Overview of the Russian-Government-Directed Doppelganger Operation

36. As set forth below, since at least 2022, under the direction and control of the Russian Presidential Administration, and in particular KIRIYENKO, Russian companies, including SDA led by GAMBASHIDZE, STRUCTURA led by TUPIKIN, and ANO Dialog led by TABAK, have used the SUBJECT DOMAINS to engage in foreign malign influence campaigns (which, as noted above, are colloquially referred to as “Doppelganger”) designed to reduce international support for Ukraine, bolster pro-Russian policies, and influence voters in U.S. and foreign elections by posing as citizens of those countries, impersonating legitimate news outlets, and peddling Russian government propaganda under the guise of independent media brands.
37. In general, Doppelganger, which is under the direction and control of the Russian government, and specifically KIRIYENKO, consists of two related foreign malign influence efforts.
38. The first component of the Doppelganger campaign carried out by STRUCTURA and SDA, acting under KIRIYENKO’s direction and control, involves the creation of fake websites that mimic legitimate media outlets. Doppelganger places content on those spoofed websites that promote specific narratives identified by the Russian government to further the Russian government’s objectives, such as influencing the U.S. electorate by targeting specific audiences within the United States and elsewhere. To evade detection, Doppelganger created sophisticated cybersquatted domains (which include the SUBJECT DOMAINS) that appear to be the websites of legitimate news outlets such as Fox News, The Washington Post, and Forward, among others. In general, the cybersquatted domains appear virtually identical to their legitimate media counterparts, including through the use of the same layout and design, as well as the same trademarks, logos, and slogans, and through attributing the false articles found on the cybersquatted domain to real journalists for the legitimate outlet, with the journalists’ names, photographs, and bylines featured on the domain. In addition, links to other content on the SUBJECT DOMAINS re-route the reader to the legitimate news outlet. However, the content published on the cybersquatted domains is not the legitimate journalistic work of the impersonated media outlet and impersonated journalists; rather, the cybersquatted domains publish fake news articles that promote Russian interests without identifying, and in fact purposefully obfuscating, the Russian government or its agents as the source of the content.

39. For example, from within the Eastern District of Pennsylvania, FBI agents located and reviewed[i] six articles published on Doppelganger’s cybersquatted domain washingtonpost|.]pm. Washingtonpost|.Jpm is a nearly identical duplication of the legitimate Washington Post website.[ii] All links on washingtonpost|.]pm such as the website navigation menu, the Washington Post icon, and the byline, re-route the reader to the legitimate washingtonpost.com website. Washingtonpost[-]pm also features trademarks registered to The Washington Post. The articles published on the washingtonpost[.]pm are published under the name of a legitimate Washington Post journalist and feature his/her photograph. Based on my training, experience, and this investigation, I believe this duplication is likely to mislead or confuse U.S. persons and other readers into believing that the Russian propaganda presented in the article is from a legitimate U.S.-based news organization. A search for the articles located on washingtonpost[.Jpm or substantially similar content on washingtonpost.com yielded negative results, as did a review of the legitimate Washington Post journalist’s published articles on washingtonpost.com.
40. The articles located on washingtonpost[.]pm present a pro-Russia and anti-Ukrainian viewpoint, and many of the articles focused on U.S. policy or politics. None of the articles include attribution to SDA, STRUCTURA or the Russian government. For example, one article is titled White House Miscalculated: Conflict with Ukraine Strengthens Russia” and purports to be authored by a Washington Post reporter. The article states, in part:

It is time for our leaders to recognize that continued support for Ukraine is a mistake. It was a waste of lives and money, and to claim otherwise only means further destruction. For the sake of everyone involved in the conflict, the Biden administration should just make a peace agreement and move on.

See Exhibit 1 for illustrative examples of the cybersquatted domains.

41. To distribute their propaganda without attribution to the Russian government, Doppelganger created social media profiles posing as U.S. (or other non-Russian) citizens. These profiles then posted comments on social media platforms with links to the cybersquatted domains to trick viewers into believing they were visiting a legitimate news outlet.

