USA v. Khan

Motion in Limine To Preclude Email Evidence Derived From FISA/FAA Oral Argument requested.

D. Or.September 15, 2014

Amy Baggio, OSB #01192 amy@baggiolaw.com Baggio Law 621 SW Morrison, Suite 1025 Portland, OR 97205 Tel: (503) 222-9830 Fax: (503) 274-8575 John S. Ransom, OSB #742655 john@ransomblackman.com Ransom Blackman LLP 1001 SW 5th Ave., Suite 1400 Portland OR 97204 Tel: (503) 228-0487 Fax: (503) 227-5984 Attorneys for Defendant IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON PORTLAND DIVISION UNITED STATES OF AMERICA, Plaintiff, v. REAZ QADIR KHAN, Defendant. Case No. 3:12-cr-659-MO MOTION IN LIMINE TO PRECLUDE EMAIL EVIDENCE DERIVED FROM FISA/FAA The defendant, Reaz Qadir Khan, through counsel, hereby moves in limine for an order precluding the government from introducing FISA/FAA-obtained emails as evidence in trial Page 1 MOTION IN LIMINE TO PRECLUDE EMAIL EVIDENCE DERIVED FROM FISA/FAA Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 1 of 32 because introduction of said evidence violates both the U.S. Constitution and the Federal Rules of Evidence. This motion incorporates by reference the arguments and authorities set forth in the accompanying Memorandum in Support, filed herewith. Respectfully submitted on September 15, 2014. /s/ Amy Baggio Amy Baggio, OSB #01192 503-222-9830 Of Attorneys for Defendant Reaz Khan Page 2 MOTION IN LIMINE TO PRECLUDE EMAIL EVIDENCE DERIVED FROM FISA/FAA Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 2 of 32 Amy Baggio, OSB #01192 amy@baggiolaw.com Baggio Law 621 SW Morrison, Suite 1025 Portland, OR 97205 Tel: (503) 222-9830 Fax: (503) 274-8575 John S. Ransom, OSB #742655 john@ransomblackman.com Ransom Blackman LLP 1001 SW 5th Ave., Suite 1400 Portland OR 97204 Tel: (503) 228-0487 Fax: (503) 227-5984 Attorneys for Defendant IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON PORTLAND DIVISION UNITED STATES OF AMERICA, Plaintiff, v. REAZ QADIR KHAN, Defendant. Case No. 3:12-cr-659-MO MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE I. Introduction This memorandum argues that because the government’s email evidence collected under FISA, FAA, or whatever other means may have been used, is inherently unreliable, fails to Page 1 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 3 of 32 consistently capture critical information, changes characters within the messages, and omits messages, the government will be unable to satisfy the requisite rules of evidence regarding authentication and admissibility. Accordingly, Mr. Khan seeks a pretrial ruling that the government will not be permitted to introduce these messages as evidence during trial. II. Facts This motion concerns what have been referred to by the government as “FISA emails.” Facts regarding this motion are mostly associated with various aspects of FISA email messages in discovery, including how the government may have collected them. A. Th e “Co lle c tio n ” O f Th e Em ails The government has not disclosed when the emails were collected, by which government entity they were collected, or how. The messages were provided as scanned images of printed emails, most of which were hand-redacted. The government describes the messages as “FISA emails.” It is not known if the emails were originally seized with EO12333 and subsequently queried (or “collected”) with FISA or FAA, or if the emails were originally seized (or “collected”) pursuant to FISA or FAA. B. Th e Em ails In Dis c o v e ry The government has provided approximately 504 different emails in discovery. These messages date from February 2005 to February 2012. Of the 504 email messages, approximately 18 messages (dated November 2005 to November 2008) involve Jaleel and Khan communicating exclusively with one another. Of the 504 email messages, approximately 481 Mr. Khan appears to have been a prolific emailer who may have sent up to a hundred emails1 a week to a large number of people, forwarding links to various online news stories about current events Page 2 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 4 of 32 messages (dated November 2008 to September 2010) involve Mr. Khan’s email address and the email addresses of Jaleel’s wives. The great majority of the approximately 438 remaining email messages produced in discovery appear not to be even potentially inculpatory. C. Th e Co n te n ts O f Th e FISA-Em ails The FISA-emails consist of multiple parts: 1. Top header information, including: a. Case – apparently the case under investigation by the government; b. Facility – the email address being targeted by the government; c. DWS Product – the particular communication seized by targeting the facility; 2. Email metadata, including a number of fields, which might include, inter alia: a. To b. From c. cc d. bcc e. Subject f. Date/Time g. Originating IP address – the internet access point used by the sender of the message or their service provider (such as Yahoo!, hotmail, comcast, etc.); h. Message ID – a unique identifier for particular email message i. In Reply To ID – a unique identifier for the original email message to which the current email message is responding 3. Message content a. Plain text version b. HTML version See generally, Exhibit A, Declaration of Josiah Roloff, Computer Forensic Expert (explaining various terms.) in the United States and abroad. Many emails that he sent to Mr. Jaleel were mass-emailings to which Mr. Jaleel was but one of anywhere between 10 and 50 recipients. Page 3 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 5 of 32 D. In fo rm atio n In c lu d e d In Em ails Pro d u c e d In Dis c o v e ry The content of the FISA-emails varies greatly from message to message. These variances are attributable to both inconsistent redactions and inconsistent provision of information within the messages. 1. Redaction Inconsistencies Regarding redactions, the FBI was inconsistent in what information it redacted from the FISA-emails in discovery. Approximately 188 of the 504 messages state that FISA was the “Collection Authority.” See, e.g., Exhibit B.1 (Excerpt from 11/5/07 Email, RQK00352672 (“Collection Authority: FISA”)). The “Collection Authority” field on other messages has been redacted. Exhibit B.2 (Excerpt from 07/16/10 Email; RQK0036496 (Collection Authority redacted)). Some messages are redacted to remove the Facility information. Exhibit B.3 (Excerpt from 11/05/07 Email; RQK0035267). The rhyme or reason to redactions is both inconsistent and unclear. 