The government has known that Lev Parnas attempted to delete some or all of his iCloud content since shortly after October 21, 2019 — 2 weeks before it obtained covert warrants for Rudy Giuliani and Victoria Toensing’s iCloud accounts.

On January 17, 2020 (note the date on the letter has the wrong year) — the same day Jeffrey Rosen issued a memo prohibiting any DOJ personnel from expanding the scope of any investigation involving Ukraine without his and Richard Donoghue’s approval — Parnas asked to modify his protective order so he could share materials seized from his iCloud on that October date with the House Intelligence Committee for their impeachment investigation.

In a memo objecting to that request, the government noted that Parnas was perfectly free to download his own iCloud and share it with HPSCI — and asserted he had already done so.

Additionally, to the extent Parnas seeks to produce his own texts, emails, photographs or other materials, he should have access to the content stored on his iCloud account through other means: he can simply download his own iCloud account and produce it to HPSCI (and in fact, it appears he has already done so)

Parnas needed to ask the government, however, because he had deleted some of the material after the government had already obtained a preservation order for his account, meaning the government had the content but Parnas no longer did.

The materials at issue include records that, as far as the Government knows, were never in Parnas’s possession. For instance, the data produced by Apple includes deleted records (which may only exist because of the Government’s preservation requests), account usage records, and other information to which a subscriber would not necessarily have access.

The government asked for Parnas to identify the previously deleted chats he wanted to share with Congress so his co-defendants could raise privilege concerns.

To the extent that Parnas has deleted materials from his iCloud account, the Government is willing to work with counsel to ensure that Parnas can produce his own materials that are responsive to the Congressional request to HPSCI. To that end, the Government respectfully submits that Parnas’s counsel should identify for the Government any specific chats, emails, photographs, or other content Parnas is unable to access from his iCloud currently, but which exist within the discovery that has been produced to him and in his view are responsive to the Congressional subpoena. Requiring Parnas to specifically identify these materials would also permit his co-defendants to raise any concerns with respect to their privilege or privacy interests prior to the materials’ release.

“Tell us which of these texts you attempted to delete you think are the most incriminating to Rudy,” they effectively invited Parnas to explain back in early 2020, as the filter team would have just started wading through Rudy’s already seized iCloud content.

Parnas’ failed attempt to delete sensitive content that would be pertinent to the impeachment inquiry puts Rudy’s wails of outrage that the government successfully persuaded Judge Paul Oetken that if they didn’t obtain this content covertly, it might get deleted in a very different light.

In addition, in the original warrant for the iCloud account, there is a nondisclosure order based upon an allegation made to the issuing Court, that if Giuliani were informed of the existence of the warrant, he might destroy evidence or intimidate witnesses. Such an allegation, on its face, strains credulity. It is not only false, but extremely damaging to Giuliani’s reputation.

Indeed, DOJ may well have been seeking information that Parnas had successfully deleted elsewhere. Parnas seems to think that’s what happened. In his request to get access to the stuff seized from Rudy’s phone, he states that the newly disclosed materials “likely” include communications involving him “that may have been deleted.”

The seized evidence will also likely contain a number and variety of communications between Giuliani and Toensing and Parnas that are directly discoverable under Fed. R. Crim. P. 16, evidence of any conversations between Giuliani, Toensing, and others, including Parnas, that may have been deleted, communications between Giuliani, Toensing and others about the defendants and how to address their prior relationships, the arrests, and the unfolding investigation, communications between Giuliani and Toensing and others with potential Government witnesses, including communications about the defendants, the offenses charged, and the witnesses’ potential disclosures and characterizations of alleged fraud-loss computations.

Meanwhile, the government made an interesting observation in their original request for a Special Master.

Based on the Government’s investigation to date, given the overlap in date range and because certain materials, including certain emails and text messages, were backed up to the iCloud accounts that were searched pursuant to these prior warrants, the Government expects that some, but not all, of the materials present on the electronic devices seized pursuant to the Warrants could be duplicative of the materials seized and reviewed pursuant to the prior warrants.

After admitting the government expects significant overlap between what they got in 2019 and what they got in April because “certain materials” were backed up to the cloud, the government notes that “not all” of what they expect to be on the devices will be duplicative. Some of the new material will pertain to a slightly different date range on the searches. But another cause would be if Rudy and Toensing deleted stuff that could be obtained from their phone.

The investigative team has gotten deep enough in the iCloud material seized in 2019 to identify files that they know existed but were deleted from the iCloud backup, which might be recoverable from a device.

Rudy, in a “doth protest too much” theme in his letter insists he didn’t delete anything but if he did he wasn’t under subpoena anyway.

Despite these two warnings that the SDNY was seeking permission to apply for a search warrant for his electronic devices and because he had no guilty conscience, Giuliani took no steps to destroy evidence or wipe the electronic devices clean. Since Giuliani was not under subpoena, he had no legal obligation to preserve that evidence, but he did so because he is an innocent man who did nothing wrong.

[snip]

Again, all of this took place without Mayor Giuliani or his counsel having any idea that a year and a half prior, the Giuliani iCloud was the subject of a warrant. Giuliani and his counsel were both aware, because of the prominent leaks to the media, of the failed attempts in November of 2020 and again in January of 2021, to gain the required Justice Department permission to search a lawyer’s office and residence. If Giuliani was inclined, there was ample notice and time to destroy evidence.

Aside from mentioning the basis for the covert warrants, Toensing didn’t address whether any data got destroyed.

Whatever exigent circumstances the Government asserted to instead justify covert and overt search warrants in this instance were satisfied when the information was secured and preserved. The information should now be returned to Ms. Toensing and her counsel for a privilege and responsiveness review under the supervision of a Special Master. Moreover, the Government should disclose what seized information it has already reviewed and whether and what information it has provided to the case team.

She just wants everything back so she can restart the process, along with some kind of indication of what the government has already seen.

Rudy, similarly, wants to know what the government knows.

Lastly, Giuliani is entitled to the production of Apple’s entire search warrant return production, as well as the material previously deemed non-privileged and responsive and relevant to the 2019 Search Warrant by the “filter” team.

But Judge Paul Oetken, who found cause for the non-disclosure order back in 2019, was thoroughly unimpressed with all these claims about whether things might have been deleted. As he noted, the search is done.

Moreover, the review of the 2019 warrant returns is now largely complete. And any pre-indictment suppression motion would be premature at this juncture.

Rudy and Toensing can complain if they get charged.