Case Document 43-4 Filed 03/19/19 Page 1 of 105

AD [06 (Rev. O?f?ii} Application for a Search Warrant

 

 

UNITED STATES DISTRICT COURT

for the
Southern District of New York

0T8 MAG- i. 69 7

APPLICATION OR A SEARCH WARRANT

I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under
penalty of perjury that i have reason to believe that on the following person or property (fdent?jJ the person or describe the

in the Matter of the Search of

{Brie?y deacribe the proper? to be scorched
or identi?i the person by some and address)

A Device Containing the Results of Three Email
Search Warrants, See Attachment A



 

a - - .
sew..- . we? 

 

located in the Southern District of . New Yorlt_ there is now concealed {ident??i the
person or describe the property to be seized):

 

 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER.

The basis for the search under Fed. R. Grim. P. 41{c) is (chess one armors):
evidence of a crime;

Cl contraband, fruits of crime, or other items illegally possessed;
Cl property designed for use, intended for use, or used in committing a crime;
CI 3. person to be arrested or a person who is unlawfully restrained.

The search is related to a violation of:

Code Section Ojjfense Description
18 U80 1005. 1014, Conspiracy to defraud the United States; false hank entries; false statements to a
1343. 1344 ?nancial institution; wire fraud; bank fraud

The application is based on these facts:

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER.

?r Continued on the attached sheet.

If Delayed notice of 30 days (give exact ending date if more than 30 days: is requested
under 13 3103s, the basis of which is set forth on the attached sheet.

    

Sworn to before me and signed in my presence.

Date: ?y Zg/z?dy
City and state: NW /Hon. Gabriel W. Gorenstein, U.S Magishate Judge

Printed some and tide

 

.. . . .. .. .. -.- .. .- . .. .. 

Case Document 43-4 Filed 03/19/19 Page 2 of 105

UNITED STATES DISTRICT COURT 1 8 MAG 6 

SOUTHERN DISTRICT OF NEW YORK

In the Matter of the Application of the United TO BE FILED UNDER SEAL
States Of America for a Search Warrant for A 

Device Containing the Results of Three Email Agent Af?davitin Support of
Search Warrants, USAO Reference No 5 Application fora Search Warrant
20131100127 5



SOUTHERN DISTRICT OF NEW YORK) as:

Special Agent-of the United States Attomey?s Of?ce for the Southern

 

?oasis 3&ng ?11313} resisting; 5321 says

I. Introduction

A. Affiant

 

2. Imake this Af?davit in support of an application pursuant to Rule 41 of the Federal
Rules of Criminal Procedure for a warrant to search the electronic device speci?ed below (the
?Subject Device?) for the items and information described in Attachment A. This af?davit is based
upon my personal knowledge; my review of documents and other evidence; my conversations with
other law enforcement personnel; and my training, experience and advice received concerning the
use of computers in criminal activity and the forensic analysis of electronically stored information

Because this affidavit is being submitted for the limited purpose of establishing probable

2

Case Document 43-4 Filed 03/19/19 Page 3 of 105

cause, it does not include all the facts that I have learned during the course of my investigation.
Where the contents of documents and the actions, statements, and conversations of others are
reported herein, they are reported in substance and in part, except where otherwise indicated.

B. Prior Warrants and the Subject Device

3. As set forth in detail below, the USAO and the Federal Bureau of Investigation
are investigating, among other things, a scheme by Michael Cohen to defraud multiple

banks. Cohen is an attorney who currently holds himself out as the personal attorney for President

 

 

 

Donald Trump: and who previously-luseui'vedwfor over a decade as. an executive 1n the Trump
Organization, an international conglomerate with real estate and other holdings.

4. In connection with an investigation then being conducted by the Of?ce of the
Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief
United States District Judge for the District of Columbia, three search warrants (collectively, the
Warrants?) for emails and other content information associated with two email accounts .
used by Cohen. Specifically: A

a. On or about July 18, 2017, the FBI sought and obtained a search warrant for
emails in the account _@gmail.com (the ?Cohen Gmail Account?) sent or received
between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17-mj-00503, is
attached as Exhibit A (the ?First Cohen Gmail Warrant?).

b. On or about November 13, 2017, the FBI sought and obtained a search
warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and
November 13, 2017. This warrant, which is numbered 17?mj?00'855, is attached as Exhibit (the
?Second Cohen Gmail Warrant?).

c. On or about November 13, 2017, the FBI sought and obtained a search

warrant for emails in the account I?the ?Cohen Account?) sent or

3

 

Case Document 43-4 Filed 03/19/19 Page 4 of 105

received between the opening of the Cohen Account1 and November 13, 2017. This
warrant, which is numbered 17?mj?00854, is attached as Exhibit (the ?Cohen 
Warrant?).

5. The SCO has since referred certain aspects of its investigation into Cohen to the
USAO, which is working with the New York Field Of?ce. As part of that referral, on or
about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other

content information obtained pursuant to the SCO Warrants. A ?lter team working with the SCO

 

 

-- h-adwpreviously reviewed the e?mails producedpurs?uantmto Warrants for privilege.
6. These emails are contained on the Subject Device, which is particularly described
as a black and red USB drive with a white label that says ?Tracking 180208140208.? That is,
the Subject Device contains the emails and other content information obtained pursuant to the SCO
Warrants, less any emails that were screened. and removed by the privilege team.
7. The Subject Device is presently located in the Southern District of New York.

C. The Subject Offenses

8. The af?davits in support of the SCO Warrants describe evidence of several
different courses of conduct by Cohen, including, among other things, false statements to ?nancial
institutions relating to the purpose of an account he opened in the name of Essential Consultants
LLC and the nature of funds ?owing into that account, and activities undertaken by Cohen on
behalf of certain foreign persons or foreign entities without having registered as a foreign agent.

The SCO Warrants accordingly de?ne the evidence to be seized by reference to subject offenses

 

1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did
not specify a time period, but the af?davit indicated that, pursuant to court order, the service
provider had provided non?content information for the Cohen Account that indicated that
the account contained emails from the approximate period of March 2017 through the date of the
warrant.

 

Case Document 43-4 Filed 03/19/19 Page 5 of 105

and speci?c categories of information related to these courses of conduct. The subject offenses in

the SCO Warrants are summarized as follows:

 

 

 

 

Exhibit Warrant Subiect Offenses in Prior Warrant
A First Cohen Gmail 13 U.S.C, 1014 (false statement to ?nancial institution), 1955 (money
Warrant laundering), 95] (acting as an unregistered foreign agent}, and 22 U.S.C.
as 61.1,. area. {Estatesassan?ssisrativn 
Second Cohen Gmail 18 U.S.C. 1014 (false statement to ?nancial institution), 1343 (wire
Warrant fraud), 1344 (bank ?aud), 1956 (money laundering), 951 (acting as an

unregistered foreign agent), and 22 U.S.C. 611 at seq. (PARA)
Cohen Warrant 13 U.S.C. 1014 (false statement to ?nancial institution}, 1343 (wire
fraud), 1344 (bank ?aud), 1956 (money laundering), 951 (acting as an
unregistered foreign agent), and 22 U.S.C. 6 11 at seq. (PARA)

 

 

 

 

 

 

 

9. Based on my participation in this investigation, including my review of documents
obtained pursuant to subpoena and court order, my conversations with witnesses and review of
reports of conversations with witnesses, and my review of publicly available I have
learned of additional conduct by Cohen, described below, which was not described in the af?davit
seeking the First Cohen Gmail Warrant and was described brie?y in the af?davits seeking the
I Second Cohen Gmail Warrant and the Cohen ?Warrant.2

10. I am therefore requesting authority to expand the search of the non-privileged e-
mails obtained pursuant to the SCO Warrants, as contained on the Subject Device, for evidence
related to this additional conduct. As set forth below, in addition to the categories of evidence
already described in the SCO Warrants, there is probable cause to believe that the Subject Device
contains evidence of violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005
(false bank entries), 1014 (false statements to a fniancial institution), 1343 (wire fraud), and 1344
(bank fraud) (collectively, the ?Subject O?enses?), related to the additional conduct described

below.3

 

2 I do not base this application on my review of emails obtained pursuant to the SCO Warrants.

3 The SCO Warrants cite many of the sands statutes as subject offenses and describe categories of
information that likely encompass evidence of the additional conduct described herein.

5

Case Document 43-4 Filed 03/19/19 Page 6 of 105

II. Probable ausc Regarding the Subject Offenses

1. Together with this application, I am submitting an application for a search
warrant, pursuant to 18 U.S.C. 2703, for all content and other information associated with 
the Cohen Gmail Account, for the time period November 14, 2017 to the present; (13) the Cohen
Account, for the time period November 14, 201 to the present; and three other
email accounts. The af?davit in support of this application is attached as Eithibit (the

?Accompanying Af?davit?), and is incorporated by reference as if fully set forth herein.

 

 

12. As set-forth in a is"momentanan
Cohen has made af?rmative misrepresentations in and omitted material information from ?nancial
statements and other disclosures that Cohen provided to multiple banks in connection with a
transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi
medallion loans from the banks. As set forth in detail in the Accompanying Af?davit, in these
?nancial statements, and in his oral and other written statements to these banks, Cohen appears to
have intentionally omitted cash assets that he began receiving in 201?' from new consulting
work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; and failed
to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8
million cash payment to a third party, in comrection with 
acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and
material omissions, Cohen avoided making payments on his loans, and attempted to and
has secured proposed agreements from the banks to relieve him of certain repayment obligations

worth millions of dollars.

 

Nevertheless, in an abundance of caution, I am seeking explicit authorization to search the Subject
Device for evidence of this additional conduct.

Case Document 43-4 Filed 03/19/19 Page 7 of 105

13. As noted above, the Accompanying Af?davit seeks email content for the Cohen
Gmail Account and the Cohen Account for the period fromNovember 14, 2017 to the
present, and therefore establishes probable cause that a search of the email content from that time
period will reveal evidence, fruits, and instrumentalities of the Subject Offenses. As set forth
below, the Accompanying Affidavit also establishes probable cause to believe that a search of
the Subject Device (73. e. the non-privileged emails from the earlier time periods covered by the

SCO Warrants) will similarly reveal evidence, fruits, and instrumentalities of the Subject

 

 

Offenses.4 For example, as described in the Accompanying Af?davit:

a. In or about December 2014, Sterling National Bank (?Sterling?) agreed to
lend approximately $22 million to Cohen?s medallion companies. See Accompanying Affidavit
11 14(0).

b. In or about September 2015, Cohen began pushing Sterling for a reduction
in his payments. See id 14(e). 

c. In or about October 2016, Cohen told a Sterling employee (?Sterling
Employee-1?) that he had a potential buyer of his taxi medallions, named_, who .
would agree to assume Cohen?s debt with Sterling (and Melrose Credit Union, the participating
bank). See id. 11 14(g). Negotiations of the potential taxi medallion transaction then folldwed for

more than a year. See id. 

 

4 As noted, the Subject Device contains email content for the Cohen Gmail Account from the
period of June 1, 2015 to November 13, 2017, and email content for the Cohen Account
for the period of March 2017 to November 13, 2017,

 

2017 F1nanc1a1 Statemen that was also attached. See id 14(1).

Case Document 43-4 Filed 03/19/19 Page 8 of 105

d. On or about February 22, 2017, the Cohen Gmail Account5 sent an email to
a Sterling employee (?Sterling Employee?2?) stating that he ?agreed to pay down 1 million from
the loan amoun See id 1[ 14(g).

e. On or about June 8, 2017, Cohen emailed Sterling Employee-1 from the
Cohen Gmail Account, attaching a Sterling personal ?nancial statement form that had been ?lled

out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May

 

 

 

f. On or about October 5, 2017, Cohen, using the Cohen Gmail Account, re-
sent Sterling Employee? 2 a copy of his May 2017 Financial Statement. A day later, on October 6,
2017, Cohen, using the Cohen Gmail Account, emailed Sterling Employee?2 a statement of
fmancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). See
id 11 14(m). The September 2017 Financial Statement omitted assets that Cohen held in certain
bank accounts and substantially understated his available cash and cash equivalents. See id. 1111
19?20.

g. It appears that Cohen set up the Cohen Account to receive emails
he was previously receiving at the Cohen Gmail Account. On or about May 5, 2017, Cohen sent
an email from the Cohen Account to a blind copy list of recipients, stating that ?[d]ue to
the overwhelming volume of phone calls and emails coming into my previous cellular number

and e-mail address, I have elected to create for Clients Only the following. Kindly use this new

 

5 As noted in n.2, supra, I do not base this application on my review of emails obtained pursuant
to the SCO Warrants. Where the content of emails sent from or received by the Cohen Gmail
Account and/or the Cohen MDPC Account are described herein, my description is based on copies
of these emails produced by third parties pursuant to subpoena or otherwise.

8

 

Case Document 43-4 Filed 03/19/19 Page 9 of 105

information for all future contact and communications.? The signature line on the email listed
the Cohen Account as the new email address. See id. 1] 26.
h. Based on my review of header information obtained by court order, I have
learned that, on approximately eight occasions in August and September 2017, while Cohen,
- and and -were communicating about a term sheet for the
Coheni- taxi medallion transaction, the Cohen Account sent or received

emails from including emails on which Sterling employees were copied. On or about

 

 

August 22, 2017, Cohen also used the Cohen Account to send an email to Sterling
Employee?1. See id. 1] 27(a).

i. Based on my review of header information obtained by court order, I have
learned that on or about September 1, 20l7?at or around the time the '-and Cohen
were negotiating a term sheet?the Cohen Account sent or received eight emails to or
from_. See id. 112503).

14. Therefore, there is probable cause to believe that a search of the Subject Device
will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following:

a. Communications, records, documents, and other ?les involving Sterling,
Melrose, and/or taxi medallions;

b. Communications, records, documents, and other ?les involving a plan,
proposal, or agreement for Cohen and/ or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to others, including to and/or
t? entities associated with him;

0. Communications, records, documents, and other files necessary to establish

the identity of any person(s) including records that reveal the whereabouts of the person(s) 

 

Case Document 43-4 Filed 03/19/19 Page 10 of 105

who communicated with the Cohen Gmail Account and/ or the Cohen Account about any
plan or proposal or agreement for Cohen and] or entities associated with him to transfer any interest
in taxi medallions, and any associated debts or liabilities, to others, including to 
and/ or entities associated with him;

d. Communications between the Cohen Gmail Account and] or the Cohen

Account and _relating to Cohen?s bank accounts, taxes, debts, and/or

finances;

 

 

e. Evidence indicating the Cohen Gmail Account and the Cohen 
Account owner?s intent as it relates to the Subject Offenses under investigation.

Procedures for Searching ESI
A. Review of E81

15. Law enforcement personnel (including, in addition to law enforcement of?cers and
agents, and depending on the nature of the E81 and the status of the investigation and related
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the
government in this investigation, interpreters, and outside vendors or technical experts under
government control) will review the E81 contained on the Subject Device for information
responsive to the warrant.

16. In conducting this review, law enforcement personnel may use various methods to
locate evidence, fruits, and instrumentalities of the Subject Offenses, including but not limited to
undertaking a cursory inspection of all emails contained on the Subject Device. This method is
analogous to cursorily inspecting all the files in a file cabinet in an office to determine which paper
evidence is subject to seizure. Although law enforcement personnel may use other methods as
well, particularly including keyword searches, I know that keyword searches and similar methods

are typically inadequate to detect all information subject to seizure. As an initial matter, keyword

10

 

Case Document 43-4 Filed 03/19/19 Page 11 of 105

searches work only for test data, yet many types of tiles commonly associated with emails,
including attachments such as scanned documents, pictures, and videos, do not store data as
searchablc text. Moreover, even as to text data, keyword searches cannot be relied upon to capture
all relevant communications in an account, as it is impossible to know in advance all of the unique
words or phrases that investigative subjects will use in their and consequently
there are often many communications in an account that are relevant to an investigation but that

do not contain any keywords that an agent is likely to search for.

