And according to the President’s written answers to the Office’s questions, he does not recall being involved in the 808 change in language of the platform amendment. Gordon stated that he tried to reach Rick Dearborn, a senior foreign policy advisor, and Mashburn, the Campaign policy director. Gordon stated that he connected with both of them (he could not recall if by phone or in person) and apprised them of the language he took issue with in the proposed amendment. Gordon recalled no objection by either Dearborn or Mashburn and that all three Campaign advisors supported the alternative formulation (“appropriate 809 assistance”). Dearborn recalled Gordon warning them about the amendment, but not weighing in because Gordon was more familiar with the Campaign’s 810 foreign policy stance. Mashburn stated that Gordon reached him, and he told Gordon that Trump had not taken a stance on the issue and that the Campaign 811 should not intervene. When the amendment came up again in the committee’s proceedings, the subcommittee changed the amendment by striking the “lethal defense weapons” 812 language and replacing it with “appropriate assistance.” Gordon stated that he and the subcommittee co-chair ultimately agreed to replace the language 813 about armed assistance with “appropriate assistance.” The subcommittee accordingly approved Denman’s amendment but with the term “appropriate 814 assistance.” Gordon stated that, to his recollection, this was the only change 815 sought by the Campaign. Sam Clovis, the Campaign’s national co-chair and chief policy advisor, stated he was surprised by the change and did not believe it

816 was in line with Trump’s stance. Mashburn stated that when he saw the word “appropriate assistance,” he believed that Gordon had violated Mashburn’s 817 directive not to intervene. 7. Post-Convention Contacts with Kislyak Ambassador Kislyak continued his efforts to interact with Campaign officials with responsibility for the foreign-policy portfolio—among them Sessions and Gordon—in the weeks after the Convention. The Office did not identify evidence in those interactions of coordination between the Campaign and the Russian government. a. Ambassador Kislyak Invites J.D. Gordon to Breakfast at the Ambassador’s Residence On August 3, 2016, an official from the Embassy of the Russian Federation in the United States wrote to Gordon “[o]n behalf of” Ambassador Kislyak inviting Gordon “to have breakfast/tea with the Ambassador at his residence” in 818 Washington, D.C. the following week. Gordon responded five days later to decline the invitation. He wrote, “[t]hese days are not optimal for us, as we are busily knocking down a constant stream of false media stories while also preparing for the first debate with HRC. Hope to take a raincheck for another time when things quiet down a bit. Please pass along my regards to the 819 Ambassador.” The investigation did not identify evidence that Gordon made any other arrangements to meet (or met) with Kislyak after this email. b. Senator Sessions’s September 2016 Meeting with Ambassador Kislyak Also in August 2016, a representative of the Russian Embassy contacted 820 Sessions’s Senate office about setting up a meeting with Kislyak. At the time, Sessions was a member of the Senate Foreign Relations Committee and 821 would meet with foreign officials in that capacity. But Sessions’s staff reported, and Sessions himself acknowledged, that meeting requests from ambassadors increased substantially in 2016, as Sessions assumed a prominent role in the Trump Campaign and his name was mentioned for potential cabinet- 822 level positions in a future Trump Administration.

823 On September 8, 2016, Sessions met with Kislyak in his Senate office. Sessions said that he believed he was doing the Campaign a service by meeting 824 with foreign ambassadors, including Kislyak. He was accompanied in the meeting by at least two of his Senate staff: Sandra Luff, his legislative director; 825 and Pete Landrum, who handled military affairs. The meeting lasted less than 826 30 minutes. Sessions voiced concerns about Russia’s sale of a missile- defense system to Iran, Russian planes buzzing U.S. military assets in the Middle East, and Russian aggression in emerging democracies such as Ukraine 827 and Moldova. Kislyak offered explanations on these issues and complained 828 about NATO land forces in former Soviet-bloc countries that border Russia. Landrum recalled that Kislyak referred to the presidential campaign as “an 829 interesting campaign,” and Sessions also recalled Kislyak saying that the Russian government was receptive to the overtures Trump had laid out during 830 his campaign. None of the attendees, though, remembered any discussion of Russian election interference or any request that Sessions convey information 831 from the Russian government to the Trump Campaign. During the meeting, Kislyak invited Sessions to further discuss U.S.-Russia 832 relations with him over a meal at the ambassador’s residence. Sessions was non-committal when Kislyak extended the invitation. After the meeting ended, Luff advised Sessions against accepting the one-on-one meeting with Kislyak, 833 whom she assessed to be an “old school KGB guy.” Neither Luff nor Landrum recalled that Sessions followed up on the invitation or made any further effort to dine or meet with Kislyak before the November 2016 834 election. Sessions and Landrum recalled that, after the election, some efforts 835 were made to arrange a meeting between Sessions and Kislyak. According to Sessions, the request came through CNI and would have involved a meeting between Sessions and Kislyak, two other ambassadors, and the Governor of 836 Alabama. Sessions, however, was in New York on the day of the anticipated 837 meeting and was unable to attend. The investigation did not identify evidence that the two men met at any point after their September 8 meeting. 8. Paul Manafort

