Case 8:19-cr-00061-JVS Document 49 Filed 07/22/19 Page 1 of 12 Page ID #:479

Case 8:19-cr-00061-JVS Document 49 Filed 07/22/19 Page 1 of 12 Page ID #:479
1 NICOLA T. HANNA
United States Attorney
2 BRANDON D. FOX
Assistant United States Attorney
3 Chief, Criminal Division
JULIAN L. ANDRÉ (Cal. Bar No. 251120)
4 Assistant United States Attorney
Major Frauds Section
5 1100 United States Courthouse
312 North Spring Street
6 Los Angeles, California 90012
Telephone: (213) 894-6683
7 Facsimile: (213) 894-6269
Email: Julian.L.Andre@usdoj.gov
8
BRETT A. SAGEL (Cal. Bar. No. 243918)
Ronald Reagan Federal Building
10 411 West Fourth Street, Suite 8000
Santa Ana, California 92701
11 Telephone: (714) 338-3598
Facsimile: (714) 338-3708
12 Email: Brett.Sagel@usdoj.gov
13 Attorneys for Plaintiff

UNITED STATES OF AMERICA
14
UNITED STATES DISTRICT COURT
15
FOR THE CENTRAL DISTRICT OF CALIFORNIA
16
UNITED STATES OF AMERICA, SA CR No. 19-061-JVS
17
Plaintiff, STATUS REPORT REGARDING THE
18 GOVERNMENT’S PRIVILEGE REVIEW
v.
19
MICHAEL JOHN AVENATTI,
20
Defendant.
21
22
23 Pursuant to the Court’s July 8, 2019, Minute Order (CR 45),
24 plaintiff United States of America, by and through its counsel of
25 record, the United States Attorney for the Central District of
26 California and Assistant United States Attorneys Julian L. André and
27 Brett A. Sagel, hereby files its Status Report regarding the United
28 States Attorney’s Office for the Central District of California’s

1 privilege review of evidence obtained during the course of the
2 investigation of defendant MICHAEL JOHN AVENATTI.
3 Dated: July 22, 2019 Respectfully submitted,
4 NICOLA T. HANNA
United States Attorney
5
BRANDON D. FOX
Chief, Criminal Division
7
8
JULIAN L. ANDRÉ
9 BRETT A. SAGEL
Assistant United States Attorneys
10
Attorneys for Plaintiff
11 UNITED STATES OF AMERICA
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2
1 STATUS REPORT REGARDING PRIVILEGE REVIEW

2 I. INTRODUCTION
3 Pursuant to the Court’s July 8, 2019, Minute Order (CR 45), the
4 United States Attorney’s Office for the Central District of
5 California (the “USAO”) submits this status report to address the
6 following topics raised during the July 8, 2019, status conference:
7 1. The status of the USAO’s ongoing privilege review of
8 evidence obtained during the course of its investigation of defendant
9 MICHAEL JOHN AVENATTI (“defendant”) and an anticipated timeline for
10 production of documents to the defense.
11 2. The production of forensic copies of digital devices to
12 defendant and information regarding possible methods for defendant to
13 review the forensic copies that have been produced.
14 3. Issues relating to the four inaccessible digital devices
15 that law enforcement seized from defendant’s residence and from
16 defendant’s person during his March 25, 2019, arrest.
17 This Status Report is based on the information currently
18 available to the USAO’s Prosecution Team. To the extent the USAO
19 learns of additional information that may affect the issues addressed
20 herein, the USAO will immediately advise the Court and defendant.
21 II. THE USAO’S PRIVILEGE REVIEW

22 A. Evidence To Be Reviewed
23 As set forth in the parties’ July 1, 2019, Joint Report (CR 43),
24 the Internal Revenue Service – Criminal Investigation (“IRS-CI”)
25 obtained the following digital devices or forensic copies thereof
26 during the course of its investigation:
27 1. The computer server belonging to defendant’s former law
28 firm, Eagan Avenatti LLP (“EA LLP”);