2. Information Provision Inconsistencies When a person sends an email message, certain data are automatically embedded as metadata within message fields that are invisible to the sender. Exhibit A (Roloff Declaration) at paragraphs 10- 19. In the FISA-emails provided in this case, however, the information varies from message to message. Some messages include only the From/To/Subject/Date fields. Exhibit B.4 (Excerpt from 8/29/2009 One email produced originally on Disc 1 included a redacted “Collection Authority” field2 (RQK0000593), but when the exact same message was reproduced on Disc 70 (RQK0036549) pursuant to the Court’s order to provide more legible copies to the defense, the “Collection Authority” field was not redacted. Page 4 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 6 of 32 Email; RQK0000712). Other messages include all the fields listed above and more. Exhibit B.5 (Excerpt from 12/31/09 Email; RQK0035879). Approximately 18 of the emails lack an Originating IP address, necessary to track and verify the origin of the original message. Exhibit B.6 (Excerpt from 8/28/19 Email; RQK0000712); and see Exhibit A (Roloff Declaration), at paragraphs 11-16 (explaining importance of IP Address to forensic examiner). Approximately 125 of the emails lack Message ID information, also necessary to track and verify the origin of the original message and to determine whether all other emails in the chain and related to this message have been provided. Exhibit B.7 (Excerpt from 12/24/08 Email; RQK0035370); Exhibit A (Roloff Declaration), at paragraphs 11-12 (explaining importance of Message ID information to forensic examiner). E. Ad d itio n al Pro b le m s With FISA-Em ails Apart from the inconsistent provision of information (whether by redaction or by omission) in the messages, the characters within the message are problematic. Due to font ambiguity, whether a character is a lowercase letter “i”, the number one, or a lowercase letter “L” is impossible to determine on many of the messages. See e.g., Exhibit B.5, supra; Exhibit A, (Roloff Declaration) at paragraphs 17-21 (discussing font ambiguity problems and impact of those problems on forensic examiner). In addition, characters within approximately twenty of the emails have been replaced with symbols in lieu of the original text characters, perhaps due to the government’s decryption process. Exhibit B.8 (Excerpt of 8/11/09 Email, RQK0037212); Exhibit A (Roloff Declaration) at paragraph 17. There are approximately twenty messages in which the incorrect characters are obvious; how many other messages contain incorrect characters, but in a less Page 5 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 7 of 32 obvious fashion, is unknown. The result of these font issues is that in reviewing the message, one cannot determine with certainty the content or metadata of the original message. Further, approximately 166 of the emails provided are missing the original production of emails within the chain. Emails missing within the chain are of two types. First, some emails include messages below in the chain that have not been produced independently as original messages. Exhibit B.9 (Excerpt from 03/11/08 Email, RQK0036968-RQK0036969) When an email is produced only as a message within the chain, no metadata is available about the within- the-chain-only message, preventing one from knowing important information regarding the date/time/sender/IP Address/etc. of the message. As to the second type of missing chain message, some emails are produced as originals when they are in fact responses to earlier emails that have not been produced. Exhibit B.10 (11/15/08 Email, RQK0036410; “In-Reply-To” another message not provided in discovery nor included in the email chain). The defense can be certain that the originating message is missing when the message that is produced lists an “In-Reply-To” code for message not otherwise provided in discovery. These omissions cripple the value of a response to a missing message. See Exhibit A (Roloff Declaration) at paragraph 21. F. Th e Go v e rn m e n t’s DWS Co lle c tio n Sy s te m Discovery provided includes references that the government collected and/or stored the FISA-emails using “DWS”. See generally, Exhibits B.1-B.3, B.5, B.7, B.8 (“DWS Product”). After the tragic shooting at Fort Hood in November of 2009, the government opened an investigation into the Federal Bureau of Investigation’s handling of available evidence involving the shooter. Part of that investigation involved the government’s email monitoring and collection process, Page 6 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 8 of 32 known as Data Warehouse System (DWS) and Electronic Surveillance Data Management System (EDMS). In its report reviewing its investigation, the William H. Webster Commission Report3 (hereafter Webster Commission Report) described the DWS-EDMS system: The primary database relevant to our investigation is the Data Warehouse System-Electronic Surveillance Data Management System (DWS-EDMS). Designed and developed by the FBI’s Special Technologies and Applications Section (STAS), DWS is an access-controlled, text-oriented database of information acquired through the FBI’s exercise of its criminal and counterterrorism authorities and techniques. Webster Commission Report at 27. In describing the problems with DWS-EDMS, the Commission explained: STAS [the FBI’s Special Technologies and Applications Section] designed DWS in 2001 as a transactional database to record [communications intercepts] [REDACTED]. In the intervening years, DWS became the depository of [REDACTED] information obtained [through exercise of the FBI’s governing authorities and techniques] [REDACTED]. Although not designed as a warehouse database, it has become one. Thus, although it is a capable, if overburdened, tool for the conventional review of [REDACTED] [information], DWS was not originally designed for the review and management of large strategic intelligence collections [REDACTED]. It also lacks the modern hardware infrastructure needed to fulfill and preserve its functionality. Webster Commission Report at 27 (redactions & parentheticals in original). The report went on to explain the various versions of DWS-EDMS, including limitations on the database’s ability to maintain and process huge amounts of information, a mission for which it was not originally designed. Webster Commission Report at 27-32. Thus, if Mr. Khan is correct and the FISA emails in his case were collected/stored with the DWS system, these established weaknesses are relevant to the authenticity and reliability of the government’s collection of FISA-emails. The complete Webster Commission Report is available online at:3 http://www.fbi.gov/news/pressrel/press-releases/final-report-of-the-william-h.-webster-commission. Page 7 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 9 of 32 G. Im p o rtan c e O f Mis s in g /In d e c ip h e rab le In fo rm atio n In FISA-Em ails As noted above, certain fields of email metadata is either missing altogether, or includes characters that are either indecipherable or unreliable. As explained in Mr. Roloff’s Declaration (Exhibit A), the missing metadata prevents proper analysis of the source material and precludes a reliable assessment of the sources of the messages, their dates, their senders and recipients, and the full message contents. III. Applicable Law A. Fe d . R. Ev id . 