 

1v. 
17. Based on the foregoing, I respectfully request the court to issue a warrant to seize
the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure
Warrant.
18. In light of the con?dential nature of the continuing investigation, and for the
reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this af?davit

and all papers submitted herewith be maintained under seal until the Court orders otherwise,

    

Special Agent, USAO

Sworn to heforemlennl't . 
day of Eehiuaryrl?l?'li?'. .

 

 

  
   
 

 

N. Gasman vii a i 
I'r'sD JUDGE

11

Case Document 43-4 Filed 03/19/19 Page 12 of 105

Attachment A
1. Device to be Searched

The device to be searched (the ?Subject Device?) is described as a black and red USB drive
with a white label that says ?Tracking 180208140208?, which contains emails and other content
information obtained pursuant to the three search warrants, numbered 17?mj?00503, 17-mj-00855
and 17-mj?00854, obtained by the Special Counsel?s Of?ce less the emails that were
screened and removed by the privilege team.

11. Review of ESI on the Subject Devices

Law enforcement personnel (including, in addition to law enforcement officers and agents,


attorneys for the government, attorney support staff, agency personnel assisting the government in
this investigation, interpreters, and outside vendors or technical experts under government control)
are authorized to review the E81 contained on the Subject Device for evidence, fruits, and
instrumentalities of one or more violations of 18 U.S.C. 371 (conspiracy to defraud the United
States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire
fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?), as listed below:

 

a. Communications, records, documents, and other files involving Sterling National
Bank, Melrose Credit Union, and/or taxi medallions;

b. Communications, records, documents, and other files involving a plan, proposal, or
agreement for Michael'D. Cohen and] or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to others, including to i_ and/or
entities associated with him; I

c. The identity of any person(s) including records that reveal the whereabouts of the

person(s) who communicated with _@gmail.com and/or - (the

?Subject Accounts?) about any plan or proposal or agreement for Michael D. Cohen and/ or entities

 

 

associated with him to transfer any interest in taxi medallions, and any associated debts or
liabilities, to others, including to _and/ or entities associated with him;
d. Communications between the Subject Accounts and _relating to

Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances;

 

Case Document 43-4 Filed 03/19/19 Page 13 of 105

e. Evidence indicating the owner of the Subject intent as it relates to the

Subject Offenses under investigation.

 

Case Document 43-4 Filed 03/19/19 Page 14 of 105

 

Case Document 43-4 Filed 03/19/19 Page 15 of 105

1,

AD 93 (Rev. lli13} Search and Seizure Warrant El! 

Ill-Ji- 22.1 Elli?
UNITED STATES DISTRICT COURT mm arena
for the courting
District of Columbia I

 

in the Matter of the Search of

0503
(Brie?y describe the pi-opern: to be searched mi ii Bar? A.
or identify the person- hy Home and address) HGWE


i
mar-201?-
INFORMATION assoc! wm-I THE EMAIL assign Date :21 seizure warrant
ACCOUNT immanent i Danna-.071 search an -

 

SEARCH AND SEIZURE WARRANT

 

Tiff?? ?H?jf?tiu??i?i'iz?d' law?enforcernent?efn 5551? 
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of Galtfornia
edema? the person or describe the property it? be senrchen'andgive its intention):

 

See Attachment A.

I ?nd that the af?davittfs}, or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search Will reveal (identi?i the person or describe the proper-{y to be seized):

See Attachment B.

YOU ARE COMNIANDED to execute this warrant on 01? before 1. 2017 {not to exceed i4 days}
9? in the daytime 6:00 am. to 10:00 pm. Cl at any time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.

The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory
as required by law and return this warrant and inventory to Hon, Beryl A. Howell
{United States Magistrate Judge)

El Pursuant to IE U.S.C. 3103363), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C.
2?05 (except for delay of trial), and authorise the o?icer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check rag qppropricie hex}

for days (not to exceed 30,} El until, the facts justifying, the later speci?c date of

Date and time issued: . f/Mfy

Judge 5 signature

 

City and state: Washington. DC Hon. Beryl A. Howelt, Chiefg?. District Judge
IPrintdririieme Iain-if I

 

 

Case Document 43-4 Filed 03/19/19 Page 16 of 105

AD 93 {Rev 13) Search and Seizure Warrant [Page 2)

 

Return

 

Case No; Date and lit warrant Copy of warrant and inventory le? with:

 

 

1h.

 

- 1?,??ams?cp3 7/!3 ?Zrot'? -@1l5pza, {Age-2' Iwm?re?ar'gwaar

Inventory rnade in the presence of i -

 

Inventory of the property taken and name of any personis) seized:
Drgr?lL?.? ELLE 
230170714- 

A A 115?; erg


 

- 

FILED
Jumznr

Clark, u.s. District an
Bankruptcy Courts 

 

Certi?cation

 

I declare under penalty of periury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date; 

    

Primed rim-w and ri?e

 

 

 

Case Document 43-4 Filed 03/19/19 Page 17 of 105

ATTACHMENT A

This warrant applies to information with the Geegle Mail Account
-@gmail.eem that is stated at premises owned, maintained, centrelled, or operated by

Geegle, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043.

 

 

Case Document 43-4 Filed 03/19/19 Page 18 of 105

ATTACHMENT 

I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including any
emails, records, files, logs, or information that have been deleted but are still available to the

Provider, the Provider is required to disclose the following information to the government for each

a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;

b. Ail records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number);

The types of service utilized;

d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddyr lists, calendar data, pictures,
and ?les 

e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken and other identi?ers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with

.session times and dates, account status, alternative e?mail addresses provided



Case Document 43-4 Filed 03/19/19 Page 19 of 105

during registration, all other user names associated with the account, all account

names associated with the subscriber, methods of connecting;

 

 

 

 

All search history or web history;
g. All records indicating the services available to subscribers of the accounts;
h. All usemames associated with or sharing a lo gin IP address or browser cookie with
the accounts;
i. All cookies, including third-party cookies, associated with the user;
j. All records that are associated with the machine cookies associated with the user;
. 
it. All telephone or instrument numbers associated with the Account {includin MAC

addresses, Electronic Serial Numbers Mobile Electronic Identity
Numbers Mobile Equipment Identi?er Mobile Identi?cation
Numbers Subscriber Identity Modules Mobile Subscriber
Integrated Services Digital Network Number International Mobile
Subscriber Identifiers or International Mobile Equipment Identities



II. Information to be Seized by the Government

All information described above in Section I that constitutes evidence, contraband, fruits,
andior instrumentalities of violations of 13 U.S.C. 1014 {false statements to a ?nancial
institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 95] (acting as an
unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 61]
at .2:qu involving Michael Dean Cohen and occurring on or after January.r 1, 2016, including, for

each accoUnt or identi?er listed on Attachment A, information hertaining to the following matters:

a. Communications, records, documents, and other ?les involving Essential
Consultants, 

b. Communications, records, documents, and other ?les involving Bo and Abe Realty,


c. Communications, records, documents, and other ?les that false representations to a

?nancial institution with relation to intended the purpose of an account or loan at

that ?nancial institution; the nature of any business or entityr associated with Case Document 43-4 Filed 03/19/19 Page 20 of 105

in
..

account a ?nancial institution; the source of funds flowing into an account; or the
purpose or nature of any ?nancial transactions involving that ?nancial institution;
Records of any funds or bene?ts received by or offered to Michael Dean Cohen by,
or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign
pet-sens, or foreign principals;

Communications, records, documents, and other ?les that reveal efforts by Michael
Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction

of any foreign government, foreign of?cials, foreign entities, foreign persons, or

 

fore'i'gn'p'rincip'aIEIW? 

Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;

Evidence indicating the account owner?s state of mind as it relates to the crimes
under investigation;

The identity of the persona) who created or used the account, including records
that help reveal the whereabouts of such personfs); and

The identity of records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or
at the direction of any foreign government, foreign of?cials, foreign entities,

foreign persons, or foreign principals.

Case Document 43-4 Filed 03/19/19 Page 21 of 105

 

Exhibit 

Case Document 43-4 Filed 03/19/19 Page 22lof 105

r-s res

so 93 (at-1n -1 1!13)Search and Seizure Warrant

UNITED STATES DISTRICT COURT

for the
District of Columbia

in the Matter of the Search of
{Br-item; describe the property to be searched
or Hamid) the person by some ondaddress)

INFORMATION arsenals-rep. WITH THE EMAIL
ACCOUNT COM 

Case: 1:1?emj?00855
Assigned To: Chief Judge Howell Beryl A
Assign. Date: 111(1312017

Description: Search and Seizure Warrant

  



SEARCH AND SEIZURE WARRANT

 

"Train? authorized later enfofcement of?ccr 

 

An application by afederal law enforcement of?cer? or tin-attorney for the government requests the search
ofthc following person or property located in the Northern - District of California
(Monti)? firepower: or descrihe the prepay to he searched cord give its io'cctticn):

 

 

See Attachment A.

I find that the. affidavit(s), or any recorded testimony, establish probable cause to Search and seize the person or property
described ab cvc, and that such search will testes] (Memory the person or describe the prepare? to be seizes):

See Attachment 3.

YOU ARE COMMANDED to execute this warrant on or before November 2'0. 2017 (not to eIceezf re does)
la, in the daytime am. to 10:00 p.111. at anyr time in the day or night because good cause has been established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property Was taken, or leave the copy and receipt at the place where the
proper ty 

The ot?oor executing this warrant or an of?cer present during the execution of the must prepare an inventory

as required by law and retuln this warrant and invent-313' to Hon. Beryl A Howell
(United Stores Magistrate Judge}

Pursuant to 13 U.S.C. 3103 am}, i ?nd that immediate noti?cation may have an adverse result listed in 13 
TIDE (except for delay ofttial), and authorize the of?cer e?xechting this warrant to delay notice to the pierced who, or Whose
property: will be searched or Seized (check the appropriate box)

 

 

 

for days (no: to excess to} El until the facts justi?ring the later speci?c date of
Date and time issued: fj/ZD/vz? 4217?9533/55 5%
I signano a
City. and state: Washington, Dr: Hon. Beryl A. ?owed. Chief US. District Judge

 

 

Printed more and this

 Case Document 43-4 Filed 03/19/19 Page 23 of 105



AD 93 [Ii-er. Ill! 3] Search and Seizure Warranl?agez]

 

Return

 

Case Ne: Date and time warrant executed: Cali-y ef warrant and inventm'y left with:

 

 

 

Inventory made in the presence ef 

 

'Inventery ef the property taken and name efany persen(s} 'seizeti:

 

Certi?cation

 

I declare under penalty of perjury ?ratthis inventory is eel-rent and was returned along with the eriginal warrant te' the
designatedjudge. 

Date:

 

Executing e?cer '3 eignetm'e

 

and Ef?e

 

 

 

Case Document 43-4 Filed 03/19/19 Page 24 of 105

a: 

ATTACHMENT A

 

This watrant applies to information associated with the Googie Mail 
that is stored at premises owned, maintained, oontrolled, or operated

by Googie, a oompan},r headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043.

Case Document 43-4 Filed 03/19/19 Page 25 of 105

ATTACHMENT 

 

I. Information to be disclosed by Google
To the extent that the information described in Attachment A is within the possession,
custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including any
emails, records, ?les, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each

account or identi?er listed In Attachment A:

 

a. . The contents of all emails assocIated with the? account, including stored or preserved
copies of emails 'sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sant, and the size and length of each email;

b. All records or other information regarding the identi?cation of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with seasion times and dates, account status, alternative em'ail addresses
provided during registration, methods of' connecting, log ?les, and means and
source of payment (including any credit or bank account number);

o. The types of service utilized;

d. All records or other information stored. at any time by an individual using the
account, including address books, contaCt and buddy lists, calendar data, pictures,
and ?les;

c. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identi?ers, records of session tirnes and durations, the date
on which the account was created, the length of service, the types of service utilised,
the 1? address used to register the accomit, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account

names associated with the subscriber, methods of connecting;

Case Document 43-4 Filed 03/19/19 Page 26 of 105

f. All search history or web history;
g. All records indicating the services available to subscribers of the accounts;
h. All usernsr'nes associated with or sharing a. lo gin IP address or brow'ser cookie with

the accounts;

All cookies, including third-party cookies, associated with the user;

j. All records that are associated with the machine cookies associated with the user;
and

it. All telephone or instrument numbers associated with the Account {including MAC


Numbers Mobile Equipment Identifier Mobile Identi?cation
Numbers Subscriber. Identity Moduies Mobile Subscriber
Integrated Services Digital Network Number International Mobile
Subscriber Identi?ers or International Mobile Equipment Identities


II, Information to be: Seized by the (tavern ment
All information described above in Section I that constitutes evidence, contraband, fruits,
instrumentalities of violations of 18 U.S.C. 10.14 (false statements. to a ?nancial

institution), 18 U.S.C. i343 (wire fraud), 13 U.S.C. 1344 [bank fraud), and 18 [1.813. 1956

(money laundering), as well as 18 11.8.0. 951 (acting as an unregistered foreign agent) and the

I Foreign Agents Registration Act 22 611 er seq, involving Michael Dean

Cohen and occurring on or after June 2015, including, for each account or identifier listed on

Attachment A, information pertaining to the following matters:

a. Communications, records, documents, and other ?les involving Essential
Consultants, .
b. Communications, records, documents, and other files that false representations to a

?nancial institution with relation to intended the porpoise of an account or loan at
that financial institution; the nature of any business or entity associated with an
account a ?nancial institution; the Source of funds flowing into an account; or the

purpose or nature of any ?nancial transactions involving that financial institution;

Case Document 43-4 Filed 03/19/19 Page 27 of 105



c. Records of any funds or benefits received by or offered to Michael Dean Cohen by,
or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign
persons, or foreign principals;

d. Communications, records, documents, and other files that reveal efforts by Michael
Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction
of any foreign government, foreign of?cials, foreign entities, foreign persons, or
foreign principals;

e. Evidence indicating how and when the account was accessed or used, to determine

to the crimes under investigation and to the, account owner;
f. Evidence indicating the account owner?s state of mind as it relates to the crimes
'under investigation;
g. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s); and
h. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters relating
to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or
at the direction of any foreign govemrnent, foreign of?cials, foreign entities,
foreign persons, or foreign principals.
Review Protocols
Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attoniey-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ??lter

team," separate and apart from the investigative team, in order to address potential privileges.

answe?eaung-'

Case Document 43-4 Filed 03/19/19 Page 28 of 105

 

Exhibit 

Case Document 43-4 Filed 03/19/19 Page 29 of 105

.

AG 5'3 (Rev. ?13) Search and Seizure Warrant

 

 

UNITED STATES DISTRICT COURT

for the
District of Columbia 

In the Matter of the Search of 
{Brie?y describe the property to beseorcited {3333: 1 :17-mj?00354
or idennjajar?e person in: name and address} Assigned TO 5 Chief Judge Beryl A,
INFORMATION WITH THE accounr i Assign. Date 11i13r2t117

'5 STORED AT THE Description: Search and Seizure Warrant
PREMISES 0F1a1 INTERNET 

SEARCH AND SEIZURE WARRANT

  

To 'a?f author ized law enforcement officer

An application by a federal law enforcement of?cer or- an attorney for the government requests the search
of the following person or property located in the Northern District 91" California
?denthfi: the person or describe the prepare- to be searched emigt've its location):

 

 

See Attachment A.

I find that. the a?idavitls), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such seateh will reveal naearg?t riiepers'on or describe ?ieproperfy to he sei. eaJ:

See Attachment B.