42. The cybersquatted domains used by Doppelganger generally are not indexed by search engines. A visit to the standalone domain, such as www.washingtonpost[.]pm, reveals a blank page or an error page. Rather, as its primary method of distribution, Doppelganger created fraudulent social media personas impersonating U.S. citizens to post article-specific extended hyperlinks to the cybersquatted domains on those social media platforms.> To further disseminate their propaganda beyond social media posts, Doppelganger also purchased and placed advertisements on social media platforms[iii] to drive traffic to their articles. Based on my training and experience, I believe Doppelganger distributes its propaganda in this manner in order to obscure from Americans and other targeted readers the fact that they are not visiting a legitimate news outlet.
43. The second component of the Doppelganger campaign, carried out by ANO Dialog and TABAK, acting under KIRIYENKO’s direction and control, focused on creating original brands (which include the SUBJECT DOMAINS) to disseminate Russian propaganda. These brands purport to be independent journalists or independent news media organizations but actually published content under the direction and control of the Russian government. As discussed below, the same articles would appear on both the cybersquatted domains and the ANO Dialog media brands, which indicates to me that ANO Dialog and SDA/STRUCTURA acted in close coordination under the direction and control of the Russian government and KIRIYENKO.
44. As detailed below, individuals associated with Doppelganger who are believed to be based in Russia or elsewhere outside the United States have transferred funds from outside the United States to lease most of the SUBJECT DOMAINS from United States-based domain registrars or registries at the direction and control of, and for the benefit of, sanctioned persons, including KIRIYENKO, GAMBASHIDZE, SDA, TUPIKIN, and STRUCTURA. These criminal actors did not obtain an OFAC license before leasing the SUBJECT DOMAINS. Because they have transferred funds from or through a place outside the United States to a place within the United States, with the intent to promote a specified unlawful activity (here, an IEEPA violation), there is probable cause to believe they have violated U.S. money laundering laws. In addition, the conspirators took steps to make each of the SUBJECT DOMAINS available on the Internet, including in the Eastern District of Pennsylvania. As set forth below, the conspirators specifically targeted the Commonwealth of Pennsylvania’s citizens, including those located in the Eastern District of Pennsylvania, in order to influence the electorate in this, and other districts.

45. In addition, and as detailed further below, there is probable cause to believe that a subset of the SUBJECT DOMAINS is being used or is intended to be used to commit or facilitate trafficking in counterfeit goods or services. These SUBJECT DOMAINS feature registered marks The Washington Post logo, for example that are identical to, or substantially indistinguishable from, marks registered on the Principal Register maintained by the USPTO and that are in use by the mark holder. The SUBJECT DOMAINS use these marks in connection with goods or services that are the same as those for which they are registered on the Principal Register and the SUBJECT DOMAINS’ use of the marks is likely to cause confusion, mistake, or to deceive the public. As set forth below, the infringing SUBJECT DOMAINS were accessed from the Eastern District of Pennsylvania and thus the infringing goods passed through Eastern District of Pennsylvania.
46. Public Reporting on Doppelganger
47. In July 2023, the European Union (EU”) sanctioned seven Russian individuals and five Russian entities for their role in Doppelganger. Among the entities and individuals sanctioned by the EU were SDA, STRUCTURA, GAMBASHIDZE, and ANO Dialog. In so doing, the EU explained:

Russian actors have conducted a digital information manipulation campaign named ‘RRN’ (Recent Reliable News) aiming at manipulating information and disseminating propaganda in support of Russia’s war of aggression against Ukraine. That campaign, in which government bodies or bodies affiliated to the Russian State have participated, relies on fake web pages usurping the identity of national media outlets and government websites as well as fake accounts on social media.[iv]

STRUCTURA and SDA were identified as “the key actor[s] of the campaign, responsible for the creation of fake websites impersonating government organizations and legitimate media in Europe (primarily Germany, France, Italy, Ukraine and the United Kingdom) and for boosting the pro- Russian ‘RRN’ campaign on social media.”

47. On July 19, 2023, the Viginum Agency (“VIGINUM”), a French government agency tasked with vigilance and protection against foreign digital interference, which operates under the authority of the Secretariat-General for National Defense and Security, highlighted Doppelganger’s creation and operation of cybersquatted domains:

Since February 2023, VIGINUM has noticed an increasing number of impersonations of major French and foreign media outlets, in order to publish pro-Russian articles linked to the war in Ukraine. The appearance of typosquatted websites is in every way similar to that of the media outlets they are impersonating, the only difference being the visited URL. The domain names of typosquatted media outlets use the same source code as that of legitimate media outlets: most of the links on the legitimate website are downloaded on the typosquatted website, which lends it credibility in the eyes of unsuspecting users.

48. VIGINUM also highlighted Doppelganger’s use of Facebook pages and advertisements to disseminate disinformation. According to VIGINUM, “Since February 2023, more than 160 Facebook pages have been identified by VIGINUM, posting more than 600 sponsored content containing links to articles and websites linked to the campaign.” As described below, the investigation has revealed that Doppelganger purchased numerous social media advertisements targeting U.S. politicians and relied on artificial intelligence to generate the content.