1 2. Digital devices seized from the residence of EA LLP’s
2 former office manager (“EA Employee 1”), which the USAO understands
3 belong to EA LLP or are the personal property of EA Employee 1;
4 3. Digital devices seized during defendant’s arrest on March
5 25, 2019;
6 4. Digital devices seized from defendant’s residence;
7 5. Digital devices seized from another law firm with which
8 defendant had a business relationship (“Law Firm 1”); and
9 6. Digital devices obtained from former employees of
10 defendant’s coffee company, Global Baristas U.S. LLC (“GBUS”).
11 The USAO understands that the devices referenced above contain a
12 total of approximately 20 terabytes (“TB”) of data. The USAO and
13 IRS-CI obtained warrants to search each of these devices for evidence
14 relating to the investigation of defendant.
15 IRS-CI also seized approximately 15 to 20 boxes of hard-copy
16 materials during the execution of search warrants at defendant’s
17 residence, EA Employee 1’s residence, and Law Firm 1’s business
18 premises.
19 B. Status of the Privilege Review

20 The USAO and IRS-CI are reviewing the contents of the digital
21 devices referenced above, pursuant to the privilege review and other
22 search protocols set forth in the applicable search warrants. The
23 search warrants issued in connection with this investigation require
24 the USAO and IRS-CI to follow specific procedures when reviewing
25 digital devices and other evidence in order to avoid unnecessary
26
27
28
2
1 disclosures of attorney-client communications or attorney work
2 product, including the use of a “Privilege Review Team.”1
3 1. Review of the EA LLP Server
4 In order for the Privilege Review Team to efficiently review
5 documents and data stored on the digital devices identified in
6 Section II.A. above, the data on these devices must first be
7 processed, filtered, exported, and loaded into a document review
8 platform. IRS-CI has provided to the Department of Justice’s
9 Cybercrime Lab (the “DOJ Lab”) the majority of the digital devices
10 obtained by IRS-CI during its investigation, including the EA LLP
11 server and any computers, external hard-drives, and USB drives, so
12 that the DOJ Lab can process and filter the data, and then export the
13 data so it can be loaded into a document review database.
14 At this time, the Privilege Review Team has prioritized the
15 processing and review of documents and data contained on the forensic
16 image of the EA LLP server. The Privilege Review Team has
17 prioritized the review of the EA LLP server because the EA LLP server
18 likely contains the largest volume of documents and data and because
19 defendant has indicated that documents on the EA LLP server are of
20 particular importance. The Privilege Review Team is also
21 prioritizing the review of any documents or data that appear to
22 relate to the individual client-victims identified in the indictment.
23 The EA LLP server consists of six separate digital devices, one
24 of which appears to have been EA LLP’s email server and another which
25 appears to have been EA LLP’s file server. The Privilege Review Team
26
27
1 The Privilege Review Team is being supervised by AUSAs
28 Patrick R. Fitzgerald and Joseph B. Woodring from the USAO’s National
Security Division.
3
1 and DOJ Lab have informed the Prosecution Team that the email server
2 contains approximately 3 million items totaling approximately 3.5 TB,
3 and that the file server contains approximately 19 million items
4 totaling approximately 6.5 TB. The DOJ Lab has processed and
5 filtered all of the data on the EA LLP email and file servers, so
6 that the data can be searched, exported, and then loaded into a
7 document review database. Specifically, the DOJ Lab copied the
8 forensic images to its systems, verified and loaded the forensic
9 image files, filtered out irrelevant system files, expanded any
10 compound files on the EA LLP server (i.e., .zip files), indexed the
11 data so that is could be searched, and then searched the data using
12 initial “scope key words.” Undersigned counsel understands that this
13 process took a considerable amount of time due to the large volume of
14 data on the EA LLP server and other technical issues.
15 The Privilege Review Team and DOJ Lab are in the process of
16 exporting all documents from the email server and file server that
17 were identified as containing any of the initial “scope key words”
18 and loading the documents into a document review database for further
19 review by the Privilege Review Team. The Privilege Review Team and
20 DOJ Lab have recently encountered some technical difficulties during
21 the export process, which should be resolved shortly. Once these
22 technical issues are resolved, the documents and data from the EA LLP
23 server will be loaded into the document review database on a rolling
24 basis.
25 The USAO currently anticipates that the Privilege Review Team
26 will begin its substantive review of documents and data from the EA
27
28
4
1 LLP server within one week.2 The Privilege Review Team will also be
2 reviewing the data from the EA LLP servers to determine whether the
3 initial “scope key words” were effective in identifying documents
4 that fall within the scope of the search warrant. Additionally, the
5 Privilege Review Team is attempting to identify any folders on the EA
6 LLP server that contain information relating to the individual
7 client-victims or other specific categories of documents covered by
8 the search warrants so that the review of these materials can be
9 prioritized.3
10 2. Review of GBUS Digital Devices
11 As noted above, IRS-CI and the USAO obtained a warrant to search
12 certain digital devices obtained from former GBUS employees. (See CR
13 1, Ex. 1.) Forensic copies of these devices have already been
14 produced to defendant subject to the Protective Order (CR 36).
15 To date, the Privilege Review Team and IRS-CI has prioritized
16 the review of one device containing GBUS emails that had been backed
17 up from GBUS’s Amazon cloud-based server. The Privilege Review Team
18 has identified potentially privileged documents on this device and is
19 in the process of reviewing such documents pursuant to the search
20
2 On July 10, 2019, the USAO requested that defense counsel
21 provide the USAO with the names and contact information for any
lawyers or law firms with whom defendant or his companies may have
22 had an attorney-client relationship by July 17, 2019. Defense
counsel has indicated that he will be responding to this request by
23 the end of this week (i.e., July 26, 2019), at which point any
additional names provided by the defense will be added to the USAO’s
24 current list of “privilege key words.”
25 3 The defense is welcome to provide the Privilege Review Team
with any information defendant believes may assist the Privilege
26 Review Team in identifying specific client files or any other
relevant information on the EA LLP server or other devices. Such
27 information would allow the Privilege Review Team to expedite the
review and production of such records to defendant, including the
28 documents and records identified in defendant’s portion of the July
1, 2019, joint report (CR 43 at 6).
5
1 warrant protocols. The IRS-CI case agents are currently reviewing
2 the non-privileged documents on this device that were released by the
3 Privilege Review Team to determine whether the documents fall within
4 the scope of the search warrant. The USAO has already produced a
5 small number of documents from this review to defendant, and will
6 continue to produce additional documents on a rolling basis going
7 forward.
8 3. Review of Other Digital Devices and Search Warrant