1002 & 901 – Bu rd e n Re g ard in g Au th e n tic atio n For the government to convince the Court to admit the FISA-obtained emails, the government must both authenticate the messages and establish their admissibility. Federal Rule of Evidence 1002 provides: “Requirement of the Original – An original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise.” Consistent with the rule of Rule 1002, Rule 901 addresses the obligation of the proponent of a piece of evidence to establish its authenticity as a prerequisite before admission. In the context of a criminal prosecution, the Ninth Circuit has explained the burden on a proponent of evidence vis-a-vis Rule 901: The authentication of evidence is “satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” Fed.R.Evid. 901(a). If the evidence is an object connected with the commission of a crime, the proponent must also establish the chain of custody. Gallego v. United States, 276 F.2d 914, 917 (9th Cir.1960). The prosecution must introduce sufficient proof so that a reasonable juror could find that the items in the bag are in “substantially the same condition” as when they were seized. Id.; see United States v. Jardina, 747 F.2d 945, 951 (5th Cir.1984), cert. denied, 470 U.S. 1058, 105 S.Ct. 1773, 84 L.Ed.2d 833 (1985). The district court may admit the evidence if there is a “reasonable probability the article has not been changed in important respects.” Gallego, 276 Page 8 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 10 of 32 F.2d at 917. Further, in the absence of any evidence of tampering, a presumption exists that public officers “properly discharge[ ] their official duties.” Id. United States v. Harrington, 923 F.2d 1371, 1374 (9 Cir. 1991). th B. Fe d . R. Ev id . 801(c ) – He ars ay Is In ad m is s ib le Not only must a proponent of certain evidence establish its authenticity, the evidence must otherwise be relevant and admissible. Fed. R. Evid. 802 generally prohibits the introduction of hearsay. Hearsay is generally defined as an out-of-court statement admitted for the truth of the matter stated therein. Fed. R. Evid. 801(c). Email messages may constitute impermissible hearsay. United States v. Morales, 746 F.3d 310, 316 (7 Cir. 2014) (email message4 th constituted hearsay); United States v. Cone, 714 F.3d 197, 219 (4 Cir. 2013)(email messages onlyth admissible if not offered for the truth of the matter). Should the government assert that the emails are admissible as co-conspirator statements, then the government must first demonstrate the existence of the conspiracy by evidence extrinsic to the hearsay statements. As stated by the Supreme Court: Before admitting a co-conspirator’s statement over an objection that it does not qualify under Rule 801(d)(2)(E), a court must be satisfied that the statement actually falls within the definition of the Rule. There must be evidence that there was a conspiracy involving the declarant and the nonoffering party, and that the statement was made “during the course and in furtherance of the conspiracy.” At this point, the defense does not know which email messages the government will seek to4 introduce or on what theory of admissibility the government might rely. This motion seeks to raise blanket objections to all email messages based on the arguments raised herein; should the Court deny the blanket request to preclude FISA email evidence, the defense reserves the right to object to individual messages as appropriate. Page 9 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 11 of 32 Bourjaily v. United States, 483 U.S. 171, 175 (1987). This burden is particularly difficult when the charge itself involves a double-layered conspiracy, such as the charge against Mr. Khan. 5 C. Fe d . R. Ev id . 106 – Th e Ru le O f Co m p le te n e s s The Rule of Completeness, Rule 106, provides that “If a party introduces all or part of a writing or recorded statement, an adverse party may require the introduction, at that time, of any other part--or any other writing or recorded statement--that in fairness ought to be considered at the same time.” Rule 106 codified the common law Rule of Completeness, which exists to avert “misunderstanding or distortion” caused by introduction of only part of a document. Beech Aircraft Corp. v. Rainey, 488 U.S. 153, 172 (1988); United States v. Vallejos, 742 F.3d 902, 905 (9 Cir. 2014) (same). See also Fed. R. Evid. 403 (evidence inadmissible whenth relevance outweighed by risk of confusion of the jury). The Advisory Committee Notes to Rule 106 state, in relevant part: The rule is based on two considerations. The first is the misleading impression created by taking matters out of context. The second is the inadequacy of repair work when delayed to a point later in the trial. Rule 106, Advisory Committee Notes (1972). Thus, the rule exists to avoid misleading impressions and taking matters out of context. Rule 106 applies to all written or recorded statements. United States v. Liera-Morales, --- F.3d ----, 2014 WL 3563356, *5-*6 (9 Cir. 2014).th See also Defendant’s Memorandum In Support Of Motion to Dismiss Indictment, Sections II.A5 & II.B (highlighting vagueness in the indictment and inherent problems of charging double-layered conspiracy in this case). Page 10 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 12 of 32 IV. Argument As set out above, the government’s emails pose a host of problems that weigh against their admission as evidence against Mr. Khan. First, the emails are not originals under Rule 1002 and cannot be properly authenticated under Rule 901. As explained by Mr. Roloff, based on the inconsistent and limited amount of metadata available in the messages, combined with font ambiguity and incorrect character problems, computer forensic experts are unable to either establish chain of custody or offer a conclusive opinion as to whether the message as provided in discovery is sufficiently similar to the original to properly authenticate the message. Exhibit A at paragraphs 1020 & esp. 21. Moreover, as explained by Mr. Roloff, when the emails were sent with a web browser and anyone can login to an email account and send a message that appears to come from the email account holder, the metadata is crucial in verifying the actual sender of the message. Exhibit A at paragraphs 10-16. In sum, the government will be unable to authenticate the messages because it cannot properly establish chain of custody or offer sufficient proof that the emails are in substantially the same condition as when they were originally communicated. Second, apart from the missing metadata or incorrect characters, any messages that are missing messages within the chain should be precluded under Rule106. To introduce only part of a written conversation is to necessarily take the conversation out of context, which is the precise danger against which the Advisory Committee warned. To allow the FISA-Email evidence, especially in a case of this seriousness, results in too great a risk of confusion for the jury and unfairness for the defendant. See Fed. R. Evid. 403. Any trial based on excerpts of conversations, with insufficient authentication and foundation, Page 11 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 13 of 32 not only violates the Federal Rules of Evidence, but the Sixth Amendment guarantee of a fair trial and due process. Respectfully submitted on September 15, 2014. /s/ Amy Baggio Amy Baggio, OSB #01192 503-222-9830 Of Attorneys for Defendant Reaz Khan Page 12 MEMORANDUM IN SUPPORT OF MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 14 of 32 Exhibit A to Defendant’s Motion In Limine To Preclude “FISA-Email” Evidence: Declaration of Josiah Roloff Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 15 of 32 Page 1 EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL”: DECLARATION OF JOSIAH ROLOFF Amy Baggio, OSB #01192 amy@baggiolaw.com Baggio Law 621 SW Morrison, Suite 1025 Portland, OR 97205 Tel: (503) 222-9830 Fax: (503) 274-8575 John S. Ransom, OSB #742655 john@ransomblackman.com Ransom Blackman LLP 1001 SW 5th Ave Ste 1400 Portland OR 97204 Tel: (503) 228-0487 Fax: (503) 227-5984 Attorneys for Defendant IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON PORTLAND DIVISION UNITED STATES OF AMERICA, Plaintiff, v. REAZ QADIR KHAN, Defendant. Case No. 3:12-cr-659-MO EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL” EVIDENCE: DECLARATION OF JOSIAH ROLOFF I, Josiah Roloff, hereby declare: 1. I am the President and Senior Digital Forensics Examiner at Global CompuSearch LLC, a private digital forensics firm with headquarters in Spokane Washington and offices in Sacramento California, Portland Oregon and Palm Springs California. Global CompuSearch Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 16 of 32 Page 2 EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL”: DECLARATION OF JOSIAH ROLOFF provides digital forensics services and consulting on legal matters that deal with electronic evidence. 