Paul Manafort served on the Trump Campaign, including a period as 838 campaign chairman, from March to August 2016. Manafort had connections to Russia through his prior work for Russian oligarch Oleg Deripaska and later through his work for a pro-Russian regime in Ukraine. Manafort stayed in touch with these contacts during the campaign period through Konstantin Kilimnik, a longtime Manafort employee who previously ran Manafort’s office in Kiev and who the FBI assesses to have ties to Russian intelligence. Manafort instructed Rick Gates, his deputy on the Campaign and a longtime 839 employee, to provide Kilimnik with updates on the Trump Campaign— including internal polling data, although Manafort claims not to recall that specific instruction. Manafort expected Kilimnik to share that information with others in Ukraine and with Deripaska. Gates periodically sent such polling data to Kilimnik during the campaign. Manafort also twice met Kilimnik in the United States during the campaign period and conveyed campaign information. The second meeting took place on August 2, 2016, in New York City. Kilimnik requested the meeting to deliver in person a message from former Ukrainian President Viktor Yanukovych, who was then living in Russia. The message was about a peace plan for Ukraine that Manafort has since acknowledged was a “backdoor” means for Russia to control eastern Ukraine. Several months later, after the presidential election, Kilimnik wrote an email to Manafort expressing the view—which Manafort later said he shared—that the plan’s success would require U.S. support to succeed: “all that is required to start the process is a very minor ‘wink’ (or slight push) from 840 [Donald Trump].” The email also stated that if Manafort were designated as the U.S. representative and started the process, Yanukovych would ensure his reception in Russia “at the very top level.” Manafort communicated with Kilimnik about peace plans for Ukraine on at least four occasions after their first discussion of the topic on August 2: December 2016 (the Kilimnik email described above); January 2017; February 2017; and again in the spring of 2018. The Office reviewed numerous Manafort email and text communications, and asked President Trump about the plan in 841 written questions. The investigation did not uncover evidence of Manafort’s passing along information about Ukrainian peace plans to the candidate or anyone else in the Campaign or the Administration. The Office was not, however, able to gain access to all of Manafort’s electronic communications (in

some instances, messages were sent using encryption applications). And while Manafort denied that he spoke to members of the Trump Campaign or the new Administration about the peace plan, he lied to the Office and the grand jury about the peace plan and his meetings with Kilimnik, and his unreliability on this subject was among the reasons that the district judge found that he breached his 842 cooperation agreement. The Office could not reliably determine Manafort’s purpose in sharing internal polling data with Kilimnik during the campaign period. Manafort Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ did not see a downside to sharing campaign information, and told Gates that his role in the Campaign would be “good for business” and potentially a way to be made whole for work he previously completed in the Ukraine. As to Deripaska, Manafort claimed that by sharing campaign information with him, Deripaska might see value in their relationship and resolve a “disagreement”—a reference to one or more outstanding lawsuits. Because of questions about Manafort’s credibility and our limited ability to gather evidence on what happened to the polling data after it was sent to Kilimnik, the Office could not assess what Kilimnik (or others he may have given it to) did with it. The Office did not identify evidence of a connection between Manafort’s sharing polling data and Russia’s interference in the election, which had already been reported by U.S. media outlets at the time of the August 2 meeting. The investigation did not establish that Manafort otherwise coordinated with the Russian government on its election-interference efforts. a. Paul Manafort’s Ties to Russia and Ukraine Manafort’s Russian contacts during the campaign and transition periods stem from his consulting work for Deripaska from approximately 2005 to 2009 and his separate political consulting work in Ukraine from 2005 to 2015, including through his company DMP International LLC (DMI). Kilimnik worked for Manafort in Kiev during this entire period and continued to communicate with Manafort through at least June 2018. Kilimnik, who speaks and writes Ukrainian and Russian, facilitated many of Manafort’s communications with Deripaska and Ukrainian oligarchs. i. Oleg Deripaska Consulting Work