Evidence
9
10 The Privilege Review Team and DOJ Lab are currently working to
11 process documents and data from other digital devices obtained during
12 the course of this investigation, using forensic processes similar to
13 those used in connection with the EA LLP server. Documents and data
14 from the other digital devices will be exported and loaded into the
15 document review database on a rolling basis going forward. The DOJ
16 Lab has indicated it should take less time to process the documents
17 and data on the other digital devices than it did to process the data
18 on the EA LLP server.
19 The Privilege Review Team, however, was already able to identify
20 and locate EA LLP’s QuickBooks records on one of the computers seized
21 from EA Employee 1’s residence. The Privilege Review Team believes
22 these QuickBooks records contain financial information within the
23 scope of the search warrant and that the privilege review of the
24 records can be completed shortly.
25 Because smart phones and tablets are typically reviewed using
26 different software programs, such as Cellebrite, the content of any
27 such devices is not being processed by the DOJ Lab or loaded into the
28 document review database. The Privilege Review Team will be
6
1 reviewing these devices separately. The Privilege Review Team has
2 already begun the review of EA Employee 1’s EA LLP smart phone.
3 Finally, the Privilege Review Team is working to scan the hard-
4 copy documents seized from defendant’s residence, EA Employee 1’s
5 residence, and Law Firm 1. Once these documents are scanned, they
6 will be loaded into the documents review database so that the
7 Privilege Review Team can complete its review.
8 C. Timeline for Completion of the Review and Production of

Documents to Defendant
9
10 The USAO is working to complete the privilege review as soon as
11 possible. Based on the information currently available, the USAO
12 estimates that the Privilege Review Team will be able to
13 substantially complete the privilege review in the next three to four
14 months. This estimate, however, could change if the volume of
15 documents and data that falls within the scope of the warrants and
16 needs to be reviewed is greater than expected, or if the Privilege
17 Review Team encounters any unexpected technical issues during the
18 review process.
19 The USAO currently anticipates that it will begin producing non-
20 privileged documents falling with the scope of the search warrants
21 within the next four to six weeks. The USAO expects that the initial
22 production will include the following materials:
23  EA LLP’s QuickBooks records;

24  Emails and other records from the EA LLP server relating to
25 the client-victims identified in the indictment;
26  Additional GBUS emails; and