2. My educational background includes a Professional Certificate in computer forensics from Oregon State University and New Technologies, Inc. (NTI), the Certified Computer Examiner (CCE) certification from the International Society of Forensic Computer Examiners, the EnCase Certified Examiner (EnCE) certification by Guidance Software, the Cellebrite Certified Logical Operator (CCLO), the Cellebrite Certified Physical Analyst (CCPA) and an Associate in Applied Science degree in Network Engineering. 3. I have been working exclusively in the field of digital forensics since 2003. During this time I have conducted examinations on thousands of pieces of digital evidence to include: hard drives, compact discs (CDs), digital versatile discs (DVDs), floppy diskettes, thumb drives, flash cards, magnetic tapes, tablet devices, cellular phones, subscriber identity module (SIM) cards, personal digital assistants (PDAs), smart phones and feature phones. During my tenure I have completed well over five hundred cases which consisted of analyzing the aforementioned media types. 4. I frequently lecture on the topic of general digital as well as mobile forensics and how it can be applied in the legal system. I have been recognized as a computer, digital and mobile forensics expert witness in numerous U.S. District Courts, U.S. Military Courts and State Courts throughout the country. 5. My firm’s list of clients in these matters includes the United States Navy, United States Marine Corps, United States Army, United States Air Force, United States Coast Guard, Federal and State Public Defender Offices throughout the United States and private attorneys throughout the United States, Europe and Asia. My firm has investigated digital evidence in allegations of homicide, rape, child pornography, “traveling” for sex with minors, sexual assault, unauthorized access (hacking), voyeurism, unauthorized use, espionage, kidnapping, arson, and robbery, to name a select few. 6. I believe it is important to point out that although Global CompuSearch is an independent consulting firm and while the case load consists of many criminal defense issues, this firm is also regularly retained by prosecutors in criminal cases and I have personally consulted and provided expert witness testimony for the prosecution in numerous cases. Neither I nor my associates are advocates for either defense attorneys or prosecutors but believe our role is to act as factual advisors to the attorneys and the courts in these cases. 7. My firm has been retained by Ms. Amy Baggio, Esq. of Baggio Law located in Portland Oregon to assist the defense by reviewing electronic high technology documents/materials produced by the government, perform digital forensic analysis on digital media seized from Mr. Reaz Qadir Khan, the defendant in this instant matter, and if necessitated, prepare affidavits/declarations or provide testimony regarding these matters. 8. I am aware of and have reviewed numerous discovery materials produced by the government which Attorney Baggio refers to in her Memorandum in Support of Motion in Limine to Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 17 of 32 Page 3 EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL”: DECLARATION OF JOSIAH ROLOFF Preclude “FISA Email” Evidence as “email evidence collected under FISA, FAA, or whatever other means may have been used…” 9. Attorney Baggio’s referenced motion highlights specific inconsistencies within the government produced materials as well as intrinsic problems the defense has when attempting to review these items for relevance in relation to the serious criminal allegations Mr. Khan faces. 10. Electronic messages or e-mails, like many electronic datasets, contain in addition to the body or message content, additional data that is referred to as “metadata”. That is, data about the data, which depending on the dataset one is working with can provide context surrounding a file or in this case, an e-mail’s initial creation and the path it took through the Internet before ending up in an inbox. Specifically with e-mails, a large amount of this metadata will be located within a more difficult to access area called the “header”. 11. E-mails contain many hidden to the user metadata fields within this header that assist an e-mail client (e.g., Outlook) in understanding which conversation thread each e-mail belongs to. One such set of important fields are titled “message ID”, “in-reply-to” and “references”. These fields essentially provide a unique identifier which consists of a lengthy string of numbers and textual characters for each specific electronic message with the intent to track the various messages sent and received as communication transpires between multiple parties. 12. In cases like this instant one, when one party has provided discovery consisting of multiple loose e-mails versus the complete threads which would include all replies, an examiner or individual investigator will need to use these message identifiers to locate the referenced e-mail(s) in order to place, for example, a response e-mail in its proper context. 13. As attorney Baggio’s motion indicates many of the government provided e-mails appear to have initially originated in an electronic format, been printed, hand redacted and then re-scanned before being provided to the defense. Because of the process utilized, poor quality optical character recognition (OCR) has occurred in the copies the defense has received and thus are at times, range from extremely difficult to useless in allowing a determination to be made as to which e-mail thread a specific response belongs to as characters are frequently indiscernible. 14. E-mail headers also frequently contain metadata which can be titled a number of ways but essentially are viewed as an “originating IP” field. In various instances the originating IP information will be contained in other locations such as the “Received:” field. Regardless of the form, when this information is included in an e-mail’s header, these fields can contain the Internet Protocol (IP) address maintained at the residence or location responsible for an e-mail’s submission. This could include a person’s home, business, or a work location. Depending on the service provider (e.g., Gmail, Hotmail, Yahoo) it can also simply contain said provider’s e-mail server IP address. 