In approximately 2005, Manafort began working for Deripaska, a Russian oligarch who has a global empire involving aluminum and power companies and 843 who is closely aligned with Vladimir Putin. A memorandum describing work that Manafort performed for Deripaska in 2005 regarding the post-Soviet republics referenced the need to brief the Kremlin and the benefits that the work 844 could confer on “the Putin Government.” Gates described the work Manafort did for Deripaska as “political risk insurance,” and explained that Deripaska used Manafort to install friendly political officials in countries where Deripaska 845 had business interests. Manafort’s company earned tens of millions of dollars from its work for Deripaska and was loaned millions of dollars by Deripaska as 846 well. In 2007, Deripaska invested through another entity in Pericles Emerging Market Partners L.P. (“Pericles”), an investment fund created by Manafort and former Manafort business partner Richard Davis. The Pericles fund was 847 established to pursue investments in Eastern Europe. Deripaska was the sole 848 investor. Gates stated in interviews with the Office that the venture led to a 849 deterioration of the relationship between Manafort and Deripaska. In particular, when the fund failed, litigation between Manafort and Deripaska ensued. Gates stated that, by 2009, Manafort’s business relationship with 850 Deripaska had “dried up.” According to Gates, various interactions with Deripaska and his intermediaries over the past few years have involved trying to 851 resolve the legal dispute. As described below, in 2016, Manafort, Gates, Kilimnik, and others engaged in efforts to revive the Deripaska relationship and resolve the litigation. ii. Political Consulting Work Through Deripaska, Manafort was introduced to Rinat Akhmetov, a 852 Ukrainian oligarch who hired Manafort as a political consultant. In 2005, Akhmetov hired Manafort to engage in political work supporting the Party of 853 Regions, a political party in Ukraine that was generally understood to align with Russia. Manafort assisted the Party of Regions in regaining power, and its candidate, Viktor Yanukovych, won the presidency in 2010. Manafort became a

close and trusted political advisor to Yanukovych during his time as President of Ukraine. Yanukovych served in that role until 2014, when he fled to Russia 854 amidst popular protests. iii. Konstantin Kilimnik Kilimnik is a Russian national who has lived in both Russia and Ukraine and 855 was a longtime Manafort employee. Kilimnik had direct and close access to Yanukovych and his senior entourage, and he facilitated communications between Manafort and his clients, including Yanukovych and multiple Ukrainian 856 oligarchs. Kilimnik also maintained a relationship with Deripaska’s deputy, 857 Viktor Boyarkin, a Russian national who previously served in the defense 858 attaché office of the Russian Embassy to the United States. Manafort told the Office that he did not believe Kilimnik was working as a 859 Russian “spy.” The FBI, however, assesses that Kilimnik has ties to Russian 860 intelligence. Several pieces of the Office’s evidence—including witness interviews and emails obtained through court-authorized search warrants— support that assessment: Kilimnik was born on April 27, 1970, in Dnipropetrovsk Oblast, then of the Soviet Union, and attended the Military Institute of the Ministry of Defense 861 862 from 1987 until 1992. Sam Patten, a business partner to Kilimnik, stated that Kilimnik told him that he was a translator in the Russian army for seven years and that he later worked in the Russian armament industry 863 selling arms and military equipment. U.S. government visa records reveal that Kilimnik obtained a visa to travel 864 to the United States with a Russian diplomatic passport in 1997. Kilimnik worked for the International Republican Institute’s (IRI) Moscow office, where he did translation work and general office management from 865 866 1998 to 2005. While another official recalled the incident differently, one former associate of Kilimnik’s at IRI told the FBI that Kilimnik was fired from his post because his links to Russian intelligence were too strong.