ARE to execute this warrant on or before November ED. 201? a ease-ea re days)
a in' the daytime Enid-am. to 10:09 p.111. at any time in the day or night because .good cause has been established.

 

Unless delayed notice is authorized below, you must give a copy ofthe warrant and a receipt for the property'tekcn to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
pro?pertj.r was taken.

The officer executing this warrant, or an of?cer present during the. execution of the must prepare an inventory
as required by law and this warrant and inventor}r to - Hon; Beryl A. HoWeli
(Haitadl'i?rares Magistrate Judge}

 

Cl Pursuant to 13 USS. 3103a(b}, i find that immediate noti?cation magir halite an adverse result listed in 13113.0.
E'i?il? (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate ear) 

for days (not ta exceed 30) El until, the facts justifying, the later Speci?c date of

Date and timei?ssued: {ff/X 433119-14?? KW

.r signature

 

City and state: Washington. Dc . Hon. Beryl a. Hawaii, enter us. District Judge
- Printedrrante ondt?ifie

 

 

Case Document 43-4 Filed.03/19/19 Page 30 of 105

(on

AD 93 (Rev. ilr?l?j Search and Seizure Werramwege 2]

 

Return

 

Case No.: Date and time warrant executed: Copy of warrant and inventory left with:

 

 

 

Inventory rite-?e in the presence of 

 

Inventory of the property taken and name of any [Jame-11(3) seized:

 

 

 

CErti?Eation

 

I declare under-penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.

Date:

 

 

Execytr?ng a?oat? '3 signature

 

Primed ?me and ri?e

 

 

 

Case Document 43-4 Filed 03/19/19 Page 31 of 105

. I

ATTACIMENT A
This warrant applies to information associated with the entaild-_ that
is store-:1 Ext-premises owned,?meinteiuod, oontrolled, or operated by 1&1 Internet, Inc. an
electronic communication andf'or remote computing service provider headquartered in Sunnyvale,

California.

. . . 

identi?er listed 1n Attachment A

Case Document 43-4 Filed 03/19/19 Page 32 of 105

ATTACHMENT 

I, Information to be disclosed by 1&1

To the extent that the information described in Attachment A is within the possession,

on study, or control of the 1&1 (hereinafter ?the Provider?), regardless of whether such infonnation

is stored, held or maintained inside or outside of the United States, and including any emails,
records, ii les, logs, or information that have been deleted but are still available to the Provider, the

Provider is required to disclose the following information to the government for each account or

 

a. The contents of all emails associated with the account, including? stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was-sent, and the size and length of each email;

b. All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identi?ers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in 1P addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log ?les, and means and
source of payment (including any credit or bank account number);

c. The types of service. utilized;

All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;

c. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length ofserviee, the types of service utilized,
the IP address used to register the account, log?in IP addresses associated with
Session times and dates, account status, alternative e-mail addresses provided.
during registration, all other user names associated with the account, all account

names associated with the subscriber, methods of connecting;

Case Document 43-4 Filed 03/19/19 Page 33 of 105

HI-



All search history or web history;

All records indicating the services available to subscribers of the accounts;

Frill-i

All usernames associated with or sharing a login IP address or browser cookie with
the accounts;

i. All cool-ties; including third-party ecokies; associated with the user;

j. All 'rec'ords'that are associated with. the machine cookies associated with the user;
and

All telephone or instrument numbers associated with the Account [including MAC

 

 

Numbers Mobile Equipment Identi?er Mobile identi?cation
Numbers Subscriber Identity Modules Mobile Subscriber
integrated Services Digital Network Number hiternational Mobile
SubScriber Identi?ers or International Mobile Equipment Identities



II. Information to be Seized by the Government

All information described above in Section I that constitutes evidence, contraband, fruits,
andfor instrumentalities of viclations of 13 USS. 11914 (false statements to a ?nancial
institution),,13 U.S.C. 1343 (wire fraud), 18 U.S.C. 1344 (bank fraud), and 13 U.S.C. 1956
(money laundering); as well as 13 11.5.0. 951 (acting as an unregistered foreign agent) and the
Foreign. Agents Registration Act 22 U.S.C. 611 ct scan involving Michael Dean

Cohen; including, for each account or identi?er listed on Attachment A, information pertaining to

the following matters:
a. Communications, records; documents, and other ?les involving Essential
Consultants, 
b. Communications, records= documents, and ether ?les that false representations to a

financial institution with relation to intended the purpose of an account 'or loan at

that financial institution; the nature of an}r business, or entity associated with an.

account a ?nancial institution; the source of funds ?owing into an account; or the

purpose or nature of any ?nancial transactions involving that ?nancial institution;

(accentuates "statistic"tantra?

Case Document 43-4 Filed 03/19/19 Page 34 of 105

We. Fe.

c. Records of any funds or bene?ts received by or offered to Michael Dean Cchen by,
or on behalf of, any foreign government, foreign officials, foreign entities, foreign
persons, or foreign principals;

d. Communications, records, documents, and other files that reveal efforts by Michael

Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction

'of anyI fercign government, foreign officials, foreign entities, foreign persons, or 

foreign principals; 
e. Evidence indicating how and when the account was accessed or used, to determine
statistics"tins?sac,
to the crimes under investigation and to the account owner;
f. Evidence indicating the account owner?s state of mind as it rel-ates to the crimes
under investigation;
g, - The identity of the person{s) who created or used the account, including records
that help reveal the whereabouts of such person(s); and
h. The identity of any records that help reveal the whereabouts
of the communicated with the account about any matters misting
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or
at the direction of any foreign government, foreign of?cials, foreign entities,
foreign persons, or foreign principals.
IIL Review 
Review of the items described in Attachment A and Attachment shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professihna] responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated ?filter

team,? separate and apart from the investigative team, in order to address potential privileges,

Case Document 43-4 Filed 03/19/19 Page 35 of 105

 

Exhibit 

Case Document 43-4 Filed 03/19/19 Page 36 of 105

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK

 

In the Matter of 9. Warrant for All

Content and Other Information TO BE FILED UNDER SEAL
Associated with the Email Accounts

(Email mm, AGENT AFFIDAVIT

 
  

Maintained at
Premises Controlled by Google, Ino.,

the Email Account 9 6

Maintained at Premises Controlled by 8 1

Oath, Ino., and the Email Account
maintained at

Premises Controlled by 1 85 1 Internet,

1116., USAO Reference No.

20181100127

 

 

Agent Affidavit in Support of Application for a Search Warrant
for Stored Electronic Communications

STATE OF NEW YORK 
55.
COUNTY OF NEW YORK 

Special Agent-of the United States Attorney?s Of?ce for the Southern

District ofNeW York, being duly sworn, depoees and states:

I. Introduction

A. Af?ant

 

 

Case Document 43-4 Filed 03/19/19 Page 37 of 105

 

B. The Provider, the Subject Account and the Subject Offenses

2. I make this af?davit in support of an application for a search warrant pursuant to 13

U.S.C. 2703 for all content and other information associated with the email accounts

-@gmail.eom (the ?Cohen Account"), (the 
(the Account? (the
Account?), and -@aol.com (the ?I-Account") (collectively, the
?Subject Accounts?). The Cohen Account, _Aecount, and 

Account are maintained and controlled by Gongle, lnc., headquartered at 1600 Amphitheatre
Parkway, Mountain View, California 94043 (?Google?), the Account is maintained and
controlled by 35 1 Internet, Inc., headquartered at 701 Lee Road, Suite 300, Chesterbrook,
19087 and tit-Account is maintained and controlled by Oath, Inc.,
22000 AOL Way, Dulles, Virginia 20166 (?Oath?) (together, the ?Troviders??. The information
to be searched is described in the following paragraphs and in Attachments A, B, and I) to the
proposed warrants.

3. As detailed below, there is probable cause to believe that the Subject Accounts contain
evidence, fruits, and instrumentalities of violations of 13 U.S.C. 371 (conspiracy to defraud the
United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343
(wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?). The Target Subjects of
this investigation are MICHAEL COHEN (?Cohen?) and others known and unknown. This
af?davit is based upon my personal knowledge, my review of documents produced pursuant to
grand jury subpoenas and prior search warrants, my review of interview reports prepared by other
law enforcement of?cers, and my conversations with other law enforcement o?icers, as well as

2
01231013

Case Document 43-4 Filed 03/19/19 Page 38 of 105

my training and experience concerning the use of email in criminal activity. Because this af?davit
is being submitted for the limited purpose of establishing probable cause, it does not include all
the facts 1 have leamed during my investigation. Where the contents of documents and the actiOns,
statements, and conversations of others are reported herein, they are reported in substance and in
part, except where otherwise indicated

C. Services and Recurds of the Provider

4. I have learned the following about the Providers:

3. The Providers offer email services to the public. In particular, Google permits
subscribers to maintain email accounts under the domain name gmail.com. Google also allows a
subscriberto maintain email accounts under any domain name under the subscriber?s control. For
example, if a subscriber controls the domain name Google enables the subscriber
to host any email address under this domain name on servers operated by Google. Oath permits
subscribers to maintain email accounts under the domain name aol.com. 1 Sc: 1 permits subscribers
to maintain email accounts under an};r domain name under the subscriber?s control. For example,
if a subscriber controls the domain namt_= 1 Sr. 1 enables the subscriber to host any
email address under this domain name on servers operated by -1 85 1. A subscriber using the
Providers? services can access his or her email account from any computer connected to the
Internet.

b. The Providers maintain the following records and information with respect to every
subscriber account:

i. Email contents In general, any email (whiCh can include attachments such
as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form
in the account, is maintained on the Providers? servers unless and until the subscriber deletes the
email. If the subscriber does not delete the email, it can remain on the Providers? computers

3
02.28.2018

Case Document 43-4 Filed 03/19/19 Page 39 of 105

inde?nitely. Even if the subscriber deletes the email, it may continue to be available on the
Provider?s servers for a certain period of tirne.

ii. Address book. The Providers also allow subscribers to maintain the
equivalent of an address book, comprising email addresses and other contact information of other
email users.

Subscriber and billing iry?brmotion. The Providers collect and maintain
(typically unveri?ed) identifying information about each subscriber, including, for example, name,
usernamc, address, telephone number, and alternate email addresses. The Providers also maintain
records concerning the date on which the account was created, the Internet protocol address
of the user at the time of account creation, the current status of the account g. active or closed),
the length of service, and the types of services utilized by the subscriber. Additionally, for paying
subscribers, the Providers maintain records of the subscriber?s means and source of payment,
including any credit card or bank account number.

iv. Transactional information. The Providers also typically retain certain
transactional information about the use of each account on its system. This information can include
records of login (12a, session) times and durations and the methods used to connect to the account
(such as logging into the account through the Providers? website).

v. Customer correspondence. The Providers also typically maintain records
of any customer service contacts with or about the subscriber, including any inquiries or
complaints concerning the subscriber?s account.

vi. Search history. Google and Oath also typically maintain records of any

search history or web history associated with the subscriber?s account.

02.23.2013

Case Document 43-4 Filed 03/19/19 Page 40 of 105

vii. Associated content. Google also typically maintains content and records
relating to the following applications that are associated with its e?mail accounts: (A) ?Google
Docs,? which provides document-editing software that can be used to create, share, store, and
manage documents online; (B) ?Google Drive,? which enables users to store ?les on Google
servers, where they can be accessed remotely by the user and others; and (C) ?Gchat? or ?Instant
Messenger,? which provides a chat interface through which users can communicate with each
other in real time. Oath also typically maintains content and records relating to AOL instant
message, which provides a chat interface through which users can communicate with each other
in real time.

Preserved and backup records. The Providers also maintain preserved
copies of the foregoing categories of records with respect to an account, for at least 90 days, upon
receiving a preservation request from the Government pursuant to 18 U.S.C. 27036). The
Providers may also maintain backup copies of the foregoing categories of records pursuant to its
own data retention policy.

1). Jurisdiction and Authority to Issue Warrant

5. Pursuant to 18 U.S.C. 2703(a), a the Government may require
a provider of an electronic service or a remote computing service, such as the
Providers, to disclose all stored content and all non-content records or other information pertaining
to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules
of Criminal Procedure.

6. A search warrant under 2703 may be issued by ?any district court of the United States
(including a magistrate judge of such a court)? that ?has jurisdiction over the offense being

investigated." 13 use. 

UI

[12.28.2013

Case Document 43-4 Filed 03/19/19 Page 41 of 105

7. When the Government obtains records under 2703 pursuant to a search warrant, the
Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C.
2703(a), 35 (3). Additionally, the Government may obtain an order precluding
the Provider from notifying the subscriber or any other person of the warrant, for such period as
the Court deems appropriate, where there is reason to believe that such notification will seriously
jeopardize an investigation. 18 U.S.C. 2705(b).

E. Prior Applications

8. On or about July 18, 2017, in connection with an investigation being conducted by the
Office of the Special Counsel the Federal Bureau of Investigation sought and
obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District
of Columbia, a search warrant for emails in the Cohen Account sent or received between January
1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from
Judge Howell search warrants for emails in the Cohen Account sent or received between June 1,
2015 and November 13, 2017, and emails in the Account sent or received. between the
opening of the account and November 2017. The SCO has since referred certain aspects of
their investigation into Cohen to the USAO, which is working with the New York Field
Office. As part of that referral, the SCO provided the USAO with emails and other content
information obtained pursuant 'to the search warrants executed by the SCO, which had already

been reviewed for privilege.l As discussed below, this af?davit is based in part on my review of

 

I In an abundance of caution, in a separate application the USAO has sought authorization,
pursuant to Fed. R. Crim. P. 4 to review the emails obtained pursuant to the Prior Cohen Account
Warrants for evidence related to certain additional conduct that was not the focus of the Prior
Cohen Account Warrants. The emails obtained from the Prior Cohen Account Warrants that relate
to that additional conduct do not form a basis for the instant application.

02.23.2211 3

Case Document 43-4 Filed 03/19/19 Page 42 of 105

responsive materials produced pursuant to the July 1 and November 13, 2017 warrants the ?Prior
Cohen Account Warrants?).

9. On or about November 7, 2017, and anuary 4, 2013, as well as certain prior dates, the
SCO sought and obtained from Judge Howell orders authorizing and extending the installation and
use of pen registers and trap and trace devices to record sent to or from the Cohen
Account. The SCO has provided pen register data obtained pursuant to those orders to the USAO.
This af?davit, as discussed below, is based in part on my review of the pen register data obtained
pursuant to the November 7, 2017 and January 4, 2013 orders (the ?Pen Register Data?).

10. On or about Felzrruarj,r 16, 2018, the USAO sought and obtained from the Honorable
Debra Freeman, United States Magistrate Judge for the Southern District of New York, an order
pursuant to 13 U.S.C. 2703 for email header information associated with the 
Account. This affidavit, as discussed below, is based in part on my review of email header
information produced by 1 d: in response to that order (the Header Infonnation?).

Probable Cause

A. Overview

1 1. The United States Attorney? 5 Office for the Southern District ofNevv York and FBI are
hivestigati-ng, among other things, a scheme by Target Subject Michael Cohen to defraud multiple
banks. Cohen is an attorney 1who currently holds himself out as the personal attorney for President
Donald Trump, and who previously served for over a decade as an executive in the Trump
Organisation, an international conglomerate with real estate and other holdings.

The investigation has revealed that Cohen has made af?rmative misrepresentations in
and omitted material information from ?nancial statements and other disclosures that Cohen
provided to multiple banks in connection with a transaction intended to relieve Cohen of

approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth

7
transects

Case Document 43-4 Filed 03/19/19 Page 43 of 105

in detail below, in these ?nancial statements, and in his oral and other written statements to these
banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017
??om new consulting work; (ii) signi?cantly understated his total holdings of cash and cash
equivalents; and failed to inform the banks from which he was seeking debt relief that he had
agreed to make a $3.3 million cash payment to a third party, - in connection with
- acquisition of the taxi medallions securing Cohen?s debt. By making these
misrepresentations and material omissions, Cohen avoided making payments on his
loans, and attempted to and had secured proposed agreements from the banks to relieve him of
certain repayment obligations worth millions of dollars.