15. In this instant case there are many examples from the government’s provided discovery Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 18 of 32 Page 4 EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL”: DECLARATION OF JOSIAH ROLOFF where this originating IP address information can be discerned. In these instances this information is valuable to an examiner or investigator as it can allow a general physical location to be determined for the party responsible for the submission of an e-mail. For example, Attorney Baggio’s motion references the attached exhibit B.10 (RQK0036410 which from its content appears to be an e-mail from Reaz Khan to “abu malaak”. Looking at the included “Received:” field, we see the originating IP address “67.171.144.182” which appears to be the address responsible for sending this message through the Yahoo webmail (HTTP) server. When resolved, we can determine that this address is owned by the Internet Service Provider (ISP) Comcast and likely assigned to a customer in the Beaverton/Portland geographic area. The following is a visual example of this data: 16. When information such as the originating IP address is omitted, an examiner or investigator is unable to provide such additional details. As can be seen with the above information, this can be important, especially when working with web based e-mail accounts where anyone with a web browser and the correct credentials could login, use, and ultimately be responsible for content being sent or received through an e-mail account. 17. General font ambiguity and/or improper characters were located not just in e-mail headers, but also in the body of numerous reproduced messages. This not only prevents either side’s investigators from being able to track the origin of a specific message, but also fails to allow a complete understanding of the true nature of the communications within e-mail’s affected by this problem. 18. The nature of the font ambiguity and poor OCR quality create a number of issues when attempting to provide a human review of the government provided documents. However, in addition to the lack of human discernable data one must also be aware of the lack of Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 19 of 32 Page 5 EXHIBIT A TO DEFENDANT’S MOTION IN LIMINE TO PRECLUDE “FISA EMAIL”: DECLARATION OF JOSIAH ROLOFF machine readable or searchable capabilities also inherent to these quality issues. One such purpose of electronic discovery is to provide the parties with efficient discovery review platforms and methods. This would include the ability to electronically search and sort information by keywords, dates and times, parties or custodians. Because of the poor quality nature of these documents, the defense cannot rely on automated searches by any such capable software and must indeed manually review every single document to ensure an accurate accounting of relevant documents are noted. 19. It is my understanding that the source for each government provided document is currently unknown to the defense. My review of the documents noted inconsistencies in the produced datasets, which attorney Baggio also points out in her motion. If these documents had been collected and provided in the normal course of business for example, by an Internet E-mail Service Provider, I would expect to see a consistent style (or sets of styles) and information set throughout the provided content. 20. It is my belief that much of the above noted issues regarding the lack of ability to search, sort, and even read the government provided documents could be alleviated if the original electronic documents were provided in their native format(s) to the defense. 21. Performing digital forensics requires an understanding and acknowledgement of the science behind technology as well as the art of how to apply and breakdown that science in a way that provides assistance as opposed to more confusion within the legal system. The e-mail headers previously discussed in-depth are a part of that science and are one of many standard artifacts digital forensic examiners rely upon to make informed deductions and correctly understand datasets. Not being provided that standard information does deter from the conclusions one can make regarding the validity and thus the ultimate weight such information should convey. 22. I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on September 14, 2014. //SIGNED// Josiah Roloff Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 20 of 32 Exhibit B to Defendant’s Motion In Limine To Preclude “FISA-Email” Evidence: Sample Emails B.1-B.10 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 21 of 32 Case:4§·1~~RJ3~~uct50780548E DWS Product 50780548E Case: Facility: Collection Authority: Product Body X-RocketMail: 00000021 ;RA --S----K ------;9720 X-Apparently-To: reaz2000@yahoo.com via 206.190.58.149; Mon, 05 Nov 2007 01 :51:26 -0800 X-Originating-IP: [206.190.38.163] Return-Path: Authentication-Results: mta54 7 .mail.mud.yahoo.com :from=yahoo.com; domainkeys=pass ( ok) Received: from 206.190.38.163 (HELO web50711.mail.re2.yahoo.com) (206.190.38.163) by mta547.mail.mud.yahoo.com with SMTP; Mon, 05 Nov 2007 01:51:26-0800 Received: ( qmail 777 46 invoked by ·uid 60001 ); 5 Nov 2007 09:51 :25 -0000 DomainKey-Signature: a=rsa-shal; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X- Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Message-ID; b=BKAU8Qh+tNR/nFA33YlzJmw4piC7GlzcT6Blb9J8MG6e6XNYK6Ewf3ixi0140NWZLIUG+VXeb2yTe7Zc8rLuFv PoE+i4IpmRQpEHpX9aDMiAleNuiOg261JcOTqjDmcVt5YtjeK4y/f2fRjOmJLGAUayiMrZcwuSnMxeMlnlmio=; X-YMail-OSG: hy.BXKMVM116hMbOY8sshcUFQFv7.6PA8PygJYWZYc9Vn72t5CEfsxkQtrk9a6JNESbdhYdaBj20LVrvAFzbOnW11 tQJ7p0zqeQqalHu W4k80bCuzQ-- Received: from [71.222.67.180] by web50711.mail.re2.yahoo.com via HTTP; Mon, 05 Nov 2007 01 :51 :25 PST X-Mailer: YahooMaiiRC/818.15 YahooMaiiWebService/0.7.152 Date: Mon, 5 Nov 2007 0 I :51 :25 -0800 (PST) From: Davlatsher Sharipov Subject: Re: madinahschool website To: Reaz Khan Message-ID: <830895. 76808.qm@web507ll.mail.re2.yahoo.com> STAS Comment: Plain Text version As-salaam Aleikum. InshaAllah, I have ability to launch your web site in a month. I mean the informational and the library part. Courses and the other stuff might take some time to work on. · I am thinking about WestHost.com for a host to the web site. It's located in Utah, it is powerful, and not very expensive. So, I will let you know when I want to take action about that. I really-really need your assistence: The sooner you give me the things I ask from you, the faster I can work. Please, consider that in December I will be very busy with exams, and projects. So we should get it done by the 4th week of November. I need introductory/detailed information about your project. I need categorizing. If we always keep the materials organized in the categoriez it will be so easy to tum them into websites. Imagine, the website is a book. The book has volumes, chapters, parts, titles, and then pages, and paragraphs. That's why having a site-tree is very important. It's also good to get inspiration. Once you have your topic chapters clear, the titles