The same individual stated that it was well known at IRI that Kilimnik had 867 links to the Russian government. Jonathan Hawker, a British national who was a public relations consultant at FTI Consulting, worked with DMI on a public relations campaign for Yanukovych. After Hawker’s work for DMI ended, Kilimnik contacted Hawker about working for a Russian government entity on a public-relations project that would promote, in Western and Ukrainian media, Russia’s 868 position on its 2014 invasion of Crimea. Gates suspected that Kilimnik was a “spy,” a view that he shared with 869 Manafort, Hawker, and Alexander van der Zwaan, an attorney who had worked with DMI on a report for the Ukrainian Ministry of 870 ForeignAffairs. Investigative Technique█ █ █ █ █ █ █ █ █ b. Contacts during Paul Manafort’s Time with the Trump Campaign i. Paul Manafort Joins the Campaign Manafort served on the Trump Campaign from late March to August 19, 2016. On March 29, 2016, the Campaign announced that Manafort would serve 871 as the Campaign’s “Convention Manager.” On May 19, 2016, Manafort was promoted to campaign chairman and chief strategist, and Gates, who had been assisting Manafort on the Campaign, was appointed deputy campaign 872 chairman. Thomas Barrack and Roger Stone both recommended Manafort to candidate 873 Trump. In early 2016, at Manafort’s request, Barrack suggested to Trump 874 that Manafort join the Campaign to manage the Republican Convention. Stone had worked with Manafort from approximately 1980 until the mid-1990s through various consulting and lobbying firms. Manafort met Trump in 1982 875 when Trump hired the Black, Manafort, Stone and Kelly lobbying firm. Over the years, Manafort saw Trump at political and social events in New York City

and at Stone’s wedding, and Trump requested VIP status at the 1988 and 1996 876 Republican conventions worked by Manafort. According to Gates, in March 2016, Manafort traveled to Trump’s Mar-a- 877 Lago estate in Florida to meet with Trump. Trump hired him at that time. Manafort agreed to work on the Campaign without pay. Manafort had no meaningful income at this point in time, but resuscitating his domestic political campaign career could be financially beneficial in the future. Gates reported that Manafort intended, if Trump won the Presidency, to remain outside the 878 Administration and monetize his relationship with the Administration. ii. Paul Manafort’s Campaign-Period Contacts Immediately upon joining the Campaign, Manafort directed Gates to prepare for his review separate memoranda addressed to Deripaska, Akhmetov, Serhiy 879 Lyovochkin, and Boris Kolesnikov, the last three being Ukrainian oligarchs 880 who were senior Opposition Bloc officials. The memoranda described Manafort’s appointment to the Trump Campaign and indicated his willingness to consult on Ukrainian politics in the future. On March 30, 2016, Gates emailed the memoranda and a press release announcing Manafort’s appointment to 881 Kilimnik for translation and dissemination. Manafort later followed up with Kilimnik to ensure his messages had been delivered, emailing on April 11, 2016 to ask whether Kilimnik had shown “our friends” the media coverage of his new 882 role. Kilimnik replied, “Absolutely. Every article.” Manafort further asked: “How do we use to get whole. Has Ovd [Oleg Vladimirovich Deripaska] operation seen?” Kilimnik wrote back the same day, “Yes, I have been sending everything to Victor [Boyarkin, Deripaska’s deputy], who has been forwarding 883 the coverage directly to OVD.” Gates reported that Manafort said that being hired on the Campaign would be “good for business” and increase the likelihood that Manafort the approximately $2 million he was owed for previous political consulting work in 884 Ukraine. Gates also explained to the Office that Manafort thought his role on the Campaign could help “confirm” that Deripaska had dropped the Pericles lawsuit, and that Gates believed Manafort sent polling data to Deripaska (as