1. The Russian Presidential Administration, through KIRIYENKO, Exercises Direction and Control Over Doppelganger

49. GAMBASHIDZEtook extensive notes documenting meetings between KIRIYENKO, SDA, STRUCTURA, TUPIKIN, ANO Dialog, members of the Russian government like Sofia Zakharova (“Zakharova”), and others involved in Doppelganger. GAMBASHIDZE’s notes include contact lists, staff lists, task or to-do lists, and potential ideas for malign foreign influence campaigns. Between April 2022 and April 2023, GAMBASHIDZE took notes related to at least 20 Russian Presidential Administration meetings.
50. For example, one note was titled Meeting with SVK at the AP”[v] and dated April 16, 2022. I assess that AP is an abbreviation for Administratsiya Prezidenta, which translates from Russian to English as the Presidential Administration. Based on the context and content of the meeting notes, other records obtained during this investigation, and the supervisory role that SVK appears to play in the Doppelganger campaign, I assess that SVK is a reference to Sergei Vladilenovich KIRIYENKO. As noted above, KIRIYENKO has been sanctioned and described by OFAC as “the First Deputy Chief of Staff of the Presidential Office” and reportedly “Putin’s domestic policy curator.” KIRIYENKO is frequently referred to in Russian and Western media as “Putin’s right-hand man.” In addition, the notes refer to Russian President Vladimir Putin and reveal that SVK, who is also referred to as Sergey in the notes, is overseeing and directing the malign foreign influence efforts described herein.
51. That note from April 16, 2022 details a meeting led by SVK at which “SVK was taking detailed notes'” to discuss bolstering support for Russia’s invasion of Ukraine. The meeting participants discussed topics for propaganda, and SVK provided his opinion, with GAMBASHIDZE recording SVK’s response to the ideas as “well received’, “need to work’, or “the right thing to do.” SVK told the group they must use two mechanisms “to be effective: 1. Creating of a nuclear psychosis. The USA have been prepping Europe for a big war with the Russian Federation. War for peace. 2. Exaggeration.” While GAMBASHIDZE’s note contains passing references to other meeting participants, the most substantive details recorded were when SVK provided his opinion or instructions. This note also makes reference to “Tabak.”I assess that the “Tabak” referenced in GAMBASHIDZE’s notes is Vladimir TABAK, the head ofANO Dialog.