will come by themselves. Ma-As-Salaama! Page 1 of 4 RQK0035267 FISA-Email Limine Ex. B.1 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 22 of 32 DWS Product 63301563E - Product Body Return-Path: Received-SPF: none (mta175.mail.sp2.yahoo.com: domain ofmunahaque@yahoo.com does not designate permitted sender hosts) X-YMaiiiSG: T7iH36EcZArVFrUikaOBdY .DSZMOcf2RR 77CtlmyukpMT _yn _ ktNivKqgQWFZOnGOtw12XafwQXss410BONV8rGtCz4nthRsjV.1 Qzq6kEd4 EZ4.tLhJEVnmVw47UUY1waCyVtM8t.NpVDUrSEZrHa7KRdPM5qq3syCv9Zim Lcr6CfEqOKTjLKZhxNYubEk7yEuoOMHhz4c4Ext 12onGgJv2roirY gbPCXE9 WDr 1 iRtFSIY7n V djlvzt43CivoHc3Bm.c04flELbP7wEIXmhqctxiXiv 1 XMx bLh V da7qiE5ysx6ysr.MWjqa.JKxilFDe6BJJ I dX9zQ3c 1 bsdD82Boz2JHBY P.M.NyZoe.en Yeu9eTlrpJFm YG9I ij9WrFIUuRa1uog5hFPZO _ bL23US1gxF A YuknXRPDE.Uf7F46iXZtJpB9hbVBYaMI R07 ADKOyoQDHvOxHbCXD59QOOG4 kuPzkRoA YGCijNhzoc YkOrd7J2MAUaNibiJAO _ XD82hg_IaQakqCOCsF47g2 FCHmWuXiGbXj8rVoCAgpWB07kHYkGiNLvtRlgV27QyFi8zVXuMetqxEdw_Yt 7MrJsEPW7kkKtYEOL65Fau9rXsfKEhr03eDpHmeXFntX50wyB I dU4 W1tQ82i CN3eGU4C7Nq_ VjwUQYZrGBpN4xKumMUzMi82qARLaBkSiiYOe Yp 1 Cw20CZaG spL YG.D81 y 1 VKTiQ6FHBOuDYHwocl3qXLA-- X-Originating-IP: [67.195.23.157] Authentication-Results: mta175.mail.sp2.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass ( ok) Received: from 127.0.0.1 (HELO n3-vm1.bullet.mail.gq1.yahoo.com) (67.195.23.157) by mtal75.mail.sp2.yahoo.com with SMTP; Fri, 16 Jul2010 10:50:53 -0700 Received: from [67.195.9.81] by n3.bullet.mail.gql.yahoo.com with NNFMP; 16 Jul2010 17:50:53-0000 Received: from [67.195.9.110] by tl.bullet.mail.gql.yahoo.com with NNFMP; 16 Jul201 0 I7:50:53 -0000 Received: from [127.0.0.1] by omp1I4.mail.gql.yahoo.com with NNFMP; I6 Jul20IO 17:50:53 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 29250.11391.bm@omp114.mail.gql.yahoo.com Received: (qmail 11797 invoked by uid 60001); 16 Jul201 0 17:50:52 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=re1axed/relaxed; d=yahoo.com; s=s1024; t=1279302652; bh=wWvp+G9Inffdaj2YmHskbSe1jmDFMoTI P8YTNLapR1M=; h=Message-ID:X-YMail-OSG:Received:X- Mailer:Date:From:Subject:To:MIME-Version: Content-Type; b=OLH7zUOWUynBEnpJkSC89tr9iD6F ARkZsbopfsJPWEsCRYpHHq8wYFes6AidSk5bOGK6JbSawWCTaNOHEhC9 II p+n9y0jxti9ya2JriZ3 fpo5LMxZc+ 73 SMo 1 AzoBsb6ucoqtl U JD34CCB 16cdqhDb/OEY3 8ZHjo5ikOx+ JkNb Y = DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail- OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=wTCtiiHILq/NJBujFmv189ikkG+Hn1xD9nxdv5WcnXH0+3Ui42TCGNz2v7VrBCgmYXpQ+TcqGwdLvrzFe78/mOO uh8GD22h7U/i4jPmeiXDEHw45hlFzEcd7x20LDpTa66bFKYm4WGjVL3USWQ4wSQhrxUoK1sOaR5yKdOi6wKE=; Message-ID: <780452.11761.qm@web111907.mail.gq1.yahoo.com> X-YMail-OSG: h2ZTk YUVM1lz3 _ FfZFzJEQQJ4zM4m6jHN1 wCvhutS8300si r3nhFyp5Rh_Mrb48t7snUXV4ZUAmn_k1mQ7z8bh1hiPdket3iaKhVR6A3oAq AAB7qeCnOK9Vyl3NOo8ZcaYpt1K_.h1p92RzkmKepaAfuSHMvivMOnPbxLQG 6eOUI7qxP8sgXo3bS5HXdrxgXpzy1 TVOunJIJqOovygWoE2KZOJLs5nn_C3V GmcJyBFg45qjvCQFW gMbEq5tXRe3E 15uPRDeOQF90dV09MJiwtt _ HguyY661 Page 1 of 2 RQK0036660 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 23 of 32 Case:4§·1~~RJ3~~uct50780548E DWS Product 50780548E Case: Facility: Collection Authority: Product Body X-RocketMail: 00000021 ;RA --S----K ------;9720 X-Apparently-To: reaz2000@yahoo.com via 206.190.58.149; Mon, 05 Nov 2007 01 :51:26 -0800 X-Originating-IP: [206.190.38.163] Return-Path: Authentication-Results: mta54 7 .mail.mud.yahoo.com :from=yahoo.com; domainkeys=pass ( ok) Received: from 206.190.38.163 (HELO web50711.mail.re2.yahoo.com) (206.190.38.163) by mta547.mail.mud.yahoo.com with SMTP; Mon, 05 Nov 2007 01:51:26-0800 Received: ( qmail 777 46 invoked by ·uid 60001 ); 5 Nov 2007 09:51 :25 -0000 DomainKey-Signature: a=rsa-shal; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X- Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Message-ID; b=BKAU8Qh+tNR/nFA33YlzJmw4piC7GlzcT6Blb9J8MG6e6XNYK6Ewf3ixi0140NWZLIUG+VXeb2yTe7Zc8rLuFv PoE+i4IpmRQpEHpX9aDMiAleNuiOg261JcOTqjDmcVt5YtjeK4y/f2fRjOmJLGAUayiMrZcwuSnMxeMlnlmio=; X-YMail-OSG: hy.BXKMVM116hMbOY8sshcUFQFv7.6PA8PygJYWZYc9Vn72t5CEfsxkQtrk9a6JNESbdhYdaBj20LVrvAFzbOnW11 tQJ7p0zqeQqalHu W4k80bCuzQ-- Received: from [71.222.67.180] by web50711.mail.re2.yahoo.com via HTTP; Mon, 05 Nov 2007 01 :51 :25 PST X-Mailer: YahooMaiiRC/818.15 YahooMaiiWebService/0.7.152 Date: Mon, 5 Nov 2007 0 I :51 :25 -0800 (PST) From: Davlatsher Sharipov Subject: Re: madinahschool website To: Reaz Khan Message-ID: <830895. 76808.qm@web507ll.mail.re2.yahoo.com> STAS Comment: Plain Text version As-salaam Aleikum. InshaAllah, I have ability to launch your web site in a month. I mean the informational and the library part. Courses and the other stuff might take some time to work on. · I am thinking about WestHost.com for a host to the web site. It's located in Utah, it is powerful, and not very expensive. So, I will let you know when I want to take action about that. I really-really need your assistence: The sooner you give me the things I ask from you, the faster I can work. Please, consider that in December I will be very busy with exams, and projects. So we should get it done by the 4th week of November. I need introductory/detailed information about your project. I need categorizing. If we always keep the materials organized in the categoriez it will be so easy to tum them into websites. Imagine, the website is a book. The book has volumes, chapters, parts, titles, and then pages, and paragraphs. That's why having a site-tree is very important. It's also good to get inspiration. Once you have your topic chapters clear, the titles will come by themselves. Ma-As-Salaama! Page 1 of 4 RQK0035267 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 24 of 32 Product Page 1 of 6 acility- reaz2000@yahoo.com ID-50779748E From: "Aqra Travel" To: "'Reaz Khan'" Subject: RE: FW: TICKET RECEIPT - SANA TO KARACHI Date: Fri, 28 Aug 2009 11 :06:35 -0700 STAS Comment: Plain Text version Noted, will cancel it Aqra Travel 939 S.Atlantic BLVD, # 213 Monterey Park, CA-91754 Tel: 626-289-7485, Fax: 626-282-3762 Email:info@aqratravel.com.Web:www.aqratravel.com From: Reaz Khan [mailto:reaz2000@yahoo.com] Sent: Thursday, August 27,2009 12:52 PM To: Aqra Travel Subject: Re: FW: TICKET RECEIPT - SANA TO KARACHI As'Salam Alaikum Tayyab Bhai, Alhamdulillah, Reached Sanaa safely. Wife & kids will stay herte for a while. Please cancell Sanaa-Karachi tickets. JazakAllahu Khairan for all your help. Was'Salam, RQK0000712 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 25 of 32 DWS Produ~t 54465628E Case: Facility: Collection Authority: Product Body Return-Path: X-YMaiIISG: zSOW .K8WLDsmk.KDmLNyLdco YuiUT5.u3ogtsCOG _ hj_ xFf3XLEfDxhyCpQF7escgxL6 _ YvCScAiVN7sFXdzWJjKx KC6ZOesDmh13yK1N2eATLVaDeAXD3bw6jEa8ECCf21su7aH81VupSy270tJOw5BXDGvCfqfMTKlxqpu3mQXhoP rB.Y52ZlcDS406.tZF71AEvtvinkMDpX9LGOIL4ogvLkwJKUUoTiy9nQL2R8jSeZwCyJxgq.DUlidie7vRziKBxzbMOJs 5UVB6Ds6wOilc87f8cbB90qBSc3mtY60gU gBLpcGZll2G lkuzxl 1gw2tmhDGndE6cq47TXUrwk:KpOel61qpsKD 1 s2qC cPj08LgeFOV AIWcu W7vmaF51 GyH5Dq78aDbd6sjvBHi9Hnx4- X-Originating-IP: [66.96.185.20] Authentication-Results: mtal 91.mail.sp2.yahoo.com from=azhengineers.com; domainkeys=neutral (no sig); from=azhengineers.com; dk.im=neutral (no sig) Received: from 127.0.0.l (EHLO bosmailout20.eigbox.net) (66.96.185.20) by mta191.mail.sp2.yahoo.com with SMTP; Thu, 