discussed further below) so that Deripaska would not move forward with his 885 lawsuit against Manafort. Gates further stated that Deripaska wanted a visa to the United States, that Deripaska could believe that having Manafort in a position inside the Campaign or Administration might be helpful to Deripaska, and that Manafort’s relationship with Trump could help Deripaska in other ways 886 as well. Gates stated, however, that Manafort never told him anything 887 specific about what, if anything, Manafort might be offering Deripaska. Gates also reported that Manafort instructed him in April 2016 or early May 2016 to send Kilimnik Campaign internal polling data and other updates so that 888 Kilimnik, in turn, could share it with Ukrainian oligarchs. Gates understood that the information would also be shared with Deripaska,Grand Jury█ █ █ █ 889 █ █ █ █ █ █ █ █. Gates reported to the Office that he did not know why Manafort wanted him to send polling information, but Gates thought it was a way to showcase Manafort’s work, and Manafort wanted to open doors to jobs 890 after the Trump Campaign ended. Gates said that Manafort’s instruction included sending internal polling data prepared for the Trump Campaign by 891 pollster Tony Fabrizio. Fabrizio had worked with Manafort for years and was brought into the Campaign by Manafort. Gates stated that, in accordance with Manafort’s instruction, he periodically sent Kilimnik polling data via WhatsApp; 892 Gates then deleted the communications on a daily basis. Gates further told the Office that, after Manafort left the Campaign in mid-August, Gates sent Kilimnik polling data less frequently and that the data he sent was more publicly 893 available information and less internal data. Gate’s account about polling data is consistent Grand Jury█ █ █ █ █ █ █ 894 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ with multiple emails that Kilimnik sent to U.S. associates and press contacts between late July and mid-August of 2016. Those emails referenced “internal polling,” described the status of the Trump Campaign and Manafort’s role in it, and assessed 895 Trump’s prospects for victory. Manafort did not acknowledge instructing Gates to send Kilimnik internal data, Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ 896 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ The Office also obtained contemporaneous emails that shed light on the

purpose of the communications with Deripaska and that are consistent with Gates’s account. For example, in response to a July 7, 2016, email from a Ukrainian reporter about Manafort’s failed Deripaska-backed investment, Manafort asked Kilimnik whether there had been any movement on “this issue 897 with our friend.” Gates stated that “our friend” likely referred to 898 Deripaska, and Manafort told the Office that the “issue” (and “our biggest 899 interest,” as stated below) was a solution to the Deripaska-Pericles issue. Kilimnik replied: I am carefully optimistic on the question of our biggest interest. Our friend [Boyarkin] said there is lately significantly more attention to the campaign in his boss’ [Deripaska’s] mind, and he will be most likely looking for ways to reach out to you pretty soon, understanding all the time sensitivity. I am more than sure that it will be resolved and we will 900 get back to the original relationship with V.’s boss [Deripaska]. Eight minutes later, Manafort replied that Kilimnik should tell Boyarkin’s “boss,” a reference to Deripaska, “that if he needs private briefings we can 901 accommodate.” Manafort has alleged to the Office that he was willing to brief Deripaska only on public campaign matters and gave an example: why 902 Trump selected Mike Pence as the Vice-Presidential running mate. Manafort 903 said he never gave Deripaska a briefing. Manafort noted that if Trump won, Deripaska would want to use Manafort to advance whatever interests Deripaska 904 had in the United States and elsewhere. iii. Paul Manafort’s Two Campaign-Period Meetings with Konstantin Kilimnik in the United States Manafort twice met with Kilimnik in person during the campaign period— once in May and again in August 2016. The first meeting took place on May 7, 905 2016, in New York City. In the days leading to the meeting, Kilimnik had been working to gather information about the political situation in Ukraine. That included information gleaned from a trip that former Party of Regions official Yuriy Boyko had recently taken to Moscow—a trip that likely included meetings

906 between Boyko and high-ranking Russian officials. Kilimnik then traveled to Washington, D.C. on or about May 5, 2016; while in Washington, Kilimnik had 907 pre-arranged meetings with State Department employees. Late on the evening of May 6, Gates arranged for Kilimnik to take a 3:00 908 a.m. train to meet Manafort in New York for breakfast on May 7. According to Manafort, during the meeting, he and Kilimnik talked about events in Ukraine, and Manafort briefed Kilimnik on the Trump Campaign, expecting Kilimnik to pass the information back to individuals in Ukraine and 909 elsewhere. Manafort stated that Opposition Bloc members recognized Manafort’s position on the Campaign was an opportunity, but Kilimnik did not 910 ask for anything. Kilimnik spoke about a plan of Boyko to boost election participation in the eastern zone of Ukraine, which was the base for the 911 Opposition Bloc. Kilimnik returned to Washington, D.C. right after the meeting with Manafort. Manafort met with Kilimnik a second time at the Grand Havana Club in New York City on the evening of August 2, 2016. The events leading to the meeting are as follows. On July 28, 2016, Kilimnik flew from Kiev to 912 Moscow. The next day, Kilimnik wrote to Manafort requesting that they 913 meet, using coded language about a conversation he had that day. In an email with a subject line “Black Caviar,” Kilimnik wrote: I met today with the guy who gave you your biggest black caviar jar several years ago. We spent about 5 hours talking about his story, and I have several important messages from him to you. He asked me to go and brief you on our conversation. I said I have to run it by you first, but in principle I am prepared to do it. . . . It has to do about the future of his 914 country, and is quite interesting. Manafort identified “the guy who gave you your biggest black caviar jar” as Yanukovych. He explained that, in 2010, he and Yanukovych had lunch to celebrate the recent presidential election. Yanukovych gave Manafort a large jar 915 of black caviar that was worth approximately $30,000 to $40,000. Manafort’s identification of Yanukovych as “the guy who gave you your biggest black caviar jar” is consistent with Kilimnik being in Moscow—where