52. On July 13, 2022, GAMBASHIDZE wrote a note titled Miutes of the Meeting at the AP on July 13, 2022.” The note listed meeting participants as “Stas, Sofia, Ilya, and Sergey.” I assess that the Sofia referenced is likely Sofia Zakharova, a Russian Presidential Administration spokesperson. Zakharova is a Kremlin official who has also focused on information technology and communications infrastructure. Zakharova has regularly taken part in conferences and events dedicated to artificial intelligence.[vi] Based on my training, experience, and information gathered through this investigation, I assess that the IIya referenced is Ilya GAMBASHIDZE and that the Sergey referenced is KIRIYENKO. GAMBASHIDZE’s note identifies KIRIYENKO, as “SVK”, telling the meeting participants, “it s an impossible task,” which I assess to be a reference to the difficulties in effectuating the Doppelganger campaign. GAMBASHIDZE notes that the participants had initially talked him into five countries. Now he says no.” Based on the context of the note and this investigation, I assess that “him” and “he” refers to KIRIYENKO. GAMBASHIDZE records that the group agreed “the Germans are more dependent than the French” and decided to focus its efforts on the Germans. In particular, the group agreed that “first and foremost, we need to discredit the USA, Great Britain and NATO, and secondly, we need to convey the truth about the war in Ukraine” and the need to convince Germans to oppose the “inefficient politics of sanctions.”
53. According to the note, the participants used the remainder of the meeting to discuss anti-Ukrainian, pro-Russian narratives to distribute, with a focus on Germany. GAMBASHIDZE noted “They were assigned Russian Reliable News -changed it into Recent, it ‘s going to work. (was sent by Tabak).
54. GAMBASHIDZE referenced SVK in six other notes in addition to the two described above. According to a note titled Meeting Minutes AP 25.07.22 – 1l.00″ SVK and others again discussed targeting Germany. SVK suggested in order to normalize relations, it is necessary to show who caused them to deteriorate,” and directed the meeting participants to influence German-Russian relations. The notes indicate that Sofia, whom I assess to be Zakharova, instructed the creation of”websites to tell the Germans the truth!” Another participant suggested using “real facts to complement fake facts.” One suggestion included trying to “make a fake on an American soldier that raped a German woman. That would be great!” Another note, titled AP Meeting Minutes, Monday, January 16° referenced another party as being “fully in charge of filling the content on the Ukraine Tribunal portal.” That note also indicated a topic for business-elites” as “Bypassing sanctions: they don t need to be lifted, they need to be bypassed.'”
55. Although five of the notes did not list SVK as a participant, the meeting notes indicate that the meetings discussed presentations, reports, and metrics related to Doppelganger for SVK’s review and awareness as well as his reactions to, and approval of, various products. For example, in a note titled “Minutes of the Meeting at the AP, August 1, 2022″, GAMBASHIDZE mentioned that articles would be submitted to SVK’s office and that so far three were well received.” Other notes mentioned creating reports or presentations for SVK, to include media monitoring. Another note, “Minutes – ECC AP 05.04.23”, included a discussion of resources, wherein a participant reported “SVK is not against including our influencers abroad.”[vii] That note referenced a French businessman whom the participants believed could do an “interview” for “RRN.” A note titled “Meeting Minutes – AP_01.18.23°” refers to SVK as “listening to no more than ten newsworthy events” and notes that “we need to create our OWN concept based on Ukraine monitoring and Tabak ‘s concept.” GAMBASHIDZE noted, “They are expecting fake news from us every day”
56. At least 13 of the meeting notes listed “SAZ” as a meeting participant, which I assess to be a reference to Zakharova due to her initials and the use of Sofia in the body of some notes. Based on my training, experience, this investigation, and the context and content of the notes, I assess that Zakharova reported to KIRIYENK0 and conveyed information regarding these meetings to and from KIRIYENKO for his approval and further direction.
57. One note ofa January 13, 2023, meeting attended by GAMBASHIDZE, Zakharova and others mentioned they had reported to the President about the project.” I assess that “the President” refers to Russian President Vladimir Putin. The note stated that the participants should not constrain themselves to specific countries; rather, false stories spread could be initiated everywhere, in different countries, even launched through media.” The note referenced specific campaigns, including the use of influencers, a “media cluster” with “40-50 websites per country” which I assess refers to creating unique media brands led by ANO Dialog, and making “political animated movies.” After mentioning “our fakes will be restored’, “the lAG team” was specifically assigned to work on “analytical products and videos.” I assess that IAG is a reference to GAMBASHIDZE.
58. In addition to foreign influence campaigns, Doppelganger also appears to have conducted influence campaigns domestically within Russia, underscoring its close ties to the Russian government. For example, one note indicates that the project could be used for P’s election campaign” which I assess to be a reference to Russian President Putin. Likewise, a different meeting note from a meeting SAZ attended indicated the group discussed “Putin team– example of work for the upcoming campaign” and explained that “Our battlefield is here. That s why men are not in Donbas,”

59. Another note, titled “Meeting Minutes – AP Factory 01.27.23″ includes the instruction that “When providing a narrative it s important to remember that this is from a German to a German, from a Frenchman to a Frenchman’!” I assess this to be a reference to the Doppelganger’s strategy of posing as citizens of other countries in order to influence their publics.
60. Internal SDA Documents, Correspondence, and Notes Take Credit for the Doppelganger Campaign and Discuss SDA’s Overarching Foreign Malign Influence Strategy

