An analysis of Kim’s desk and mobile phones showed dozens of calls between him and Rosen. During a September interview with the F.B.I., Kim told the agents that the best e-mail to use to reach him was a Yahoo! account. The next day, he called and said he was getting rid of the Yahoo! account and the F.B.I. should instead use a Google account he had set up. A forensic analysis of Kim’s hard drive, the affidavit says, found an e-mail from Rosen; the affidavit suggests that the e-mail had been deleted. Moreover, electronic records showed that after his interview with the F.B.I., Kim’s user profile accessed his Yahoo! account—which he told the F.B.I. he was getting rid of the next day—and viewed e-mails that had been sent from Rosen’s account.
At that point, the F.B.I. obtains subpoenas for the Yahoo! accounts of both Kim and Rosen. There, they find communications between the two of them in which they are using aliases—Kim is “Leo” and Rosen is “Alex.”
So, here is the scenario: Kim is one of a few officials who sees classified information about possible nuclear tests by North Korea. He speaks to Rosen of Fox. And shortly thereafter, Fox runs the story about the classified information. The F.B.I. questions Kim and then comes to believe that he is deleting information from his computer. So, knowing already that Kim is in communication with Rosen, it subpoenas both Kim’s and Rosen’s e-mail accounts.