Yanukovych resided—when Kilimnik wrote “I met today with the guy,” and with a December 2016 email in which Kilimnik referred to Yanukovych as 916 “BG,” Grand Jury█ █ █ █ █ █ Manafort replied to Kilimnik’s July 29 917 email, “Tuesday [August 2] is best . . . Tues or weds in NYC.” Three days later, on July 31, 2016, Kilimnik flew back to Kiev from Moscow, and on that same day, wrote to Manafort that he needed “about 2 918 hours” for their meeting “because it is a long caviar story to tell.” Kilimnik wrote that he would arrive at JFK on August 2 at 7:30 p.m., and he and Manafort 919 agreed to a late dinner that night. Documentary evidence—including flight, 920 phone, and hotel records, and the timing of text messages exchanged — 921 confirms the dinner took place as planned on August 2. As to the contents of the meeting itself, the accounts of Manafort and Gates —who arrived late to the dinner—differ in certain respects. But their versions of events, when assessed alongside available documentary evidence and what Kilimnik told business associate Sam Patten, indicate that at least three principal topics were discussed. First, Manafort and Kilimnik discussed a plan to resolve the ongoing political problems in Ukraine by creating an autonomous republic in its more 922 industrialized eastern region of Donbas, and having Yanukovych, the 923 Ukrainian President ousted in 2014, elected to head that republic. That plan, Manafort later acknowledged, constituted a “backdoor” means for Russia to 924 control eastern Ukraine. Manafort initially said that, if he had not cut off the discussion, Kilimnik would have asked Manafort in the August 2 meeting to convince Trump to come out in favor of the peace plan, and Yanukovych would have expected Manafort to use his connections in Europe and Ukraine to support 925 the plan. Manafort also initially told the Office that he had said to Kilimnik that the plan was crazy, that the discussion ended, and that he did not recall 926 Kilimnik asking Manafort to reconsider the Ian after their August 2 meeting. Manafort said Grand Jury█ █ █ █ █ ██ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ that he reacted negatively to Yanukovych sending—years later—an “urgent” 927 request when Yanukovych needed him. When confronted with an email written by Kilimnik on or about December 8, 2016, however, Manafort

928 acknowledged Kilimnik raised the peace plan again in that email. Manafort ultimately acknowledged Kilimnik also raised the peace plan in January and February 2017 meetings with Manafort, Grand Jury█ █ █ █ █ ██ █ █ █ █ █ 929 █ █ █ █ █ █ █ █ █ █ █ █ Second, Manafort briefed Kilimnik on the state of the Trump Campaign and 930 Manafort’s plan to win the election. That briefing encompassed the Campaign’s messaging and its internal polling data. According to Gates, it also included discussion of “battleground” states, which Manafort identified as 931 Michigan, Wisconsin, Pennsylvania, and Minnesota. Manafort did not refer explicitly to “battleground” states in his telling of the August 2 discussion, 932 Grand Jury█ █ █ █ █ ██ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Third, according to Gates and what Kilimnik told Patten, Manafort and Kilimnik discussed two sets of financial disputes related to Manafort’s previous work in the region. Those consisted of the unresolved Deripaska lawsuit and the funds that the Opposition Bloc owed to Manafort for his political consulting 933 work and how Manafort might be able to obtain payment. After the meeting, Gates and Manafort both stated that they left separately from Kilimnik because they knew the media was tracking Manafort and wanted 934 to avoid media reporting on his connections to Kilimnik. c. Post-Resignation Activities Manafort resigned from the Trump Campaign in mid-August 2016, approximately two weeks after his second meeting with Kilimnik, amidst negative media reporting about his political consulting work for the pro-Russian Party of Regions in Ukraine. Despite his resignation, Manafort continued to offer advice to various Campaign officials through the November election. Manafort 935 told Gates that he still spoke with Kushner, Bannon, and candidate Trump, and some of those post-resignation contacts are documented in emails. For example, on October 21, 2016, Manafort sent Kushner an email and attached a strategy memorandum proposing that the Campaign make the case against Clinton “as the failed and corrupt champion of the establishment” and that “Wikileaks provides the Trump campaign the ability to make the case in a very