13. Based on my review of emails obtained from the Prior Cohen Account Warrants,
Header Information, and documents produced pursuant to subpoenas, I have learned that
Cohen has used the Cohen Account andfor Account to, among other things, 
communicate with and their attorney,?
about the proposed transfer of Cohen?s medallions and associated debts; (ii) negotiate a pay-down
of the principal amount of the taxi medallion loans; communicate with his accountant about

the contents of the false ?nancial statements at issue; and (iv) send those false ?nancial statements

to banks Additionally, i?lscd the 
Account, ._Account and-Account, respectively, to communicate with Cohen

about the status of the taxi medallion transaction, and to send relevant ?nancial statements to
banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that
the Subject Accounts will include evidence of the Subject Offenses.

B. Cohen?s Statements to Sterling National Bank
14. As set forth in detail below, in 2014, Cohen, through limited liability corporations
controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling

3
02.28.2013

Case Document 43-4 Filed 03/19/19 Page 44 of 105

National Bank (?Sterling?) and the Maltese Credit Union (?Melrose?), secured by taxi medallions,
for approximately $20 million. Though entered into by LLCs, the loans were also secured by
personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry
weakened and the medallions were devalued, Cohen sought to renegotiate the terms of those loans
andfor relieve himself from their obligations, including the personal guarantees. As part of that
effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets,
available cash, and ?nancial outlook. Speci?cally, based on my review of records maintained by
Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi
medallions, as well as my review of reports prepared by law enforcement of?cers of interviews
with a Sterling executive viee~president (the ?Sterling Employee?1?) and my participation in an
interview with a Sterling employee (the ?Sterling I have learned, among other
things, the following:

a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it
is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his
wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two
medallions).2 Cohen?s purchase of these New York taxi medallions was originally fmanced by
loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi
operator, and leased his medallions to a third party. That third party made payments to
Cohen, who in turn used some ofthose proceeds to pay his loan payments.

b. in early 2014, Cohen became a customer of Sterling when he sought to re?nance a

mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling

 

2 One of these companies, Mad Dog Cab Corp, was jointly owned by Sondra Cohen, who I
believe is Cohen?s mother.

02.23.2013

Case Document 43-4 Filed 03/19/19 Page 45 of 105

the prospect of re?nancing his taxi medallion loans, which were then at Capital One Bank. By in
or about September 2014, Cohen began negotiating a lending transaction with Sterling that would
allow Cohen to pay off his loans at Capital One and borrow more money from the then~increase in
value of the medallions. According to Sterling Employee-l, in 2014, prior to the recent upheaval
in the taxi industry?as a result of the emergence of ride-sharing services, such as Uber?taxi
medallion loans were viewed by bani-ts and investors as safe, short term credits, as the market value
of taxi medallions was consistently rising. Consequently, taxi medallion loans?like the loans held
by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose.
According to Sterling Employee~1, borrowers typically cashed out the increase in the loan amount
and used the additional funds for other purposes. Cohen appears to have followed this approach in
2014, when he agreed. to re?nance his medallion loans for approximately $22 million, which?-
according to letters from Capital One Bank in Sterling?s files?was greater than his previous debt
at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This
allowed Cohen to cash out the proceeds from the transaction.

c. Based on my review of records maintained by Sterling, have learned that on or
about December 3, 2014, each of Cohen?s sixteen taxi medallion corporations entered into loan
agreements and promissory notes with Sterling for the principal sum of $1 ,3 75,000, with repayment
due on December 3, 2016. Each loan was signed by Michael or Laura Cohen, depending on who
was the sole shareholder of the corporation. The loans were also each secured by a security
agreement, dated the same day, making the medallions collateral for the notes. To give Sterling
additional security, Michael and Laura Cohen signed personal guarantees and confessions of
judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were

their corporations to default under the loan agreements. in total, Sterling agreed to lend

l0
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 46 of 105

approximately $22 million to the Cohens? companies. Pursuant to participation agreements,
Sterling transferred 45 percent of that debt to lvielrose.3 Under the terms of Sterling?s participation
agreements with Melrose, Sterling was precluded ?om amending or modifying the loans without
the consent of Melrosc.

d. in evaluating Cohen?s requested re?nancing of the taxigmedallions, Sterling (and
Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s
request, Cohen provided Sterling with a statement of fmancial condition, dated August 1, 2014
(the ?August 2014 Financial Statement"), which indicated that Cohen had $100,740,000 in total
assets, $23,550,000 in total liabilities, and a net worth of From my review of a
Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the
transaction favorably because, accounting for loan payments, cash ?ows from the medallions were
projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million,
and the net worth of Cohen?who was the direct obligor under the guarantee agreements?was
over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20.
2014, approval of the loans for substantially the same reasons.

e. Based on my review of records maintained by Sterling and public sources, I have
learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due
to the rise in ride-sharing companies and signi?cant devaluation of taxi medallions. Additionally,
Cohen began falling behind on loan payments to Sterling and Melrose. II know from records

maintained by Sterling and an interview with Sterling Employee-2 that, beginning in or around

 

3 Melrose, which had a business principally focused on taxi medallion loans, is now in
conservatorship by the National Credit Union Administration 

4 Cohen subsequently provided Sterling with a revised statement of f?mancial condition, also
dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,5 50,000, and a
net worth of$75,870,000.

I
naessms

Case Document 43-4 Filed 03/19/19 Page 47 of 105

September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s
medallions had fallen behind in making payments to Cohen, and that as a result, the cash
?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately
$16,000 each month. For instance, I have reviewed an email from-Sterling Employee-2, dated
September 9, 2015, summarizing a call with Cohen?which according to the email and toll records
for Cohen?s cellphone occurred on September 8, 2015~during which Cohen told Sterling
Employee?2, in sum and substance, about his cash ?ow problems and a shortfall of
approximately $16,000. In that same email, Sterling Employee?2 commented that despite Cohen?s
statements, his personal ?nancial information ?indie ate[d] a strong ability to make up the difference
in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction
in Cohen?s payments. 

f. From my review of records maintained by Sterling and my participation in an
interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke
again on September 23, 2015, and that during the call Cohen stated, in sum and substance, that the
individual to whom Cohen leases the medallions had again reduced payments to Cohen. 1
know from my review of records maintained by Sterling that between in or about September 2015
and November 2015, Sterling raised the possibility?bod] internally and with Cohen?mt? Cohen
posting his real estate holdings, personal residence, or some other collateral as additional security
for the banks. According to these records, however, Cohen resisted these requests. From. my review
of loan documents and records maintained by Sterling, I know that in or about November 2015, as
a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to

cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by,

12
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 48 of 105

among other things, reducing the interest rate Cohen paid to Melrose and extending the loan
maturity date to December S, 201?.

g. lltnow from interviews with Sterling Employee-l and Sterling Employee?2, as well
as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee-1 that
Cohen bad a potential buyer of his taxi medallions, named -who would agree to
assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by
Sterling, as well as the interviews with Sterling Employeed and Sterling Employee-2 referenced
above, Iknow that by or before October 2016, Cohen had entered into negotiations to sell his sixteen
corporate taxi medallions to for the
balance of the loans, which at the time was $21,375,000. I lmow from my review of records
maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a
condition of the transfer of the medallion loans?and because Sterling was unfamiliar with-

??Sterling requested that Cohen make a substantial principal payment on the loan, of
approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But
on or about January 31, 2017, Cohen told Sterling Employee-1, in and substance, that he would
make a one million dollar principal reduction payment in order to move forward with the medallion
transfer deal with - Indeed, in an email sent from the Cohen Account to Sterling
Employee?2. on or about February 22.. 2017, Cohen con?rmed that he ?agreed to pay down 1 million
??om the loan amount.?

Pursuant to the participation agreements between Sterling and Melrose, Sterling
was required to secure Melrose?s agreement to participate in the transfer of the taxi medallion debt
from Cohen to On or about April 17, 2017, Sterling sent a memorandum to

Melrose summarizing the terms of the proposed transaction, and noting the requirement that

3
02.23.20??

Case Document 43-4 Filed 03/19/19 Page 49 of 105

Melrose agree to the terms. On or about May 2, 2017, emailed Sterling
Employee?l from the _Account to inquire about the status of the transaction.
Sterling Employee-l responded to at the _Account that
Melrose had agreed to the deal, and that Sterling would be sending a term sheet
shortly.

i. In order for the banks to evaluate the proposed transaction fully, they requested
?nancial information from the parties. On or about October 26, 2016, a Sterling employee emailed

the .-Account about the ?Cohen Medallion Purchase,? and stated order to

proceed with the assumption of Michael?s loans,? Sterling needed certain ?nancial information

_1t the _Account, that he would send a ?nancial statement and tax

returns shortly. Additionally, on or about June 7, 201?, Sterling Employee?1 emailed Cohen to
request an ?updated personal ?nancial completed jointly with Cohen?s wife, and
Cohen?s most recent federal income tax return. 011 or about June 8, 2017, Cohen emailed Sterling
Employeed ?om the Cohen Account, attaching a Sterling personal ?nancial statement form that
had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1,
2017 (the ?May 20]?l Financial Statement?), that was also attached. The May 2017 Financial
Statement included a cover letter from Cohen?s accountant_ stating, in sum and
substance, that the information in the statement came from Cohen and that -1ad not
continued its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had
total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The

May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in

14
02.232013

Case Document 43-4 Filed 03/19/19 Page 50 of 105

cash, $26,1 5 5,000 in closely held companies (such as the taxi medallion entities and his real estate
holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence.

j. Based on my review of reports of law enforcement intendews of Sterling
Employee?1, I have learned that Sterling Employee-1 reviewed each line of the May 2017 Financial
Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-l asked
Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling
Employee?1, in sum and substance, that the May 2017 Financial Statement Was accurate.

k. On or about August 16, 2017, Sterling Employee-1 emailed Cohen at the Cohen

Account and - at the -Account, attaching a non-binding term

sheet memorializing the potential transaction between Sterling, Melrose, Cohen, and -

- On or about August 29, 2017, .mailed Sterling Employee?1 from the-
Account, requesting that he be included on ?all future e?mails to and! or -

- concerning this matter," and providing proposed edits to the term sheet. On or about
August 30, 2017, Sterling Employee-1 emailed _at the 
Account, Cohen at the Cohen Account, and i- at the - Account, and provided them with a
revised term sheet. 011 or about September 5, 2017, Sterling Employee-1 sent?
at the ._aceount, Cohen at the Cohen Account, and-1t the .kccount a
copy of the executed term sheet. According to the term sheet, would borrow
$20,000,000 from Sterling and Mclrose, to be secured by the medallions that -was to
acquire from Cohen.

1. As part of the agreement, according to the term sheet, $1,265,913 in principal (which
is what would remain after the $20,000,000 payment. on the outstanding loan balance) would be

repaid by Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the

5
02.232018

Case Document 43-4 Filed 03/19/19 Page 51 of 105

remaining half of the balance. Based on my review of an internal Sterling credit memorandum,
dated October 4, 2617, the parties reached a preliminary agreement that Cohen would pay $532,956
of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb
$3 57,167 and $275,789 respectively in the form of charge?offs. According to Sterling Employee-
1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its
prior insistence that Cohen make a principal pay-donm of at least one million dollars?because
Cohen represented on a telephone call with. Sterling Employee-1, in sum and substance, that he had
insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Starling
and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made
on behalf of the LLCs. Thus, after completing the -t1'ansaction, Cohen would no longer
have had any outstanding obligations to Sterling or Melrose.

111. Based on my review of emails sent by Sterling employees, I have learned that
because the transaction between the parties was subject to full credit underwriting by Sterling and
Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling
required and requested additional ?nancial statements for Cohen and - for its credit

underwriting process. In response to Sterling?s requests, on or about October 5, 2017, 

- sent from the Account to a Sterling employee a copy of i-
- personal ?nancial statement. The ?nancial statement lists the?

Account as the email contact for?. Additionally, on or about October 5, 2.017,

 

Cohen, using the Cohen Account, re?sent Sterling Employee?2 a copy of his May 2017 Financial
Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling
Employeeil a statement of ?nancial condition, dated September 30, 2017 (the ?September 2017

Financial Statement?).

1 6
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 52 of 105

11. Like the May 2017 Financial Statement, the September 201?}l Financial Statement
included a cover letter from- Cohen?s accountant, stating, in sum and substance, that
the information in the statement came from Cohen, and that -1ad not con?rmed its accuracy
or completeness. The September 2017 Financial Statement stated that Cohen had total assets of
$33,430,000, total liabilities of$45,630,000, and a negative net worth of $12,200,000. Notably,
unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement
represented to Sterling that Cohen had a negative net worth. The September 2017 Financial
Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in
closely held companies (such as the taxi medallion entities and his real estate holdings), 5
$3,200,000 in real estate investments, and his $1 1,000,000 personal residence (which, for the ?rst
time, he indicated was held in trust). The September 2017 Financial Statement included assets and
liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and
some" of his real estate investment entities.

c. From my participation in an interview with Sterling EmployceZ, and my review of
records maintained by Sterling, I have also learned that at or around the time Cohen ptovided
Sterling with these ?nancial statements?in or around September 20] 7?Cohen stopped paying
loan payments on his taxi medallion loans altogether. According to Sterling Employee-
2, Cohen informed Sterling, in sum and substance, that he had insuf?cient funds to pay the 
principal and interest payments on his medallion loans. By in or about December 201?, Sterling
and Melrose had not been paid approximately $276,937.92 in principal and interest

payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the

 

5 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty?two New
York taxi medallions. at approximately which was considerably less than the
$650,000 valuation ascribed to each medallion in the -

7
02282013

Case Document 43-4 Filed 03/19/19 Page 53 of 105

September 2017 Financial Statement, and his delinquency in making payments to Sterling, among
other things, the bank?s credit undeiwiting committee determined (and memorialized in a
December 2017' memorandum) that the Cohen??- transaction was favorable for the bank
that is, that -would he a better borrower than Cohen.

p. On or about December 26, 201?, Sterling sent Cohen a demand letter requesting
the immediate receipt of past-due loan payments. On December 29, 2017, Sterling sent Cohen a
letter stating that he was in default under the loans between Sterling and Cohen?s medallion
colporations. Cohen did not make an immediate payment on the loans, but instead sent an e-mail
to Sterling Employee-l on or about anuaiy 24, 2013, from the Cohen Account, stating that during
the closing of the Cohan-transaction, Cohen would ?bring all payments up to date as
Well as deposit the payo? differential.? Cohen also requested by email sent from the Cohen
Account on January 2.4, 2018, that at the closing of the Cohen-- transaction, Sterling
provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal
guarantees of the medallion loans had been terminated.

q. The Cohen-?- transaction, however, did not close. On or about January
29, 2018, -the -attorney, emailed attorneys for Sterling from the-xccount
and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have
changed and we are not prepared to go forward.?

r. Based on my participation in the interview with Sterling Employee-2 and my
review of records maintained by Sterling, I know that after the Cohen~- deal fell apart,
Sterling assigned Cohen?s loans to an employee at Sterling who specializes in collecting on
defaulting loans (?Sterling From my review of telephone call notes, llrnow that

Sterling Employee-3 spoke to Cohen on or about January 30, 2018 about paying down andfer

3
02.282013

Case Document 43-4 Filed 03/19/19 Page 54 of 105

restructuring Cohen?s outstanding taxi medallion loans. Based on my review of an email between
Sterling Employee-3 and Cohen, I know that on the January 30, 2018 call, Cohen stated that he
would send a ?corrected current? version of his personal ?nancial statement. Following that call,
on or about January 31, 2013, Cohen emailed Sterling Employecafi from the Cohen Account a
copy of the September 2017r Financial Statement. Later that day, Cohen again emailed Sterling
Employee-3 from the Cohen Account and proposed paying $500,000 to bring the loans current
and $75 0,000 to bring the principal balance to $20,500,000. Cohen also suggested revised 
interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to
Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the
entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000
(in total, a payment of approximately $1,750,000), and would need to make larger interest
payments.

a. On or about February 1, 2018, Cohen emailed Sterling Employee-3 from the Cohen
Account and proposed ?[p]ayment of $1.250m which ALL can he used to pay down principal, if
[Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m."
(Emphasis in original.) Cohen also stated, in sum and substance, that he had insuf?cient ?nancial
resources to post additional collateral er pro-fund payments. Based on my participation
in an interview with Sterling Employee-2, Ihave learned that Sterling continues to renegotiate the

medallion loans with Cohen based on Cohen?s re resentations about his current ?nancial osition.