27  Data from EA Employee 1’s smart phone.
28
7
1 The USAO will then make rolling productions to the defense on a
2 monthly basis going forward. All such documents will be Bates-
3 labeled and produced with database load files, which will allow the
4 defense to more easily search and review the documents.
5 III. FORENSIC COPIES PRODUCED TO DEFENDANT

6 On May 15, 2019, defendant requested that the USAO produce
7 forensic copies of any digital devices obtained during the course of
8 its investigation. On June 10, 2019, the Privilege Review Team
9 produced to defendant forensic copies of accessible digital devices
10 seized from defendant’s residence, seized during defendant’s arrest,
11 and obtained from former GBUS employees. During the July 8, 2019,
12 status conference, defense counsel indicated that he was having
13 difficulties reviewing the forensic copies defendant requested.
14 Accordingly, the Court directed the USAO to include additional
15 information regarding the forensic images that were produced to
16 defendant in the instant report.
17 IRS-CI has created forensic images of each of the digital
18 devices obtained during the course of this investigation.4 The
19 purpose of a forensic image is to ensure that the best evidence is
20 collected and that the data on the device can be preserved,
21 authenticated, and verified. The use of a forensic image also allows
22 the parties to preserve metadata and demonstrate that the data on the
23 devices has not been -- and cannot be -- altered.
24 The production of a forensic image is the standard method for
25 providing a defendant with a complete copy of a hard drive or other
26
27
4In many instances, such as with the EA LLP server and devices
28 from Law Firm 1, IRS-CI did not maintain a copy of the original
devices or never took possession of the original devices.
8
1 digital device. Here, the forensic images that were produced to
2 defendant are duplicates of the forensic images that the USAO’s
3 Privilege Review Team is using to conduct its own review.
4 There are a number of commercially available software programs
5 that defendant can use to access, search, and review data on a
6 forensic image, including programs such as Forensic Toolkit (FTK),
7 EnCase, and Nuix. In white-collar prosecutions such as this one,
8 defendants typically retain an eDiscovery vendor or computer
9 forensics expert to assist with the technical aspects of such a
10 review. If defendant is unable to retain such services, the USAO
11 understands that there are some free software programs available
12 online that would allow defense counsel to review the forensic images
13 on his own. For example, there is a free version of FTK Imager
14 available for download from AccessData at https://accessdata.com.
15 The USAO understands that FTK Imager should allow defense counsel to
16 review the folders and most files contained on the forensic images in
17 a format similar to Windows Explorer.
18 Additionally, based on discussions with an IRS-CI Computer
19 Investigative Specialist, undersigned counsel understands that there
20 is no way for the USAO to ensure that defendant will be able to
21 review the contents of the forensic images in the same manner as he
22 would be able to if defendant were reviewing the original devices.
23 In some limited instances, defendant may be able to use the forensic
24 image of certain devices to create a “virtual machine,” which would
25 allow the defense to review the device in a format similar to the
26 original device. Undersigned counsel, however, understands that this
27 is a highly-technical process and that defense counsel may need to
28 obtain technical support to be able to do so.
9
1 In sum, the USAO has produced to defendant forensic images of
2 devices in this case in the same manner in which it produces forensic
3 images to defendants in other prosecutions. There is no reason why
4 defendant cannot conduct his own independent review of these forensic
5 images, as numerous other defendants and their counsel do on a
6 regular basis.
7 IV. INACCESSIBLE DIGITAL DEVICES

8 As noted in the parties July 1, 2019, joint report (CR 43), IRS-
9 CI is currently in possession of an Apple desktop computer seized
10 from defendant’s residence, which is password protected and has not
11 yet been accessed.5 The United States Attorney’s Office for the
12 Southern District of New York is also in possession of an iPhone, an
13 iPad, and an Apple laptop computer, which are password protected and
14 have not yet been accessed. The government will continue its efforts
15 to gain access to these devices pursuant to the warrants. If
16 defendant wishes to immediately obtain forensic copies of these
17 digital devices, defendant can either provide the government with the
18 passwords for these devices or make arrangements to personally unlock
19 the devices.
20
21
22
23
24
5 In defendant’s portion of the July 1, 2019, joint report,
25 defendant claimed that the warrants permitting the government to
access the inaccessible devices expired. (CR 43 at 14.) This is
26 incorrect. The warrant to search defendant’s residence provides the
government with at least 180 days to complete the search of any
27 digital devices found in defendant’s residence, subject to additional
time extensions from the Court. The government may also seek
28 authorization from the Court to retain encrypted devices once the
time period to complete the search has concluded.
10