31Dec2009 10:24:41 -0800 · Received: from bosmailscan19.eigbox.net ([10.20.15.19]) by bosmailout20.eigbox.net with esmtp (Exim) id 1NQPam- 0007GZ-VC for reaz2000@yahoo.com; Thu, 31 Dec 2009 13: 17:49 -0500 Received: from bosimpout02.eigbox.net ([10.20.55.2]) by bosmailscan19.eigbox.net with esmtp (Exim) id lNQPam- 0004gj-Oy for reaz2000@yahoo.com; Thu, 31 Dec 2009 13: 17 :48 -0500 Received: from bosauthsmtp08.eigbox.net ([10.20.18.8]) by bosimpout02.eigbox.net with NO UCE id PuH3 ld0080ASroSOluH3Hs; Thu, 31Dec2009 13:17:03 -0500 X-EN-OrigOutlP: 10.20.18.8 X-EN-IMPSID: PuH31d0080ASroSO1 uH3Hs Received: from 97-120-105-50.ptld.qwest.net ([97 .120.105.50] helo=tawabk) by bosauthsmtp08.eigbox.net with esmtpa (Exim) id lNQPal-OOOlg8-8t for reaz2000@yahoo.com; Thu, 31 Dec 2009 13:17:48 -0500 · From: To: "'Reaz Khan"' References: "<33B313DE24E 14E34A 75966B40AD0530D@tawabk> <683729.73356.qm@web55003.mail.re4.yahoo.com> Subject: RE: FW: Urgent help needed. Please help to find Davlatsher, one of the visitores of AsSaber Mosque Date: Thu, 3"1 Dec 2009 10:17:30 -0800 Message-ID: <2ABFF9120EEA4F A1B6F l 6AB3CB7 Al D7C@tawabk> X-Mailer: Microsoft Office Outlook 11 .In-Reply-To: <683729.73356.qm@web55003.mail.re4.yahoo.com> thread-index: AcqJ5Lg8oJjNk9JvSSaXCNi99F/+JAA YDDEg X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 X-EN-Userlnfo: 4ad3b3da18la7f5d27elabbf2788cd69:a04dee4669edc4ef24b46b6c784fd4e8 X-EN-Auth User: tawab@azhengineers.com Sender: X-EN-OrigIP: 97.120.105.50 X-EN-OrigHost: 97-120-105-50.ptld.qwest.net STAS Comment: Plain Text version Walaikum salaam, Page 1of8 RQK0035879 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 26 of 32 Product Page 1 of 6 acility- reaz2000@yahoo.com ID-50779748E From: "Aqra Travel" To: "'Reaz Khan'" Subject: RE: FW: TICKET RECEIPT - SANA TO KARACHI Date: Fri, 28 Aug 2009 11 :06:35 -0700 STAS Comment: Plain Text version Noted, will cancel it Aqra Travel 939 S.Atlantic BLVD, # 213 Monterey Park, CA-91754 Tel: 626-289-7485, Fax: 626-282-3762 Email:info@aqratravel.com.Web:www.aqratravel.com From: Reaz Khan [mailto:reaz2000@yahoo.com] Sent: Thursday, August 27,2009 12:52 PM To: Aqra Travel Subject: Re: FW: TICKET RECEIPT - SANA TO KARACHI As'Salam Alaikum Tayyab Bhai, Alhamdulillah, Reached Sanaa safely. Wife & kids will stay herte for a while. Please cancell Sanaa-Karachi tickets. JazakAllahu Khairan for all your help. Was'Salam, RQK0000712 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 27 of 32 Case DWS Product 50782519E Case: Facility: Collection Authority: Product Body X-RocketMail: 00000002;R ---------------;2232 Received: from [209.162.223.250] by web55004.mail.re4.yahoo.com via HTTP; Wed, 24 Dec 2008 04:17:12 PST Date: Wed, 24 Dec 2008 04:17:12-0800 (PST) From: Reaz K.4an Subject: RE: Booking request To: Aqra Travel In-Reply-To: <0 14c0 1 c94e92$973fc3a0$c5bf4ae0$@com> STAS Comment: Plain Text version As'Salam Alaikum Tayyab Bhai, I hope that this email finds you in good health & Iman. I discussed an umrah trip with you earlier with a stop in UK. But now it seems I may not be able to delay the Uk trip for too long. Please make a booking and quote me a price for ticket, dates are flexible so that you can find the best price. POX-Heathrow Leaving Jan 5-8 (Have to arrive in heathrow not latter than Jan 8 evening) approx 4 days stay in london Heathrow- Edinburgh,Scottland Jan Leaving 10 - 14 2-4 days stay in Edinburg the return to london approx 4 days stay in london return to PDX Name Reaz Q. Khan US pp# 445415395 exp 26 Aug 2018. Please also advise any visa requirements. Also pls invest~gate taking route pdx-lax-london, with 1 business day stop in LA on outbound led, then 4 day stop in LA after return. I can get to meet all of you while there! Another question, ifl give you the Umrah application before leaving to London, then can you arrange for umrah visa while I am doing my work in london? This way I can continue from heathrow-Jeddah without the need to make a separate trip? Was'Salam Reaz Aqra Travel wrote: Daer Reaz Bhai, Hajj hasd just started and it will finsh on 16t=h DEC, UMRA visa will not strt till ENDS JAN or FEB Aqra Travel Page 1 of 8 RQK0035370 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 28 of 32 aj.reaz20O0@yahOO corn Product50779036E DWS Product 50779036E Facility reaz2000@yahoo.com Product Body X-RocketMail 00000002 X-YMa11-OSG 5gIZnd4VM mjwkpDSPFbChGf.okj LDoaFX2byd6ogTfslb XFjAu nLm5 ldT8MU9h5vFyUdsQhO67yO23jz4dOus4A mB a5BaYHnmVmkkecTFRZiF oRCeuJc8cVoxBS n9A ViMIfTQwaYoj4tgp95 IQaRBhRQgWxq9gT EW6mJcYf b.BxXeIR raZ6007 WNMIQu4D5cPzZ9HFaW 73dTgayIJL oxaFnEcDeMSCBoXMurKnUexhO4CDjOOheonHzMwT OFB8XkO_pwNrA9bvozqCWNmgA9QftBxp.PFuSzNlF8Qws WOWWMFfOIKyybBOE_3336kG6O8ZjdzZ Received from by web55004.mail.re4.yahoo.com via HTTP Tue 11 Aug 2009 140535 PDT X-Mailer YahooMailClassic/6 .2 YahooMail WebService/0 7.33 8.1 Date Tue Ii Aug 2009 140535 -0700 PDT From Reaz Khan reaz2000@yahoo.com Subject Re FW MUST READ ABOUT MASJID-AL-AQSA To Sohail Ahmed asohai1786@yahoo.com In-Reply-To 273447.48856.qmweb90506.mai1 .rnud.yahoo.com STAS Comment Plain Text version Wa Alaikum AsSalaam Here is what found A1-Masjid al-Aqsa in Jerusalem was the first of the two qiblahs and is one of the three mosques to which people may travel for the purpose of worship And it was said that it was built by Sulaymaan peace be upon him as stated in Sunan alNasaaÆTMi 693 And it was said that it existed before Sulaymaan peace be upon him and that Sulaymaan rebuilt it this is based on the evidence narrated in al-Saheehayn from Abu Dharr may Allaah be pleased with him who said âl said â_O Messenger of Allaah which mosque was built on earth firstâTM He said âc_Al-Masjid al-Haraam Makkah.âTM said âSThen whichâTM He said âSAlMasjid al-Aqsa.âTM said â-How much time was there between themâETM He said âLForty years So wherever you are when the time for prayer comes pray for that is the best thing to do.ÆTMâ Narrated by al-Bukhaari 3366 Muslim 520 The Prophet peace and blessings of Allaah be upon him was taken on the Night Journey israâTM to Bayt al-Maqdis Jerusalem where he led the Prophets in prayer in this blessed mosque Allaah says interpretation of the meaning âceGlorified and Exalted be He Allaah all that evil they associate with Him Who took His slave Muhammad for journey by night from Al-Masjid Al-Haraam at Makkah to Al-Masjid Al-Aqsaa in Jerusalem the neighbourhood whereof We have blessed in order that We might show him Muhammad of Our Ayaat proofs evidences lessons signs etc. Verily He is the All-Hearer the All-Seerª 1711 The Dome of the Rock was built by the caliph âSAbd al-Malik ibn Marwaan in 72 AH It says in alMawsooâTMah al-Filasteeniyyah 4/203 âEcThe name al-Masjid al-Aqsa was historically applied to the entire sanctuary al-Haram al-Shareef and the buildings in it the most important of which is the Dome of the Rock which was built by â_SAbd al-Malik ibn Marwaan in 72 AH/691 CE which is regarded as one of the greatest Islamic historical buildings But today the name is applied to the great mosque which is situated in the southern part of the sanctuary plateau.