9
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 55 of 105

C. Cohen Made Material Misrepresentations About His Finances to Banks

Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work

15 . As set forth in detail below, despite multiple representations by Cohen to Sterling (and,
by extension, Melrose's) that he had insuf?cient funds to pay down the principal balance of the
medallion loans, make interest payments, or pay past-due amounts, it appears that
between 20] 6 and the present, Cohen opened and maintained bank accounts at First Republic Bank
(?First Republic?), and then received millions of dollars in purported consulting payments in these
accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these
funds during the very period in which he made disclosures to Sterling about his personal ?nances
(including his assets and liabilities) and his ability to make payments on the medallion loans. In
these disclosures to Sterling?and despite being asked about these bank accounts by his
accountant?Cohen withheld information about liquid financial assets at First Republic.

16. Speci?cally, based on my review of documents and bank records produced pursuant to
a subpoena by First Republic, and my participation in and review of reports of interviews with two
First Republic employees, I have learned, among other things, the following:

a. Cohen and his wife have been customers of First Republic since approximately

June 2011. Cohen controls several checking and loan accounts, some in his own name and others

in the names of corporate entities.

 

5 Based on my review of a report of an interview conducted with an employee of Melrose, 1
have learned that, pursuant to the participation agreement beaveen Sterling and Melrose, Cohen?s
?nancial statements and other records in Sterling?s possession were forwarded to Maltese so that
Melrose could make a determination as to whether to approve of the Cohen!
n'ansaction. Based on my review of reports of interviews with Melrose employees, 1 atso know
that Cohen called employees at Melrose regarding the Cohen transaction.

  
  

 

20
(12.23.2013

Case Document 43-4 Filed 03/19/19 Page 56 of 105

b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new
checking account at First Republic in the name of Essential Consultants LLC (the ?Essential
Consultants Account?). Cohen was the only authorized signatory on the account. When Cohen
opened the Essential Consultants Account, a First Republic employee (?First Republic Employee-
conducted an in?person interview of Cohen. In response to a series of know-your-customer
questionsI about the purpose of the account?the answers to which First Republic Employee-1
entered into a forms?Cohen stated, in sum and substance, that he was opening Essential
Consultants as a real estate consulting company to collect fees for irwestment consulting Work,
and all of his consulting clients weldd be domestic individuals based in the United States. Cohen
also stated, in sum and substance, that his purpose in setting tip the account was to keep the revenue
from his consulting business?which he said was not his main source of income?separate from
his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s
statements about the intended pinpose of the account and source of funds for the account were
false. Speci?cally, the account was not intended to receive?and does not appear to have

received?money in connection with real estate consulting work; in addition, the account has

touched substantial payments ?om foreign sources.

 

 

7 Certain ?nancial institutions are required to conduct such procedures pursuant to the Bank
Secrecy Act and its implementing regulations. See 31 U. .0 5313; 31 C. .R 1020.220.

3 First Republic Employeewl first ?lled out the form on the day he intervieWed Cohen, October
26, 2016. On or about December 19, 2016-, at the request of bank compliance personnel, First
Republic Employee?l updated the form to add more detail about Cohen statements.

21
02.25.2013

Case Document 43-4 Filed 03/19/19 Page 57 of 105

 

cl. Second, I know ?om my review of First Republic bank records that were scheduled

by an FBI forensic accountant that a?er Cohen opened the Essential Consultants Account, Cohen
received payments into that account ?'orn foreign?businesses and entities that do not re?ect the
stated client pro?le for the residential and commercial real-estate consulting services. Speci?cally,
from my review of the Essential Consultants Account schedule and public sources, I know the
following:

i. Beginning on or about January 31, 2017, Cohen began receiving 
payments of $83,333 from an entity called Columbus Nova LLC, which were deposited into the
Essential Consultants Account. According to public sources, Columbus Nova is an investment
management firm controlled by Renova Group, an industrial holding company based in Zurich,
Switzerland that is controlled by Rossian national Vilctor Vekselberg. From January 2017 to

August 2017, the. Essential Consultants Account received seven payments totaling $583,332.98

from Columbus Nova LLC.

 

02.283018



Case Document 43-4 Filed 03/19/19 Page 58 of 105

ii. Beginning on or about April 5, 2017, Cohen began receiving payments from
Nevartis Investments, EARL, which I believe to be the in?house ?nancial subsidiary of the Swiss
pharmaceutical company Novartis hiternational AG (?Novartis?). Between April 2017 and January
2018, the Essential Consultants Account received ten wire payments from a Swiss bank account
held in the name of Novartis, each in the amount of $99,980, for a total of $999,300.

Beginning in or about April 2017, the Essential Consultants Account started
receiving wire payments from a bank account associated with the telecommunications company
Inc. Speci?cally, on or about April 14, 2017, wired $100,000 to the
Essential Consultants-Account and, from in or about June 2017 to in or about January 2013, the
Essential Consultants Account received nine $50,000 payments from In total,AT&T wired
$550,000 to the Essential Consultants Account.

iv. On or about May 10, 2017, June 9, 2017, July 10, 201?, and NoVember 27,
2017, the Essential Consultants Account received four deposits in the amount $15 0,000 (totaling
$600,000) from a bank account in South Korea. The account holder from which the money was
sent is Korea Aerospace Industries Ltd. KAI is a South Korea-based company that
produces and sells ?xed?wing aircraft, helicopter aircraft, and satellites to the United States
Department of Defense, among other customers.

v. On or about May 22, 2017, the Essential Consultants Account received a
$150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account
holder at Kazlcotnmertsbank was a second Kazakhstani bank named BTA Bank, A0. A message
accompanying the wire payment indicated that the payment was a consulting fee as per

Inv DD May 10, 2017 consulting agreement WIN DD 08 05 2017 CNTR WINDD



02 .28.20  

Case Document 43-4 Filed 03/19/19 Page 59 of 105

vi. In total, from on or about January 31, 2017 to on or about January 10, 2013,
the Essential Consultants Account received approximately $2,883,132.59? in transfers and checks
from the aforementioned entities. As of on or about January 10, 2013, the balance in the Essential
Consultants Account was $1,369,474.23. I

e. On'or about April 4, 2017, Cohen opened another new checking account at First
Republic, this one in the name of Michael D. Cohen &Associates, P.C. (the Account?).
Cohen was the only authorised signatory on the account. Among other things, the 
Account received ten wire transfers and one check from an account in the name of Squire Patton
Boggs, a law ?rm. In total, from on or about April 5, 2017, to on or about January 2, 2018, the
MDCIELA Account received $426,097.70 in deposits, and the balance in the account as of January
2, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the
Essential Consultants or WCELA accounts to Sterling during the negotiations with respect to the
- transaction, including in his May 2017 Financial Statement and September 2017
Financial Statement.

17'. Based on my review of emails from the Cohen Account that were seized pursuant to
the Prior Cohen Account Warrants, and my review of reports of interviews with employees of
and Novartis, it appears that the aforementioned payments to the Essential Consultants
Account and Account ostensibly were for political consulting work, including consulting
for international clients on issues pending before the Trump administration.? Speci?cally, from

my review of emails from the Cohen Account and public sources, I have learned the following:

 

1? Based on my review of public sources, I have learned that Cohen is not registered as a
lobbyist or as a person acting as an agent of foreign principals, as may have been required by the
Foreign Agents Registration Act.

24
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 60 of 105

a. On or about April 28, 2017, Cohen sent an email from the Cohen Account to an
individual whom I believe is af?liated with KAI. In the email, Cohen attached a document
purporting to be a ?Consulting Agreement? between KAI and Essential Censultants dated as of
about May 1, 20.17. The document indicates that Essential Consultants would render ?consultin 
and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a
consulting fee of One Million Two Hundred Thousand US Dollars,? disbursed
through eight $150,000 installments between May 2017 and December 2017.

b. On or about May 10, 2017, Cohen sent an email from an alternate email address,
copying the Cohen Account, to an employee of BTA Bank. To the email, Cohen attached an
invoice to BTA Bank in the name of Essential Consultants. The invoice contemplated a $150,000
payment to Essential Consultants for a consulting fee.?

c. On or about February 13, 2017, Cohen emailed an employee ?'om the Cohen
Account what appears to be a consulting agreement, which contemplates that Essential Consultants
?shall render consulting and advisory services to and that would ?advise [Essential
Consultants] of those issues and matters with respect to which Services desires [Essential
Consultants]?s assistance and advice.? The contract calls for ?to pay the Consultant for his
services . . . a consulting fee of Fifty Thousand ($50,000) Dollars . . . per Based on my
review of reports of interviews with employees, I have learned that A'l?dc'l? retained Cohen
to consult on political issues, including net neutrality, the merger between and Time Wamer,
and tax reform.

d. On or about January 17, 20W, Cohen emailed to a lepresentative of Novautis from
the Cohen Account a contract between Novartis and Essential Consultants, which provides that

Essential Consultants will ?provide consulting and adviscly services to Novartis on matters that

02.18.20] 8

Case Document 43-4 Filed 03/19/19 Page 61 of 105

relate to the repeal and replacement of the Affordable Care Act in the US and any other issues
mutually agreeable to [Essential Consultants] and Nevartis.? The contract provides for a
?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to
Essential Consultants in even installments over the course of a year. Based on my review
of reports of interviews with Novartis employees, I hate learned that Novartis retained Cohen to
provide political consulting services and to gain access to relevant policymakers in the Trump
Administration.

c. On or about April 3, 2017, Squire Patton Boggs, a law ?rm, announced on its
website that is had formed a ?strategic alliance? with Michael D. Cohen Se Associates and would
?jointly represent alien 

18. Despite the signi?cant amount of money that Cohen received into the Essential
Consultants Account and the Account, and the cash balance in both accounts, Cohen did
not disclose that infoirnation to Sterling or Melrose. Speci?cally, based on my review of documents
provided by I and my review snows and a? 1
have learned the following:

a. In or about May 2017,-met with Cohen at a law ?rm in Manhattan, New
York. At the meeting, Cohen told- in sum and substance, that he had set up a law practice
called Michael D. Cohen <95 Associates RC, and a consulting company called Essential Consultants
LLC. Cohen told- in euro and Substance, that he expected to earn $75,000 per month in
connection with his law practice, and that he expected gross revenues for the consulting business to
be between title and six million dollars annually.

b. In or about October 2017, if not earlier, .Was preparing a personal ?nancial

stateu1ent for Cohen. On or about October 6, 2017, -sent an email to Cohen at the Cohen

26
02.23201 3

Case Document 43-4 Filed 03/19/19 Page 62 of 105

Account in which -vvrote that ?[a]ttached is a draft of the new PFS as of September 30, 2017?
and attached a draft of the September 201'? Financial Statement. The dra? statement re?ected that
as of September 30, 2017', Cohen had only $1,250,000 in cash, total assets of approximately
$33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence
and property), and liabilities of approximately $45,630,000, leavmg him purportedly over $12
million in debt. in the same email,-questioned Cohen, in sum and substance, about the fact
that the ?nancial statement did not list any assets associated with either the Essential Consultants
Account or the WCSIA Account: did not add any value for you[r] two operating entities 
Michael D. Cohen 82: Associates POC [sic] and Essential Consultants LLC. Please advise whether
or not these should be disclosed and what value.?

c. On or about October 6, 2017, Cohen called -by telephon%which is re?ected
on toll records for Cohen?s cellphone?and told - in sum and substance, not to include
Essential Consultants or in the September 201? Financial Statement because they had no
value.

d. On or about October 6,2017, following the call with-Iohen, using the Cohen
Account, reaponded to - email with the answer ?[l]ooks good to me.? Cohen neVer directed

- to make any changes to his cash position as listed in the September 2017 Financial
Statement. Neither Essential Consultants nor was listed on the September 2017 Financial
Statement that was provided to Sterling.

19. Based on the foregoing, and from my review of bank records and emails sent by Cohen
to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of
assets that Cohen held in the Essential Consultants Account or the Account. As of

September 30, 2017?the date of the September 2017 Financial Statement?Cohen had

27

02.23.2013

Case Document 43-4 Filed 03/19/19 Page 63 of 105

approximately in the Essential Consultants Account and $248,619.28 in the 
Account. As of October 6, 201?, the date when -lsked Cohen about the two accounts, Cohen
had approximately $823,709.95 in the Essential Consultants Account and $248,619.28 in the
Account.
Cohen Understated His Available Cash

20. In addition to withholding the existence of the Essential Con5ultants Account and the
Account from Sterling and Melrose, it appears that Cohen also substantially understated
.his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, I know from my
review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen
represented that he had $1,250,000 in cash as of September 30, 2017. But, from my review of a
summary of bank records that were scheduled by an FBI forensic accountant, I have learned that
Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2017. Speci?cally,
from my review of the account schedule and bank records, I have learned the following:

a. Cohen has three checking andfor savings accounts at Capital One Bank, one of
which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,630.35 in his savings
account, and $1,262,982.29 in total in the three accounts at Capital One Bank.

b. Cohen has three accounts at Morgan Stanley in his name. As of September 30,
2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41.

c. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank.

d. In addition to the Essential Consultants Account and Account at First
Republic, Cohen also had We joint checking accounts with Laura Cohen at First Republic. In total,
as of September 30, 2017, Cohen had at least 31337530937 in total in his four accounts at First

Republic.

02.23201 3

Case Document 43-4 Filed 03/19/19 Page 64 of 105

e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of
September 30, 2017.

f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling.

g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his
wife?and the total balance across the two accounts as of September 30, 2017 Was $300,096.72.

h. In total, as of September 30, 2017, Cohen had at least $5,014,051.80 in his accounts
at Capital One Bank, Signature Bank, TD Bank, Bethpage Credit Union, First Republic, and
Morgan Stanley.

21. Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling
and Maltese that he did not have more than $1,250,000 were False, and that Cohen withheld
information regarding approximately $5 million in funds from Sterling and Melrose in order to
secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an
interview with Sterling Employee-2, and my review of reports of interviews with Sterling
Employee-l and two Melrose employees, it is my understanding that that Sterling and Melrose
would View Cohen?s understating of his assets as material to its decision whether to renegotiate

Cohen?s medallion loans and on what terms, or approve of the transfer of these loans to

Cohen Had a Side Agreement With -

22. As set forth in detail below, it appears that during the course of Cohen?s negotiations to

sell his interest in taxi medallions and the associated debt to Cohen not only

 

misrepresented his ?nancial position to Sterling, but also failed to disclose a side deal he had

negotiated with _it appears that _agreed to pay an above-market price for

Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay _approximately

29
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 65 of 105

$3.8 million in cash. Specifically, from my review of documents produced pursuant to a subpoena
by Sterling, and reports prepared by law enforcement of?cers of interviews with Sterling
Employee?l, as well as my participation in an interview with Sterling Employee?2, I have learned,
among other things, the following:

a. On or about September 5, 2017, an executed term sheet was circulated by Sterling
Employee-l to Cohen and? See supra'll 1400. According to the term sheet, -
- would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions
that -was to acquire from Cohen a price of $20 million for thirty-two taxi medallions,
the proposed transaction valued each medallion as worth $625,000. The term sheet also
contemplated a $1,265,913 pay-down of the principal balance of the loan. The term sheet made no
mention of a $3.8 million payment from Cohen to - or any other form of payment or
?nancial transaction between the parties.

b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017,
describing the terms of the Cohen-_ transaction and the new loan tr_did
not mention any payments from Cohen to - including a $3.8 million payment The
memorandum also noted that the ?loan amount of indicates a purchase price per
medallion? but ?it is recognized that this is not in line with current market values.? Indeed,
according to an internal Sterling memorandum dated February 5, 2018, in the month of January
2013, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling
Employeed and Sterling Employee-2, they Were never told that - agreed to a purchase

price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make

any payment to -

02.28.2013

Case Document 43-4 Filed 03/19/19 Page 66 of 105

23. While Cohen and did not disclose any payment from Cohen to

communications with Sterling, it appears that such a payment. was contemplated.
Indeed, based on my review of records maintained by -and a report prepared by law
enforcement agents of an interview with I- I have learned the following, in substance and in
part, regarding the proposed side-payment from Cohen to?

a, On or about September 19, 2017, -prepared a memorandum for Cohen

entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the 

The --Memorandum the proposed transaction between Cohen and -

in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion
entities to a Buyer who will assunm their bank indebtedness, upon the [Cohens?] paying down the
debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of $3,300,000.? 
1). According to- Cohen told him the parameters of the deal, including the
payment of $3,800,000 to- but -:lid not know where Cohen was going to obtain
$3,800,000 to pay - As noted above, Cohen had more than $5,000,000 in cash and
cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial
Statement that he had $1.25 million in cash.
24. Based on my review of records maintained by Sterling (as well as Melrose, the bank
with the participating interest in the loans) and reports of interviews of representatives of Sterling
(and Melrose), I have seen no evidence that Sterling, Melrose, or any other ?nancial instimtion

involved in the potential deal with Cohen and -was aware of the planned $3.3 million

side payment from Cohen to -

 

 

The reference to thirteen medallions appears to be an error by 4- Cohen and his wife
together owned sixteen corporations, which in turn owned 32 taxi medallions.

31
02132013

Case Document 43-4 Filed 03/19/19 Page 67 of 105

D. Probable Cause Regarding the Subject Accounts

25. As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling
that he has dif?culty making payments on his medallion loans and, since at least October 2016,
Cohen has been actively engaged in an attempt to sell his taxi medallions and the associated debts

to_ In the course of doing so, Cohen has used the Cohen Account andfor 

Account to engage in email communications regarding the terms of the transactions and the

_at the 4- Account, and at the-Account. Speci?cally,

as described aboVe, there is probable cause to believe that the Subject Accounts have been used

 

undisclosed side-payment with

regarding the proposed Cohen?- transaction with Sterling:

3.. Cohen has used the Cohen Account to, among other things, negotiate a pay?down
of the principal amount of the loan, sea supra ii 14(g), to send term sheets to Sterling, see supra 1]
140), to communicate with his accountant about the contents of ?nancial statements, see supra 1 
16, to send fmancial statements to Sterling, see supra fl 14(i), to check on the status of the
transaction as of January '24, 2018, see supra ii 14(n), to negotiate a reduction of his debt with
. Sterling on or around January 31, 2018, see supra 1[ 14(0), to tell Sterling on February 1, 2018, he
does not have the ability to pay more than 531,25 0,000, sea supra 1i and to communicate with
individuals responsible for sources of payments to the Essential Consultants Account, see supra Ti
15. In other words, from the communications described above, it appears likely that the Cohen
Account will contain recent evidence of the Subject Offenses, including communications and
potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling
are false or misleading.

b. _has used the _Account to communicate about
the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early

32
01232013

Case Document 43-4 Filed 03/19/19 Page 68 of 105

as October 2016. See supra 1i Speci?cally, as described above, as early as May 2, 2017,

_used the - Account to inquire about the status of the transaction,

see supra 11 14(h). He used the?Account to exchange drafts of the proposed tenn
sheet with Cohen,- and Sterling, see supra 1! 140). The ._Account was also

used by l-to send a personal ?nancial statement for_ to Sterling,
see supra 14(1). The I_Account was copied on emails from the -

Account about the transaction, see supra 11 140), and was listed on ?nancial
statement as the contact email for_. sea supra 1i 14011). Additionally, based on my
review of WCPC Header Information, [know that on or about September 1, or around
the time the -md Cohen were negotiating a term the
_Account to send and receive eight emails from Cohan at the Account.
o. -t as used the .kccount to communicate with Sterling employees, Cohen,
and ._about the proposed taxi medallion transaction since at least December 20 16.
See supra 1W 14(g), 24(c). Speci?cally, on or about August 29, 2017, .told Sterling that he
should be included on ?all future e-mails? involving the proposed transaction, see supra 140).
Additionally, -was involved in making revisions to the parties? term sheets, and he told
Sterling on January 29, 2.013 that-would not go forward with the planned transaction,
see supra 11 146), Accordingly, there is probable cause to believe that the -Account will

contain evidence of the negotiations between Sterling and the parties, evidence of a payment from

Cohen to-md the reasons for the collapse of the Cohen-?- transaction.

12 For instance, ?'orn records provided by Sterling, I know that on or about December 2,
2016,?sent an email to a Sterling employee using the?
Account. The email forwarded correspondence between-Who was using the?
Account, and an employee of Capital One regarding extending loan with
Capital One.

 

33
02.23am

 

Case Document 43-4 Filed 03/19/19 Page 69 of 105

26. Additionally, it appears that Cohen set up the Account to receive emails he
was previously receiving at the Cohen Account. Speci?cally, based on my review of records
maintained by I have leamed that on or about May 5, 201?, Cohen sent an email from the
Account to a blind copy list of recipients stating that ?[d]ue to the overwhelming volume
of phone calls and emails coming into my previous cellular number and e?mail address, I have
elected to create for Clients Only the following. Kindly use this new information for all future
contact and communications.? The signature line on the email listed ?Essential Consultants 
and ?Michael D. Cohen tit Associates, as well as the Account as the email. address. ?3

27. In addition, based on my review of emails from the Account produced
pursuant to the Prior Cohen Account Warrants and the Header Information, I have learned
that Cohen has used the Account to send and receive emails from the Cohen Account, to
communicate with tbt-chount, and to send and receive emails from other email accounts
about his political consulting business. Additionally, from my review of the Header
Information, it appears that since the 
Cohen has continued to send and receive emails at the Account that appear likely to be
relevant to the commission of the Subject Offenses. For example, emails obtained pursuant to the
Prior Cohen Account Warrants, as well as the Header Information have revealed the
following:

a. 0n approximately eight occasions in August and September 2017, while Cohen,

were communicating about a term sheet for the Cohen-"-taxi

 

13 Based on my review of emails from the Account obtained pursuant to subpoena, I
have learned that Cohen has used the account to communicate with numerous individuals with
whom he does not enjoy an attorney-client privilege, including some of the individuals described
below. See ie?a Ti 27.

3-4

92.23-2018

Case Document 43-4 Filed 03/19/19 Page 70 of 105

medallion transaction, see supra 1[ 140:), Cohen used the Account to send or receive
emails ??om-it the-recount. For instance, on or about August 22, 2017, -used
the -Account to send an email to Sterling Employeeul and copied Cohen on the email at the
Account. On the same day, Sterling Employee-1 responded to -at the-tecount
and Cohen at the Account. On or about August 22, 2017, Cohen also used the 
Account to send an email to Sterling Employee?l .

b. As noted above, on or about September 1, 2017.; Cohen used the Account
to send or receive eight emails with the_ Account.

I c. Cohen used the Account to send and receive emails from individuals who
work at companies with whom it appears Cohen has a political consulting agreement. For
example, beginning in April 2017?the same month when Cohen began receiving payments from
see supra 16(d), used the Account to send and receive emails
from employees. These emails contain, among other things, invoices from Cohen to 
for consulting work by Cohen. Similarly, beginning in April EON?which is also the month
Cohen began receiving payments from Novartis for consulting work, see supra 16(d), 17(d)?
Cohen need the Account to send and receive emails from employees ofNovartis. These
emails concern, among other things, invoices from Cohen and requests for Novartis for Cohen?s
assistance on an initiative relating to drug pricing.

d. From my review of the Header Information, I have learned that Cohen has
continued to use the Account to send and receive emails ?om individuals who work at
companies with whom it appears Cohen had a political consulting agreement, such as Novartis and
AT For instance, on approximately six occasions between November 28, 2017 and January

30, 2018, the Account was used to send and receive emails from accounts belonging to

35
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 71 of 105

individuals using @attcom email addresses. Similarly, on approximately seventeen occasions
between December 1, 2017 and February 20, 2018, the Account was used to send and
receive emails from accounts belonging to individuals using @novartis.con1 email addresses.
Since November 15, 20] 7, the Account has also sent and received emails with individuals
using the email domains @bta.kz, whichl believe is the email domain used by employees of BTA
Bank, see szmra 111] 16(d), 17(b), and @squirepb.com, which I believe is the email domain used by
employees of the law firm Squire Patton Boggs?both of which Cohen appears to have a
consulting relationship with, sea supra 16(e), 17(e). Accordingly, it appears that Cohen
continues to use the Account to send and receive emails that will be relevant to whether
he is maintaining a consulting business, what type of consulting work he is doing, and whether he
is receiving money for that consulting work.
28. In addition to the foregoing, based on my review of the Pen Register Date, see supra 11
9, it appears that since the date of the last search warrant on the Cohen Account (is, November
l3, 2017), Cohen has continued to use the Cohen Account to communicate with the -
_Account, the-Account, and other email accounts that appear likely to be relevant
to the commission of the Subject Offenses described above. For example, the Pen Register Data
has revealed the following:
a. Emails sent by the Cohen Account to the-Recount on or about December 18,
2017 at 8:26 December 21, 2017 at 9:35 December 22, 2017 at 4:32 p.rn., January 3,
2018 at 8:01am, January 3, 2018 at 2:56 and January 4, 2018 at 3:31 p.111.

b. An email sent by the Cohen Account to the _Account on or about

January 25, 2018 at 8:55 13.11].

36

CELEB EM 8

Case Document 43-4 Filed 03/19/19 Page 72 of 105

c. Emails from the Cohen Account to the email account on or

about December 1, 201? at 2:14 December 29, 2017 at 10:20 January 2, 2018 at 3:52
January 2, 2018 at 5:44 and January 8, 2018 at 6:38 pm. Based upon my review of
emails contained in the Cohen Account, I have learned that the_ email account
belongs to_ Cohen?s accountant, through whom Cohen made misrepresentations to
?nancial institutions, as discussed above.

(1. Emails from the Cohen Account to email accounts belonging to Sterling employees,
including Sterling Employee-1, on or about January 25, 2018 at 10:23 p.1n., January 26, 2018 at
12:55 am, January 29,2018 at 5:30 January 29, 2018 at 8:29 January 30, 2018 at 6:44
part.

c. An email sent from the Cohen Account to the email account
on or about January 25, 2018 at 5:29 pm. As stated above,
First Republic is the bank at which the Essential Consultants Account is held.

f. Numerous emails sent from the Cohen Account to the email account

including emails on or about December 4, 2017 at 2: 1 7 pm. and January 29,
2018 at 5 :43 pm. Based upon the email address and domain name, as Well as my review of reports

of interviews and documents re?ecting that Cohen?s taxi medallions were leased and operated by

I believe that the email address belongs to

29. Based on my review of records maintained by Sterling, I know that Cohen used the
Cohen Account to send and receive documents related to the 
Based on my training and experience, I know that Google allows users of e-mail accounts to easily

save documents to file sharing and retention platforms such as Google Docs and Google Drive. I


02.28.20] 3

Case Document 43-4 Filed 03/19/19 Page 73 of 105

also lmow, from my training and experience, that users of e-mail accounts often use instant
messaging interfaces linked to their email accounts. Further, I have learned that the Providers
maintain records of search and web histories associated with email accounts and, based on my
training and experience, users of c?mail accounts use associated web search browsers associated
with a subscriber?s account to research topics they are e?mailing about. Accordingly, there is
probable cause to believe that content information associated with the Subject Accounts will also
centain evidence related to the Subject Offenses.

30. Thus, I respectfully submit that there is probable cause to believe that emails and other
content information ?om the Subject Accounts will contain evidence of Cohen?s e??orts to sell his
taxi medallions and the associated debt, and his misrepresentations and omissions to Sterling and
Melrose in connection with these negotiations. Although Cohen appears to have communicated
with and - primarily through the Cohen Account and
. Account, lknow, based on my involvement in the investigation, that Cohen also used at
least one other email account associated with his position at the Trump Organization. Thus, I
respectfully submit that there is probable cause to believe that emails and other content information
from the Account, - Account and I-Account since on or
about October 1, Z?l??the approximate date of when Cohen?s efforts to sell his taxi medallions
and the associated debt began?will re?ect communications with the Cohen Account, 
Account, and possibly one or more additional accounts used by Cohen, and probable cause to
believe that such emails will constitute evidence of Cohen?s commission of the Subject Offenses,
including the extent to which Cohen did or did not inform other individuals involved in the conduct

described above?Such a5??of his nusstaternents and

omissions to ?nancial institutions.

'38
52.23.2013

Case Document 43-4 Filed 03/19/19 Page 74 of 105

31. Temporal Limitation This application seeks all emails and other requested content

 

infonnation speci?ed in Attachments A, B, C, and for the following periods:

a. For the Cohen Account, this application seeks all emails sent, created, or received
between November 14, 2017, and the date of the proposed warrant, inclusive. As described above,
pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAD
emails from the Cohen Account that were sent, created, or received before November 14, 2017.
This application also seeks other information speci?ed above associated with the Cohen Account
that was created between December 1, 2014 (the month when Cohen entered into the medallion
loans with Sterling), and the date of the proposed warrant, inclusive.

b. For the Account, this application seeks all emails sent, created, or received
between November 14, 2017, and the date of the proposed warrant, inclusive. As described above,
pursuant to a prior warrant, the SCO obtained and provided to the USAO emails ?rom the 
Account that were sent, created, or received before November 14, 2017.

c. For the?Account and ._Account, this application
seeks emails and all other content information speci?ed above sent, created, or received between
October 1, 2016, and the date of the proposed wan'ant, inclusive. As described above, October
2016 is the month in which Cohen began negotiating the taxi medallion sale with the?

d. For the - Account, this application seeks emails and all other content
information speci?ed above sent, created, or received bemoan December 1, 2016, and the date of
the proposed warrant, inclusive. As described above, December 2016 is the month in which-
began representing the-n relation to the taxi medallion transaction.

E. Evidence, Fruits and Instrumentalitics
32. Based upon the foregoing, I submit there is probable cause to believe that
information stored on Google?s servers associated with the Cohen Account will contain evidence,

39
02.28.2013

Case Document 43-4 Filed 03/19/19 Page 75 of 105

?nite, and instrul'nentalities of violations of the Subject Offenses, as more fully described in
Section II of Attachment A to the proposed warrant for the Cohen Account and Account,
including the following:

a. Communications, records, documents, and other ?les necessary to establish the
identity of the person(s) who created or used the Cohen Account or Account.