Case 8:19-cr-00061-JVS Document 49 Filed 07/22/19 Page 1 of 12 Page ID #:479

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Case 8:19-cr-00061-JVS Document 49 Filed 07/22/19 Page 1 of 12 Page ID #:479

Hochgeladen von

Copyright:

Verfügbare Formate

Case 8:19-cr-00061-JVS Document 49 Filed 07/22/19 Page 1 of 12 Page ID #:479

13 Attorneys for Plaintiff

23 Pursuant to the Court’s July 8, 2019, Minute Order (CR 45),

24 plaintiff United States of America, by and through its counsel of

25 record, the United States Attorney for the Central District of

26 California and Assistant United States Attorneys Julian L. André and

28 States Attorney’s Office for the Central District of California’s

1 privilege review of evidence obtained during the course of the

2 investigation of defendant MICHAEL JOHN AVENATTI.

3 Dated: July 22, 2019 Respectfully submitted,

1 STATUS REPORT REGARDING PRIVILEGE REVIEW

4 United States Attorney’s Office for the Central District of

5 California (the “USAO”) submits this status report to address the

6 following topics raised during the July 8, 2019, status conference:

7 1. The status of the USAO’s ongoing privilege review of

8 evidence obtained during the course of its investigation of defendant

9 MICHAEL JOHN AVENATTI (“defendant”) and an anticipated timeline for

10 production of documents to the defense.

11 2. The production of forensic copies of digital devices to

12 defendant and information regarding possible methods for defendant to

13 review the forensic copies that have been produced.

14 3. Issues relating to the four inaccessible digital devices

15 that law enforcement seized from defendant’s residence and from

16 defendant’s person during his March 25, 2019, arrest.

17 This Status Report is based on the information currently

18 available to the USAO’s Prosecution Team. To the extent the USAO

19 learns of additional information that may affect the issues addressed

21 II. THE USAO’S PRIVILEGE REVIEW

24 the Internal Revenue Service – Criminal Investigation (“IRS-CI”)

25 obtained the following digital devices or forensic copies thereof

26 during the course of its investigation:

27 1. The computer server belonging to defendant’s former law

28 firm, Eagan Avenatti LLP (“EA LLP”);

1 2. Digital devices seized from the residence of EA LLP’s

3 belong to EA LLP or are the personal property of EA Employee 1;

4 3. Digital devices seized during defendant’s arrest on March

6 4. Digital devices seized from defendant’s residence;

7 5. Digital devices seized from another law firm with which

8 defendant had a business relationship (“Law Firm 1”); and

9 6. Digital devices obtained from former employees of

10 defendant’s coffee company, Global Baristas U.S. LLC (“GBUS”).

11 The USAO understands that the devices referenced above contain a

12 total of approximately 20 terabytes (“TB”) of data. The USAO and

13 IRS-CI obtained warrants to search each of these devices for evidence

14 relating to the investigation of defendant.

15 IRS-CI also seized approximately 15 to 20 boxes of hard-copy

16 materials during the execution of search warrants at defendant’s

17 residence, EA Employee 1’s residence, and Law Firm 1’s business

19 B. Status of the Privilege Review

21 devices referenced above, pursuant to the privilege review and other

22 search protocols set forth in the applicable search warrants. The

23 search warrants issued in connection with this investigation require

24 the USAO and IRS-CI to follow specific procedures when reviewing

25 digital devices and other evidence in order to avoid unnecessary

1 disclosures of attorney-client communications or attorney work

2 product, including the use of a “Privilege Review Team.”1

3 1. Review of the EA LLP Server

4 In order for the Privilege Review Team to efficiently review

5 documents and data stored on the digital devices identified in

6 Section II.A. above, the data on these devices must first be

7 processed, filtered, exported, and loaded into a document review

8 platform. IRS-CI has provided to the Department of Justice’s

10 obtained by IRS-CI during its investigation, including the EA LLP

11 server and any computers, external hard-drives, and USB drives, so