â Page of RQK00372 12 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 29 of 32 reaz2000@yahoo.com Product 50780596E DWS Product 50780596E Fiz2O00@yahoo.com Product Body X-RocketMail 00000002 Received from by web55Ol2.mail.re4.yahoo.com via HTTP Tue II Mar 2008 023825 PDT Date Tue 11 Mar 2008 023825 -0700 PDT From Reaz Khan reaz2000@yahoo.com Subject Re your advise To Muhammad Ahmad ideal@comsats.net.pk In-Reply-To 2008031021 4928.M46640@comsats.net.pk STAS Comment Plain Text version AsSalam Alaikum Here is what think will give an example Looking back think of Pakistan now similar to East Pakistan in 1968/69 Would it have been advisable to sink money into capital project machinery or buy house at that time The situation of Pakistan now is similar to East Pakistan of that time OPTION As far as options are concerned they are ongoing business there is no reason to discontinue unless if you were moving out of Karachi orb other family members do not agree you do not have the capital needed If you have lack of capital you may sell off one of them to generate some capital But this is possible only if all agree If your choice is to be able to do only one of the two you are probably better judge of that than me because you are aware of the local business risks than am OPTION Answer to option seems easy Right now you are in struggle for survival It very likely that the current pressures on you will not allow you to keep up with the demands of Pak Suzuki and Atlas Honda So it would be advisable to drop it However to be listed as vendor for an automobile manufacturer has its value Just shutting it down would be loss So could you spin it out as separate company and sell it out If you cant sell it can you find partner who comes in with capital to atleast pay off debts and bring in working capital OPTION As far as property mostly think that you should rent Worldwide property values have started falling fast US the prices have declined 10-15% in last 6-8 months some areas such as Florida as much as 40% causing many people and mortgage companies to go bankrupt Same is case in Canada and most of eastern and western Europe So it is just matter of time that the same phenomenon hits Pakistan OPTION Since all the family is not agreeing to sell the assets it is not really an option that you can pursue However if they can get partner and release you think it would be the best for you That way you will be independent and many of the burdens on you will be lifted then you can work more freely and take care of your business and family Also you mother and brothers will also come to peace with you probably happy with you that you have accepted their terms OPTION think going to Middle East is the best option Dubai is rapidly growing economy with lots of opportunity However computer is very low margin and highly competitive business prices of some components are very volatile Page of RQK0036968 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 30 of 32 reaz2O00yahoocom Product 50780596E such as CPU Memory and hard drive others are relatively stable such as motherboards cases monitors etc You have to learn the market well before you start this business We rarely kept more than few days of supply for parts sensitive items At Genesis our overall inventory was turned over 20 times years Even by the computer industry standard this was an incredibly tight control But this was one of the keys to our success Working for year in this industry would be good step before you put your money down The down side in Dubai free zone is the large capital requirement for DFZ to let you register company If you want to bypass the capital requirement you need local arab partner If you are considering going overseas also consider this option recommend that you think of Jeddah/Makkah/Madinah as better place For an Arab partner in Saudi remember you had friend who has business in Jeddah If you want also now have very reliable Arab contact who can facilitate it for you without any extra money for himself you will only need to pay the government fees for the business license etc and you can stay in full control of your business With an Arab partner it is much easier because all the processes are much easier for Saudi nationals If you want to setup as an independent business without arab partner you can do it Here is the link for you http //www.sagia.gov .sa/english/index.php Officially the minimum investment required for an foreign owned company is USD 30000 but approval is difficult with that amount Usually with an investment of USD 50000 or more is easier depending on the project pray to Allah that He makes your business and family affairs easier to you If you want to discuss anything please feel free to call or email work night time 1100PM to 700AM US Pacific Standard time In the day am available 700am 930Am then from 200PM to 530PM Was Salam Reaz Muhammad Ahmad ideal@comsats.net.pk wrote March 10 2008 Dear Reaz AsSalam Alaikum am fine and hope you are fine and doing well As you suggested that should think over in detail before decide any thing long term have been observing the situation before and after elections and observed the things are not going in favor of Pakistan Nation as whole although the two parties have jointly obtained clear mandate but the existing govt is trying to create confusion between them The steel products and other raw material prices have raised remarkably especially steel sheet price has been increased from 46000/- to Rs 70000/- just with in two months Its really horrible What am planning is as under for your advice Should continue AMTEC for the vendorised work of Siemens only The monthly rents electricity charges and other fixed overheads are Rs.750001- and expect profit around 50000/- This should meet my financial requirements including studies of children etc The existing Fixed Capital investment is Rs.2 million The working capital is Rs million which think should be million as to secure the above margin and maintain some stocks to avoid unnecessary profit reduction due to sudden increase in prices of steel and other items Can Continue speakers after importing Kit from CHINA and assembling same in AMTEC Regarding business option in Dubai as immediate business alternate have studied computer market and auto parts market think it is better to start the computer business in Page of RQK0036969 Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 31 of 32 Product Page 1 of 1 Facility- reaz2000@yahoo.com ID-50782501 E X-RocketMail: 00000002;R---------------;493 l Received: from [67.171.144.182] by web55007.mail.re4.yahoo.com via HTTP; Sat, 15 Nov 2008 I 0:48:51 PST Date: Sat, 15 Nov 2008 10:48:51 -0800 (PST) From: Reaz Khan Subject: Re: salaam To: abu malaak In-Reply-To: ST AS Comment: Plain Text version Salam, you are correct, 1 am waiting for a few things to settle out. It will take about end of dee/early january to happen. I will let you know when ready so you can make booking. Also the second one does not have her pp ready. it will be a lot easier if both can go at same time. Was'Salam Reaz STAS Comment: HTML version Salam, you are correct, I am waiting for a few things to settle out. It will take about end of dee/early january to happen. I will let you know when ready so you can make booking. Also the second one does not have her pp ready. it will be a lot easier if both can go at same time. Was'Salam Reaz RQK003641C Case 3:12-cr-00659-MO Document 115 Filed 09/15/14 Page 32 of 32