60. An SDA internal document titled “Countermeasures by foreign agencies and organizations” which recounted that the ‘collective West’ countries are seriously concerned by the effectiveness of the project” and that, along with “major online platforms, factcheckers and investigators” they have “been involved in the effort of countering our narratives since September 2022.” The document went on to list and summarize 15 publications from various news sources and organizations, such as Meta, Premier Ministre, The Washington Post, Wired, and Le Monde, which discussed Doppelganger. I believe this document reflects SDA’s acknowledgment of its role in Doppelganger. See Exhibit 2.[viii]
61. In a similar vein, another SDA document highlighted social media companies’ attempts to combat SDA, STRUCTURA, and ANO Dialog’s propaganda by identifying the cybersquatted domains, as well as RRN, as suspicious and blocking them. The document set out a plan to combat the social media companies’ disruption efforts by posting comments through social media accounts to complements their use of bots and further publicize their narratives. The plan was to post “60,000 comments per month for France and Germany combined.” See Exhibit 3.
62. SDA also possessed at least 27 invoices for the equivalent of thousands of U.S. dollars’ worth of translation services. These invoices requested payments for the translation of files, identified by the file name. The file names on the invoices appear to correspond to the headlines of articles published on the cybersquatted domains, including certain SUBJECT DOMAINS. For example, one SDA invoice dated December 18, 2023, contained six file names, which matched articles found either on washingtonpost[.Jpm or fox-news[.Jin. One of the partial headlines listed on the SDA invoice was “Middle East Coalition of US Allies Crumbles.” I have located and reviewed a corresponding article published on washingtonpost[.]pm that is titled “Middle East Coalition of US Allies crumbles like a House of Cards.” Accordingly, I believe these invoices reflect SDA’s payment for Doppelganger-related services. See Exhibit 1 at 6.
63. Multiple SDA documents detail SDA’s strategy for implementing its foreign malign influence campaigns. Among these documents is what appears to be an initial concept plan for the Doppelganger campaign, which specifically referenced GAMBASHIDZE, and noted if we can, we needa separate department for fakes – a factory!”[ix] The document indicated the campaign would target England, Germany, and Italy and would have “Two news sites: English-language and German-speaking.”[x]

64. A hallmark of the Doppelganger campaign was to impersonate U.S. and other non- Russian citizens through the creation of fake social media profiles. Then, that social media profile, posing as an American or other non-Russian citizen, would post comments or other content promoting a pro-Russian narrative and include a hyperlink to the cybersquatted domain impersonating a legitimate news outlet like The Washington Post or Fox News. Using this manner of distribution, KIRIYENKO, GAMBASHIDZE, TUPIKIN, SDA, and STRUCTURA are able to mislead, for example, American citizens into believing they are seeing the viewpoints of a fellow American citizen, rather than the Russian governments view. SDA documents provide detailed instructions on how these fake American social media profiles should distribute Doppelganger content through social media platforms. For example, SDA documents provide instructions and exemplar social media posts designed to influence the U.S. election. One such document first sets out what appears to be an article, written in English, likely to be published on one of the cybersquatted domnains with the headline “U.S. Loses Its Position as a World Leader by Making Too Many Mistakes” under the heading of “International Politics.” The document envisions the creation of social media profiles posing as American citizens “living in a small town,” which would post comments linking to the article in order to influence the views of actual American voters. That document also provided suggested English-language comments for use in distributing the article on social media. See, e.g., Exhibit 4, Exhibit 5.
65. Another 26-page SDA manual set forth a plan for a campaign targeting the Ukrainian public. The manual showed SDA dividing its influence campaigns into four sections: “monitoring, analytics, content production, and content delivery.” See Exhibit 6. This manual described SDA’s efforts to create “articles (long reads)” which were “original texts ranging from 2,000 to 5,000 characters with spaces, devoted to topics relevant to the Ukrainian audience, which fit into the main subject areas of the project. Each text is professionally edited and accompanied by 10 comments and 3 teasers for disseminating the text on social networks.” I assess that SDA’s reference to these articles, or “long reads”, refer to the original content produced by Doppelganger and intended to be posted on domains SDA controls, including the SUBJECT DOMAINS, and which may also be distributed through ANO Dialog’s unique media brands. Further, I assess that the reference to “10 comments and 3 teasers” refers to SDA’s practice of spreading Doppelganger content by posting links to the cybersquatted domains through proposed social media comments, as discussed in the preceding paragraphs.
66. SDA documents further reveal that SDA extensively monitors and collects information about a large number of media organizations and social media influencers. One document revealed a list of more than 2,800 people on various social media platforms like Twitter, Facebook and Telegram, spanning 81l countries, that SDA identified as influencers, including television and radio hosts, politicians, bloggers, journalists, businessmen, professors, think-tank analysts, veterans, professors, and comedians. When referring to politicians, the list often mentioned which U.S. state and/or political party they represent and the position they hold in Congress. The U.S.-based influencers accounted for approximately 21% of the accounts being monitored by SDA. On another list of over 1,900 anti-infuencers”[xi] from 52 countries, the U.S.-based accounts comprised 26% of the total accounts being monitored by SDA. I assess that anti-influencer” indicates that the account posts content that SDA views as contrary to Russian objectives. Based on my review of other records obtained during this investigation, I know that SDA adds information captured through its monitoring efforts to dashboards. These dashboards analyze trends in public opinion and thereby measure the effectiveness of the malign foreign influence campaign based on its impact on public opinion. SDA’s content varies from project to project; however, it can include videos, memes, cartoons, social media posts, and/or articles. SDA’s content delivery also varies each campaign, but often relies heavily on social media posts driving targeted audiences to domains SDA controls, like the SUBJECT DOMAINS.
67. One SDA document outlined a project titled International Conflict Incitement” which targeted Germany and France. As described by SDA, the

objective of the ‘International Conflict Incitement’project is to escalate internal tensions in the countries allied with the United States in order to promote the interests of the RuSsian Federation on the international arena. To influence real- life conflicts and artificially create conflict situations, it is proposed to use a wide range of information tools to influence public opinion.