credible way – by using the words of Clinton, its campaign officials and DNC 936 members.” Later, in a November 5, 2016 email to Kushner entitled “Securing the Victory,” Manafort stated that he was “really feeling good about our prospects on Tuesday and focusing on preserving the victory,” and that he was concerned the Clinton Campaign would respond to a loss by “mov[ing] immediately to discredit the [Trump] victory and claim voter fraud and cyber- fraud, including the claim that the Russians have hacked into the voting 937 machines and tampered with the results.” Trump was elected President on November 8, 2016. Manafort told the Office that, in the wake of Trump’s victory, he was not interested in an Administration job. Manafort instead preferred to stay on the “outside,” and monetize his campaign position to generate business given his familiarity and 938 relationship with Trump and the incoming Administration. Manafort appeared to follow that plan, as he traveled to the Middle East, Cuba, South Korea, Japan, and China and was paid to explain what a Trump presidency 939 would entail. Manafort’s activities in early 2017 included meetings relating to Ukraine and Russia. The first meeting, which took place in Madrid, Spain in January 2017, was with Georgiy Oganov. Oganov, who had previously worked at the Russian Embassy in the United States, was a senior executive at a Deripaska 940 company and was believed to report directly to Deripaska. Manafort initially denied attending the meeting. When he later acknowledged it, he claimed that the meeting had been arranged by his lawyers and concerned only the Pericles 941 lawsuit. Other evidence, however, provides reason to doubt Manafort’s statement that the sole topic of the meeting was the Pericles lawsuit. In particular, text messages to Manafort from a number associated with Kilimnik suggest that Kilimnik and Boyarkin—not Manafort’s counsel—had arranged the 942 meeting between Manafort and Oganov. Kilimnik’s message states that the meeting was supposed to be “not about money or Pericles” but instead “about recreating [the] old friendship”—ostensibly between Manafort and Deripaska 943 —“and talking about global politics.” Manafort also replied by text that he 944 “need[s] this finished before Jan. 20,” which appears to be a reference to resolving Pericles before the inauguration.

On January 15, 2017, three days after his return from Madrid, Manafort emailed K.T. McFarland, who was at that time designated to be Deputy National Security Advisor and was formally appointed to that position on January 20, 945 2017. Manafort’s January 15 email to McFarland stated: “I have some important information I want to share that I picked up on my travels over the last 946 month.” Manafort told the Office that the email referred to an issue regarding Cuba, not Russia or Ukraine, and Manafort had traveled to Cuba in the past 947 month. Either way, McFarland—who was advised by Flynn not to respond to 948 the Manafort inquiry—appears not to have responded to Manafort. Manafort told the Office that around the time of the Presidential Inauguration in January, he met with Kilimnik and Ukrainian oligarch Serhiy 949 Lyovochkin at the Westin Hotel in Alexandria, Virginia. During this meeting, Kilimnik again discussed the Yanukovych peace plan that he had broached at the August 2 meeting and in a detailed December 8, 2016 message found in 950 Kilimnik’s DMP email account. In that December 8 email, which Manafort 951 acknowledged having read, Kilimnik wrote, “[a]ll that is required to start the process is a very minor ‘wink’ (or slight push) from DT”—an apparent reference to President-elect Trump—“and a decision to authorize you to be a ‘special representative’ and manage this process.” Kilimnik assured Manafort, with that authority, he “could start the process and within 10 days visit Russia [Yanukovych] The Office has not uncovered evidence that Manafort br level,” and that “DT could have peace in Ukraine basically within a few months after 952 inauguration.” As noted above, Grand Jury█ █ █ █ █ ██ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ and statements to the Office, Manafort sought to qualify his engagement on and support for the plan. Grand Jury█ █ █ █ █ ██ █ █ █ █ █ 953 █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ Grand Jury█ █ █ █ █ █ █ █ █ █ 954 █ █ Grand Jury █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 955 █ Grand Jury █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ On February 26, 2017, Manafort met Kilimnik in Madrid, where Kilimnik 956 had flown from Moscow. In his first two interviews with the Office, Manafort denied meeting with Kilimnik on his Madrid trip and then—after being