I b. Communications, records, docurrients, and other ?les involving Sterling, Melrose,
and/or taxi medallions;

c. Communications, records, documents, and other ?les involving aplan, proposal, or
agreement for Cohen andi?or entities associated with him to transfer any interest in taxi medallions,
and any associated debts or liabilities, to others, including to_andfor entities
associated with him;

Communications, records, documents, and other ?les involving Essential
Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature
and purpose of payments made to or from Essential Consultants or Michael D. Cohen 3L
Associates;

e. Communications, records, documents, and other ?les necessary to establish the
identity of any person(s) including records that reveal the whereabouts of the person(s) - who
communicated with the Cohen Account andfor Account about any matters relating to
Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen andfor entities
associated with him to transfer any interest in taxi medallions, and any associated debts or

liabilities, to others, including to_andi'or entities associated with him;

f; Communications between the Cohen Account andfor Account and-

 

-?elating to Cohen?s bank accounts, taxes, debts, and/or ?nances;

40
(12.23.2013

Case Document 43-4 Filed 03/19/19 Page 76 of 105

g. Communications, records, documents, and other ?les re?ecting false
representations to a ?nancial institution with relation to the intended purpose of an account or loan
at that ?nancial institution; the nature of any business or entity associated with an account at a
?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any
?nancial transactions involving that ?nancial institution;

h. Evidence indicating how and when the Cohen Account and Account was
necessed or used, to determine the geographic and chronological context of account access, use,
and events relating to the crimes under investigation and to the account owner; and

i. Evidence indicating the Cohen Account and Account owner?s intent as it
relates to the Subject Offenses under investigation.

33. Based upon the foregoing, I further submit there is probable cause to believe that
information stored on Google?s servers associated with the?Account antl-
-chount will contain evidence, fruits, and instrumentalities of violations of the Subject
Offenses, including the following:

a Communications, records, documents, and other files necessary to establish the
identity of the _person(s) who created or used tht_. Account and 
Account;

b. Commtniications, records, documents, and other files involving a plan or proposal
or agreement for Cohen and/or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to _andi'or entities associated
with him;

c. Communications, records, documents, and other ?les necessary to establish the

identity of any person(s} including records that reveal the whereabouts of the person(s) who

4 
02.28-2018

Case Document 43-4 Filed 03/19/19 Page 77 of 105

commtmicated with the _Account ant?Account about any

matters relating to any plan or proposal or agreement for Cohen andfor entities associated with him

to transfer any interest in taxi medallions, and any associated debts or liabilities, to -

-1t1dfor entities associated with him;

Account and others, including employees or representatives of Sterling, Melrose, or other ?nancial
institution(s), regarding Cohen?s ?nances;

e. Communications, records, documents, and other ?les re?ecting false
representations to a ?nancial institution with relation to the intended purpose of an account or loan
at that ?nancial institution; the nature of any business or entity associated with an aceouut at a
?nancial institution; the source of funds flowing into an account; or the purpose or nature of any
?nancial transactions involving that ?nancial institution;

f. Evidence indicating how and when the Account and -
-1 Account were accessed or used, to determine the geographic and chronological content
of account access, use, and events relating to the crimes under investigation and to the account
owner; 

g. Etddenee indicating the?Account and_ Account
owners? intent as it relates to the Subject Offenses under investigation.

34. Based upon the foregoing, I further submit there is probable cause to believe that
information stored on Oath?s servers associated with the-account will contain evidence.
?nite, and of violations of the Subject Offenses, including the following:

a. Communications, records, documents, and other ?les necessary to establish the

identity of the pcrson(s) who created or used the-Account:

42
[12232013

Case Document 43-4 Filed 03/19/19 Page 78 of 105

1). Communications, records, documents, and other ?les involving a plan or proposal
or agreement for Cohen andfor entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to -and!or entities associated
with him;

0. Communications, records, documents, and other ?les necessary to establish. the
identity of any person(s) including records that. reveal the whereabouts of the person(s) who
communicated with the -'tccount about any matters relating to any plan or proposal or
agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions,
and any associated debts or liabilities, to -and/or entities associated with him;

d. Communications between the r-tocount and others, including employees or
representatives of Sterling, Melrose, or other ?nancial histitution(s), regarding Cohen?s ?nances;
and

e. Communications, records, documents, and other ?les reflecting false representations
to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial
institution; the nature of any business or entity associated with an account at a ?nancial institution;
the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions
involving that ?nancial institution.

111. Review of the Information Obtained Pursuant to the Warrant

35. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not
required for service of a search warrant issued under 2.703, or for the collection or production of
reaponsive records. Accordingly, the warrant requested herein will be transmitted to the Providers,
which shall he directed to produce a digital copy of an},r responsive records to law enforcement
personnel within 30 days from the date of service. Law enforcement personnel (including, in
addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the

43
02232013

Case Document 43-4 Filed 03/19/19 Page 79 of 105

status of the investigation and related proceedings, attorneys for the government, attorney support
staff, agency personnel assisting the government in this investigation, and outside technical experts
under government control) will retain the records and review them for evidence, fruits, and
instrumentalities of the Subject Offenses as specified in Section 111 of Attachments A, and to
the proposed warrant.

36.1n conducting this review, law enforcement personnel may use various methods to
locate evidence, fruits, and instrumentalities of the Subject Offenses, including but not limited to
undertaking a cursory inspection of all emails within the Subject Account. This method is
analogous to cursorily inspecting all the ?les in a ?le cabinet in an of?ce to determine which paper
evidence is subject to seizure. Althoagh law enforcement personnel may use other methods as
well, particularly including keyword searches, iknow that keyword searches and similar methods
are typically inadequate to detect all information subject to seizure. As an initial matter, keyword
searches work only for text data, yet many types of ?les commonly associated with emails,
including attachments such as scanned documents, pictures, and videos, do not store data as
searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture
all relevant communications in an account, as it is impossible to know in advance all of the unique
Words or phrases that investigative subjects will use in their communications, and consequently
there are often many communications in an account that are reIBVant to an investigation but that
do not contain any keywords that an agent is likely to search to r.

37. Because Cohen and attorneys, the review of the content within the Subject.
Accounts will be conducted pursuant to established screening procedures to ensure that the law
enforcement personnel involved in the investigation, including attorneys for the Government,

collect evidence in a manner reasonably designed to protect any attorney-client or other applicable

44
02.23.2013

Case Document 43-4 Filed 03/19/19 Page 80 of 105

privilege. When appropriate, the procedures will include use of a designated ?filter team,? separate
and apart from the investigative team, in order to review potentially privileged communications
and determine which communications to release to the investigation and prosecution team.

IV. Request for Non-Disclosure and Sealing Order

33. The existence and scope of this ongoing criminal investigation are not publicly known.
As a result, premature public disclosure of this af?davit or the requested warrants could alert
Cohen that he is under investigation, causing him to destroy evidence, ?ee from prosecution, or
otherwise seriously jeopardize the investigation. I In particular, based on my experience
investigating white collar cases, including cases featuring documents such as agreements, drafts
of agreements, notes of conversations, and other documentary evidence, premature disclosure of
an investigation may cause the target of the investigation to attempt to destroy or conceal such
evidence. In addition, as also set forth above, Cohen uses computers and electronic
conununications in furtherance of his activity and thus could easily delete, or otherwise
conceal such digital evidence from law enforcement were he to learn of the Govermnent?s
investigation. Sea 18 U.S.C. 2705(b)(3). Cohen also appears to have the financial means that
would facilitate his ?ight from prosecution. Sea 13 U.S.C. (5).

39. Accordingly, there is reason to believe that, were the Providers to notify the subscriber
or others of the existence of the warrant, the investigation would be seriously jeopardized.
Pursuant to 18 U.S.C. 27050:), ltherefcre request that the Court direct the Providers
not to notify any person of the existence of the warrant for a period of 180 days from issuance,
subject to extension. upon application to the Court, if necessary.

40. For similar reasons, I reSpectfully request that this af?davit and all papers submitted
herewith be maintained under seal until the Court orders otherwise, except that the Government
be permitted without further order of this Com-t to provide copies of the wanant and af?davit as

45
cars .2013

Case Document 43-4 Filed 03/19/19 Page 81 of 105

need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose
those materials as necessary to comply with discovery and disclosure obligations in any
prosecutions related to this matter.

V. Conclusion

41. Based on the foregoing, I respectfully request that the Court issue the warrants sought

herein pursuant to the applicable provisions of the Stored Communications Act, 13 U.S.C.

 



relevant provisions of Federal Rule of Criminal Procedure 41.

 

Special Agent Mason Posiikin
United States Attorney?s Of? ce
Southern District of New York

Sworn to before me this
28th day of February, 2018

 

HONORABLE GABRIEL W. GORENSTEW
Chief United States Magistrate Judge
Southern District of New York

46
0223.2on

Case Document 43-4 Filed 03/19/19 Page 82 of 105

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK

 

In the Matter of a Warrant for All
Content and Other Information
Associated with the Email Accounts
?@gmail.com,
_@gmail.eom, and
Maintained at
Premises Controlled by Goegle, Inc,
USAO Reference No. 201 SRODIZT

 

 

 

 

SEARCH WARRANT AND NON- ISCLOSURE ORDER
TO: Google, Inc. (?Provider?)

United States Attorney?s Of?ce for the Southern District of New York and the Federal
- Bureau of Investigation (collectively, the ?Investigative Agencies?)

1. Warrant. Upon an af?davit of Special Agent?of the United States
Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the
Stored Communications Act, 13 U.S.C. ?2703(b)(1)(A) and and the relevant

provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable

cause to believe the email accounts -@grnail.com, and
maintained at premises controlled by Googlc, Inc., contain evidence,

fruits, and mstrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly,
the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date
of service of this'Warrant and Order, the records speci?ed in Section II of Attachments A and 
hereto, for subsequent review by law enforcement personnel as authorized in Sections and IV

of Attachments A and B. The Government is required to serve a copy of this Warrant and Order

on the Provider within ?7 days of the date of issuance. The Warrant and Order may be served via 

Case Document 43-4 Filed 03/19/19 Page 83 of 105

electronic transmission or any other means through which the Provider is capable of accepting
service.

2. Non?Disclosure Order. Pursuant to 18 U.S.C. 2705 the Court ?nds that there is
reason to believe that noti?cation of the existence of this warrant will result in destruction of or
tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the


180 days from the date of this Order, subject to extension upon application to the Court if
necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider
for the purpose of receiving legal advice.

3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which
it was issued, be ?led under seal, except that the Government may without further order of this
Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and
Order as need be to personnel assisting the Government in the investigation and prosecution of
this matter; and disclose these materials as necessary to comply with discovery and disclosure
obligations in any prosecutions related to this matter.

Dated: New York, New York

 

 

Date Issued Time Issued

 

HONORABLE GABRIEL W. GORENSTEIN
Chief United States Magistrate Judge
Southern District of New York

02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 84 of 105

Email Search Attachment A
1. Subject Account and Execution of Warrant

This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other
information within the Provider?s possession, custody, or control associated with the email account

_@gmail.com (the ?Subject Account?) for the time period referenced below.

..

 

appropriate manner to the Provider. The Provider is directed to produce to the law enforcement
of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the
production, law enforcement personnel will review the information for items falling within the
categories speci?ed in Section below.

II. Information to be Produced by the Provider

To the extent within the Provider?s possession, custody, or control, the Provider is directed
to produce the following information associated with the Subject Account:

21. Email content. All emails sent to or from, stored in draft form in, or otherwise
associated with the Subject Account, including all message content, attachments, and header
information (speci?cally including the source and destination addresses associated with each
email, the date and time at which each email was sent, and the size and length of each email)
limited to items sent, received, or created between November 14, 2017 and the date of this warrant,
inclusive.

b. Address book information. All address book, contact list, or similar information
associated with the Subject Account.

0. Subscriber and payment information. All subscriber and payment information

regarding the Subject Account, including but not limited to name, username, address, telephone

 

Case Document 43-4 Filed 03/19/19 Page 85 of 105

number, alternate email addresses, registration IP address, account creation date, account status,
length of service, types of services utilized, means and source of payment, and payment history.

d. Transactional records. All transactional records associated with the Subject Account,
including any 1P logs or other records of session times and durations, limited to items sent,
received, or created between December 1, 2014 and the date of this warrant, inclusive.

e. Customer correspondence. All correspondence with the subscriber or others associated

ect?Accountyinel-uding. comp laints; inquiries; 
and records of actions taken, limited to items sent, received, or created between December 1, 2014
and the date of this warrant, inclusive.

f. Search History. All search history and/or web history associated with the Subject
Account, limited to items sent, received, or created between December 1, 2014 and the date of this
warrant, inclusive.

g. Associated content. All Google Docs, files maintained on Google Drive, and instant
messages or Gchats associated with the Subject Account, limited to items sent, received, or created
between December 1, 2014 and the date of this warrant, inclusive.

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing
categories of records, whether created in response to a preservation request issued pursuant to 18
U.S.C. 2703(f) or otherwise.

Review of Information by the Government

Law enforcement personnel (who may include, in addition to law enforcement officers and
agents, attorneys for the government, attorney support staff, agency personnel assisting the
government in this investigation, and outside technical experts under government control) are
authorized to review the records produced by the Provider in order to locate any evidence, fruits,
and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud

2
02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 86 of 105

the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343
(wire fraud), and 1344 (bank fraud), including the following:

a. Communications, records, documents, and other ?les necessary to establish the identity
of the person(s) who created or used the Subject Account;

b. Communications, records, documents, and other ?les involving Sterling National

Bank, Melrose Credit Union, and/or taxi medallions;

 

- - 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to others, including to -and/or
entities associated with him;

d. Communications, records, documents, and other ?les involving Essential Consultants,
LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of
payments made to or from Essential Consultants or Michael D. Cohen Associates;

e. Communications, records, documents, and other ?les necessary to establish the identity
of any person(s) including records that reveal the whereabouts of the person(s) who
communicated with the Subject Account about any matters relating to Essential Consultants, LL C,
or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with

him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others,

including to or entities associated with him;
f. Communications between the Subject Account and-relating to Michael

D. Cohen?s bank accounts, taxes, debts, and/or ?nances;
g. Communications, records, documents, and other ?les re?ecting false representations

to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial

02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 87 of 105

institution; the nature of any business or entity associated with an account at a ?nancial institution;
the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions
involving that ?nancial institution;

h. Evidence indicating how and when the Subject Account was accessed or used, to
determine the geographic and chronological context of account access, use, and events relating to

the crimes under investigation and to the account owner; and

 

. irr?videncezind-icatin to_the:- 

Offenses under investigation.

IV. Review Protocols

Review of the items described in this Attachment shall be conducted pursuant to
established procedures designed to collect evidence in a manner reasonably designed to protect
any attorney-client or other applicable privilege. When appropriate, the procedures shall include
use of a designated ??lter teal-n,? separate and apart from the investigative team, in order to address

potential privileges.



Case Document 43-4 Filed 03/19/19 Page 88 of 105

Email Search Attachment 
I. Subject Account and Execution of Warrant

This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other
information within the Provider?s possession, custody, or control associated with the email

accounts -@gmail.com and? (the ?Subject Accounts?) for the time

12?; Tf?' 

A law enforcement of?cer will serve this warrant by transmitting it via email or another
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement
officer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the
production, law enforcement personnel will review the information for items falling within the
categories specified in Section Ill below.