SDA intended for its project to result in the “fe]scalation of the conflict situation through the use of available tools (traffic redirection, work with comments, work with influencers, analytical articles, augmented reality, media mirror outlets, fakes, etc.) in order to destabilize the societal situation.” I believe “media mirror outlets” is the term SDA used to refer to Doppelganger’s use of cybersquatted domains to impersonate legitimate news outlets. The project intended to artificially generate conflicts through, among other things, “spreading additional false narratives'”; fake videos, documents, and telephone conversation recordings”; “comments on social media”; and “fake and real quotes from influencers”. The project identified the “media mirrors outlets”; foreign and Russian influencers” and “bots and work with comments;” as “delivery channels” for the project. See Exhibit 7.

68. In another document, SDA summarized its campaign against Germany, identifying three major themes: (1) “HOHLI– pigs”;[xii] (2) “The difference between Ukraine and Germany”; and (3) *” The U.S. is behind everything.”[xiii] It also included 43 ideas for propaganda, which were all associated with one or more of the three themes listed above. The document placed each idea into a table, complete with the target audience and media type. For example, one idea for “The U.S. is behind everything,” theme was a “screenshot of the publication with a photo of the US Embassy in Germany. Headline: Scholz became employee of the month at the US Embassy.” This screenshot and headline were meant to impress upon viewers that the U.S. directs German policy.

[i] The FBI used the WayBack Machine to locate articles published on the cybersquatted domains. The Wayback Machine is a digital archive of the World Wide Web founded by the Internet Archive, an American nonprofit organization, that allows the user to go “back in time” to see how websites looked in the past. See EVO Brands, LLC v. Al Khalifa Group LLC, 657 F. Supp. 3d 1312, 1322-23 (C.D. Cal. 2023) (collecting cases and noting that “[c]ourts have taken judicial notice of internet archives in the past,

[ii] including Archive.org’s Wayback Machine, finding that Archive.org possesses sufficient indicia of accuracy that it can be used to readily determine the various historical versions of a website'”).

[iii] For example, while a visit to www.foxnews.cx would reveal a blank or error page, a visit to www.foxnews.cx/world/US-Decided-to-Trade-Ukraine-for-Security.html would reveal the active cybersquatted website with an article and the re-routing links to the legitimate Fox News.

[iv] Regulations, Official Journal of the Europcan Union, L 190, Vol. 66 (28 July 2023) available at https:/leur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri-0J:L:2023:1901:FULL.

[v] Virtually all records discussed herein were in the Russian language. Throughout this affidavit, italicized quoted language indicates a verbatim translation, whereas plaintext quoted language indicates a summary translation. Exhibits 2B through 13B to this affidavit have been translated verbatim. All translations were completed by FBI linguists.

[vi] See htps://www.voanews.com/alinvestigation-who-is-ilya-gambashidze-the-man-the-us-government- accuses-of-running-a-kremlin-disinformation-campaign-/7604052. html

[vii] Another meeting note indicated that we need influencers! A lot of them and everywhere. We are ready to wine and dine them.

[viii] Attached as Exhibits to this affidavit are the original Russian-language SDA documents lawfully obtained during this investigation (see Exhibits 2B through 13B) as well as English-language translations (see Exhibits 2A through 13A). All of the SDA documents were obtained prior to June 1, 2024. Consistent with Department of Justice policy, redactions have been applied to certain identifiers contained within the documents. The terms substituted in place of those identifiers in the English language translations relate to the status of those persons or entities at the time the documents were obtained.

[ix] This translation was completed using machine translation software.

[x] This translation was completed using machine translation software. As discussed below, I assess that these two “news” websites are likely references to RRN and Journalisten Freikorps.

[xi] This translation was completed using machine translation software.

[xii] After consulting with Ukrainian and Russian spcaking FBI employees, I have learned that this term is a derogatory word for Ukrainians.

[xiii] This translation was completed using machine translation software.