confronted with documentary evidence that Kilimnik was in Madrid at the same time as him—recognized that he met him in Madrid. Manafort said that Kilimnik had updated him on a criminal investigation into so-called “black ledger” payments to Manafort that was being conducted by Ukraine’s National Anti- 957 Corruption Bureau. █ █Grand Jury█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ 958 █ █ █ █ █ █ █ Manafort remained in contact with Kilimnik throughout 2017 and into the spring of 2018. Those contacts included matters pertaining to the criminal 959 charges brought by the Office, and the Ukraine peace plan. In early 2018, Manafort retained his longtime polling firm to craft a draft poll in Ukraine, sent the pollsters a three-page primer on the plan sent by Kilimnik, and worked with 960 Kilimnik to formulate the polling questions. The primer sent to the pollsters specifically called for the United States and President Trump to support the 961 Autonomous Republic of Donbas with Yanukovych as Prime Minister, and a series of questions in the draft poll asked for opinions on Yanukovych’s role in 962 resolving the conflict in Donbas. (The poll was not solely about Donbas; it also sought participants’ views on leaders apart from Yanukovych as they pertained to the 2019 Ukraine presidential election.) The Office has not uncovered evidence that Manafort brought the Ukraine peace plan to the attention of the Trump Campaign or the Trump Administration. Kilimnik continued his efforts to promote the peace plan to the Executive 963 Branch (e.g., U.S. Department of State) into the summer of 2018. B. Post-Election and Transition-Period Contacts Trump was elected President on November 8, 2016. Beginning immediately after the election, individuals connected to the Russian government started contacting officials on the Trump Campaign and Transition Team through multiple channels—sometimes through Russian Ambassador Kislyak and at other times through individuals who sought reliable contacts through U.S. persons not formally tied to the Campaign or Transition Team. The most senior levels of the Russian government encouraged these efforts. The investigation did not establish that these efforts reflected or constituted coordination between the Trump Campaign and Russia in its election-interference activities.

1. Immediate Post-Election Activity As soon as news broke that Trump had been elected President, Russian government officials and prominent Russian businessmen began trying to make inroads into the new Administration. They appeared not to have preexisting contacts and struggled to connect with senior officials around the President- Elect. As explained below, those efforts entailed both official contact through the Russian Embassy in the United States and outreaches—sanctioned at high levels of the Russian government—through business rather than political contacts. a. Outreach from the Russian Government At approximately 3 a.m. on election night, Trump Campaign press secretary Hope Hicks received a telephone call on her personal cell phone from a person 964 who sounded foreign but was calling from a number with a DC area code. Although Hicks had a hard time understanding the person, she could make out 965 966 the words “Putin call.” Hicks told the caller to send her an email. The following morning, on November 9, 2016, Sergey Kuznetsov, an official at the Russian Embassy to the United States, emailed Hicks from his 967 Gmail address with the subject line, “Message from Putin.” Attached to the email was a message from Putin, in both English and Russian, which Kuznetsov 968 asked Hicks to convey to the President-Elect. In the message, Putin offered his congratulations to Trump for his electoral victory, stating he “look[ed] forward to working with [Trump] on leading Russian-American relations out of 969 crisis.” Hicks forwarded the email to Kushner, asking, “Can you look into this? 970 Don’t want to get duped but don’t want to blow off Putin!” Kushner stated in Congressional testimony that he believed that it would be possible to verify the authenticity of the forwarded email through the Russian Ambassador, whom 971 Kushner had previously met in April 2016. Unable to recall the Russian Ambassador’s name, Kushner emailed Dimitri Simes of CNI, whom he had consulted previously about Russia, see Volume I, Section