11. Information to be Producedhy the Provider

To the extent within the Provider?s possession, custody, or control, the Provider is directed
to produce the following information associated with the Subject Accounts:

a. ErrataT content. All emails sent to or from, stored in draft form in, or otherwise
associated with the Subject Accounts, including all message content, attachments, and header
information (speci?cally including the source and destination addresses associated with each

I email, the date and time at which each email was sent, and the size and length of each email).

b. Address book information. All address book, contact list, or similar information
associated with the Subject Accounts.

c. Subscriber and payment information. All subscriber and payment information

regarding the Subject Accounts, including but not limited to name, usernamc, address, telephone

Case Document 43-4 Filed 03/19/19 Page 89 of 105

number, alternate email addresses, registration address, account creation date, account status,
length of service, types of services utilized, means and source of payment, and payment history.
d. Transactional records. All transactional records associated with the Subject Accounts,
including any logs or other records of session times and durations.
e. Customer correspondence. All correspondence with the subscriber or others associated

with the Subject Accounts, including complaints, inquiries, or other contacts with support services

 

W..- .. a W.

f. Search History. All search history and/or web history associated with the Subject
Accounts.

g. Associated content. All Google Docs, ?les maintained on Google Drive, and instant
messages or Gchats associated with the Subject Accounts.

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing
categories of records, whether created in response to a preservation request issued pursuant to 18
U.S.C. 2703(f) or otherwise.

Review of Information by the Government

Law enforcement personnel (who may include, in addition to law enforcement officers? and
agents, attorneys for the government, attorney support staff, agency personnel assisting the
government in this investigation, and outside technical experts under government control) are
authorized to review the records produced by the Provider in order to locate any evidence, fruits,
and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud
the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343
(wire fraud), and 1344 (bank fraud), including the following:

a. Communications, records, documents, and other filesinecessary to establish the identity
of the person(s) who created or used the Subject Accounts;

2
02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 90 of 105

b. Communications, records, documents, and other ?les involving a plan or proposal or
agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to-and/or entities associated
with him;

c. Communications, records, documents, and other ?les necessary to establish the identity
of any person(s) including records that reveal the whereabouts of the person(s) who


agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, tc_and/or entities associated
with him; i

d. Communications between the Subject Accounts and others, including employees or
representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s),
regarding Michael D. Cohen?s ?nances;

e. Communications, records, documents, and other ?les re?ecting false representations
to a ?nancial institution with relation to the intended purpoSe of an account or loan at that ?nancial
institution; the nature of any business or entity associated with an account at a ?nancial institution;
the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions
involving that ?nancial institution;

f. Evidence indicating how and when the Subject Accounts was accessed or used, to
determine the geographic and chronological context of account access, use, and events relating to
the crimes under investigation and to the account owner;

g. Evidence indicating the Subject Accounts oWners? intent as it relates to the Subject

Offenses under investigation.

02.2 8.2018

 

Case Document 43-4 Filed 03/19/19 Page 91 of 105

IV. Review Protocols

Review of the items described in this Attachment shall be conducted pursuant to
established procedures designed to collect evidence in a manner reasonably designed to protect
any attorney-client or other applicable privilege. When appropriate, the procedures shall include
use of a designated ??lter team,? separate and apart from the investigative team, in order to address

potential privileges.

 

02.23.2U13



Case Document 43-4 Filed 03/19/19 Page 92 of 105

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK

 

In the Matter of a Warrant for All
Content and Other Information
Associated with the Email Account
-@aol.cotn, Maintained at
Premises Controlled by Oath, Inc.,
USAO Reference No. 20 BROOI 27

 

 

SEARCH WARRANT AND ORDER

 

TU: Oath, Inc (?Provider?)

United States Attomey?s Of?ce for the Southern District of New York and the Federal
Bureau of hivcstigation (collectively, the ?Investigative Agencies?) .

1. Warrant. Upon an af?davit of Special Agent -of the United States
Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the
Stored Communications Act, 13 U.S.C. and and the relevant
provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable
cause to believe the email account maintained at premises controlled by Oath,
Inc., contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment 
hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies,
within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II
of Attachment hereto, for subsequent review by law enforcement personnel as authorized in
Sections HI anle of Attachment C, The Government is required to serve a copy of this Warrant
and Order on the Provider within 14 days of the date of issuance. The Warrant and Order may be
served via electronic transmission or any other means through which the Provider is capable of

accepting service.

 

Case Document 43-4 Filed 03/19/19 Page 93 of 105

2. NemDisclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is
reason to believe that notification of the existence of this warrant will result in destruction of or
tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the
existence of this Warrant and Order to the listed subscriber or to any other person for a period of

130 days from the date of this Order, subject to extension upon application to the Court if

 



for the purpose of receiving legal advice.

3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which
it was issued, be filed under seal, except that the Government may without further order of this
Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and
Order as need be to personnel assisting the Government in the investigation and prosecution of
this matter; and disclose these materials as necessary to comply with discovery and disclosure
obligations in any prosecutions related to this matter.

Dated: New York, New York

 

 

Date Issued Time Issued

 

HONORABLE GABRIEL w. (ifiitsusratu
Chief United States Magistrate Judge
Southern District of New York

02.23.2013

Case Document 43-4 Filed 03/19/19 Page 94 of 105

Email Search Attachment 
1. Subject Account and Execution of Warrant

This warrant is directed to Oath, Inc. (the ?Provider?), headquartered at 22000 AOL Way,
Dulles, Virginia 20166, and applies to all content and other information within the Provider?s
possession, custody, or control associated with the email account -@aol.com (the ?Subject

Account?) for the time period between December 1, 2016 and the date of this warrant, inclusive.

 

appropriate manner to the Provider. The Provider is directed to produce to the law enforcement
of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the
production, law enforcement personnel will review the information for items falling within the
categories speci?ed in Section below.

11. Information to be Produced by the Provider

To the extent within the Provider?s possession, custody, or control, the Provider is directed
to produce the following information associated with the Subject Account:

a. Email content. All emails sent to or from, stored in draft form in, or otherwise
associated with the Subject Account, including all message content, attachments, and header
information (speci?cally including the source and destination addresses associated with each
email, the date and time at which each email was sent, and the size and length of each email).

b. Address book information. All address book, contact list, or similar information
associated with the Subject Account.

c. Subscriber and payment information. All subscriber and payment information
regarding the Subject Account, including but not limited to name, username, address, telephone
number, alternate email addresses, registration IP address, account creation date, account status,

length of service, types of services utilized, means and source of payment, and payment history.

anothermzm

 

Case Document 43-4 Filed 03/19/19 Page 95 of 105

d. Transactional records. All transactional records associated with the Subject Account,
including any logs or other records of session times and durations.

e. Customer correspondence. All correspondence with the subscriber or others associated
with the Subject Account, including complaints, inquiries, or other contacts with support services
and records of actions taken.

f. Search Hismry. All search history and/or web history.

 



categories of records, whether created in response to a preservation request issued pursuant to 18
U.S.C. 2703(f) or otherwise.

Review of Information by the Government

Law enforcement personnel (who may include, in addition to law enforcement officers and.
agents, attorneys for the government, attorney support staff, agency personnel assisting the
govemment in this investigation, and outside technical experts under government control) are
authorized to review the records produced by the Provider in order to locate any evidence, fruits,
and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343
(wire fraud), and 1344 (bank fraud), including the following:

a. Communications, records, documents, and other ?les neceSsary to establish the identity
of the person(s) who created or used the Subject Account;

b. Communications, records, documents, and other files involving a plan or proposal or
agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi

medallions, and any associated debts or liabilities, to_ and/or entities associated

with him;

02.28.2018

 

 Document 43-4 Filed 03/19/19 Page 96 of 105

c. Communications, records, documents, and other ?les necessary to establish the identity
of any person(s) including records that reveal the whereabouts of the person(s) who
communicated with the Subject Account about any matters relating to any plan or proposal or
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to_and/or entities associated
with him;

- an. W- 

 

representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s),
regarding Michael D. Cohen?s ?nances; and

e. Communications, records, documents, and other ?les re?ecting false representations
to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial
institution; the nature of any business or entity associated with an account at a ?nancial institution;
the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions
involving that ?nancial institution.

IV. Review Protocols

Review of the items described in this Attachment shall be conducted pursuant to
established procedures designed to collect evidence in a manner reasonably designed to protect
any attorney?client or other applicable privilege. When appropriate, the procedures shall include
use of a designated ??lter team,? separate and apart from the investigative team, in order to address

potential privileges.

02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 97 of 105

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK

 

In the Matter of a Warrant for All
Content and Other Information
Associated with the Email Account
maintained at
Premises Controlled by 1 Internet, 
Inc., USAO Reference No.
201 8R00127

 

 

 

 

-

TO: 1 1 Internet, IHC- (?Provider?)

United States Attorney?s Of?ce for the Southern District of New York and the Federal
Bureau of Investigation (collectively, the ?Investigative Agencies?)

1. Warrant. Upon an af?davit of Special Agent?of the United States
Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the
Stored Communications Act, 18 U.S.C. 2703(b)(l)(A) and 2703(c)(l)(A), and the relevant
provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable
cause to believe the email account maintained at premises controlled by 
1 Internet, Inc., contains evidence, fruits, and instrumentalities of crime, all as speci?ed in
Attachment hereto. Accordingly, the Provider is hereby directed to provide to the Investigative
Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in
Section II of Attachment hereto, for subsequent review by law enforcement personnel as
authorized in Sections and IV of Attachment D. The Government is required to serve a copy
of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant
and Order may be served via electronic transmission or any other means through which the

Provider is capable of accepting service.

 

Case Document 43-4 Filed 03/19/19 Page?98 of 105

2. Non?Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is
reason to believe that noti?cation of the existence of this warrant will result in destruction of or
tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the
existence of this Warrant and Order to the listed subscriber or to any other person for a period of

180 days from the-date of this Order, subject to extension upon application to the Court if

for the purpose of receiving legal advice.

3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which
it was issued, be ?led under seal, except that the Government may without further order of this
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and
Order as need be to personnel assisting the Government in the investigation and prosecution of
this matter; and disclose these materials as necessary to comply with discovery and disclosure
obligations in any prosecutions related to this matter.

Dated: New York, New York

 

 

Date Issued Time Issued

 

HONORABLE GABRIEL W. GORENSTEIN
Chief United States Magistrate Judge
Southern District of New York

02.28.2018

7:22:22? :trnecessaryyexc ept:that:P:r meyefereProvgiderre ..

 

 

Case Document 43-4 Filed 03/19/19 Page 99 of 105

Email Search Attachment 
I. Subject Account and Execution of Warrant

This warrant is directed to 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee
Road, Suite 300, Chesterbrook, 19087, and applies to all content and other

information within the Provider? possession, custody, or control associated with the email account

(the ?Subject Account?) for the time period between November 14, 2017

 

A law enforcement of?cer will serve this warrant by transmitting it via email or another
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement
officer an electronic copy of the information speci?ed in Section II below. Upon receipt of the
production, law enforcement personnel will review the information for items falling within the
categories specified in Section below.

11. Information to be Produced by the Provider

To the extent within the Provider?s possession, custody, or control, the Provider is directed
to produce the following information associated with the Subject Account:

a. Email content. All emails sent to or from, stored in draft form in, or otherwise
associated with the Subject Account, including all message content, attachments, and header
information (specifically including the source and destination addresses associated with each
email, the date and time at which each email was sent, and the size and length of each email).

b. Address book information. All address book, contact list, or similar information
associated with the Subject Account.

o. Subscriber and payment information. All subscriber and payment information

regarding the Subject Account, including but not limited to name, usemame, address, telephone

 

Case Docu?ment 43-4 Filed 03/19/19 Page 100 of 105

number, alternate email addresses, registration IP address, account creation date, account status,
length of service, types of services utilized, means and source of payment, and payment history.
d. Transactional records. All transactional records associated with the Subject Account,
including any IP logs or other records of session times and durations.
e. Customer correspondence. All correspondence with the subscriber or others associated

with the Subject Account, including complaints, inquiries, or other contacts with support services

 

WV 

f. Preserved or backup records. Any preserved or backup copies of any of the foregoing
categories of records, whether created in response to a preservation request issued pursuant to 18
U.S.C. 2703(f) or otherwise.

Review of Information by the Government

Law enforcement personnel (who may include, in addition to law enforcement of?cers and

agents, attorneys for the government, attorney support staff, agency personnel assisting the
government in this investigation, and outside technical experts under government control) are
authorized to review the records produced by the Provider in order to locate any evidence, fruits,
and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud
the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343
(wire fraud), and 1344 (bank fraud), including the following:

a. Communications, records, documents, and other files necessary to establish the identity
of the person(s) who created or used the Subject Account;

b. Communications, records, documents, and other ?les involving Sterling National
Bank, Melrose Credit Union, and/or taxi medallions;

0. Communications, records, documents, and other ?les involving a plan, proposal, or
agreement for Michael D. Cohen and] or entities associated with him to transfer any interest in taxi

2
02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 101 of 105

medallions, and any associated debts ?or liabilities, to others, including to -and/or

entities associated With him;

d. Communications, records, documents, and other ?les involving Essential Consultants,
LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of
payments made to or from Essential Consultants or Michael D. Cohen Associates;

e. The identity of any person(s) including records that reveal the whereabouts of the

 

'personfsi) WW

Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/ or entities
associated with him to transfer any interest in taxi medallions, and any associated debts or
liabilities, to others, including to_Lnd/ or entities associated with him;

f. Communications between the Subject Account and _telating to Michael
D. Cohen?s bank accounts, taxes, debts, and/or ?nances;

g. Communications, records, documents, and other ?les re?ecting false representations
to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial
institution; the nature of any business or entity associated with an account at a ?nancial institution;
the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions
involving that ?nancial institution;

h. Evidence indicating how and when the Subject Account was accessed or used, to
determine the geographic and chronological context of account access, use, and events relating to
the crimes under investigation and to the account owner; and

i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject

Offenses under investigation.

02.28.2018

 

Case Document 43-4 Filed 03/19/19 Page 102 of 105

IV. Review Protocols

Review of the items described in this Attachment shall be conducted pursuant to
established procedures designed to collect evidence in a manner reasonably designed to protect
any attorney-client or other applicable privilege. When appropriate, the procedures shall include
use of a designated ?filter team,? separate and apart from the investigative team, in order to address

potential privileges.

 

{32.23.2013

..L.. . .. . 

Case Document 43-4 Filed 03/19/19 Page 103 {sour Rev. cane} searehsind seiziurc? Wei-rant 

_1

 

 

UNITED STATES D1S'raicr COURT

for the
Southern District of New York

In the Matter of the Search of

(Brie?y describe the property to be searched
or identity the person by name and address)

A Device Containing the Results of Three Email Search
Warrants. See Attachment A

 

SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement of?cer

An application by a federal law enforcement of?cer or an attorney for the government requests the search
of the following person or property located in the Southam District of New York

(remap the person or describe the prepare; to be searched and give its focaricn):
A Device Containing the Results of Three Email Search Warrants, See Attachment A

 

The person or property to be searched, described above, is believed to conceal (tearing; the person or describe the
property to be seized):

See Attachment A

I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or

property.
YOU ARE COMMANDED to execute this warrant on or before i til?f 
(not to exceed 1'4 days)
CI in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been

established.

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the
place where the property was taken Ki - -

The of?cer executing this warrant or an of?cer present during the execution of the warrant, must prepare an
inventory as required by law and return this warrant 1and inventory to the Clerk of the Court.

 

 

1" ~11:ch

El 1 ?nd that immediate noti?cation may have an adverse result listed in 18 Use ?1 ?3 2705- {excelnt for delay-
of trial}, and authorize the of?cer executing this warrant to delay notice to the person who, or whose pi operty, is ill be
searched or seized (check the appropriate em) ?for 30 dayS (not re exceed 30) . - 

Eluntil, the fa ustifying, the late speei date of

I
Date and time issued: 
(U Jim /Jdge ?5 Signature

Cit}! and State?- New York. NY Hon. Gabriel W. Gorenstein. U5. Maoistrate Judoe

Primed name and title

 

 

 

 

 

 

Case Document 43-4 Filed 03/19/19 Page 104 of 105

Attachment A
I. Device to be Searched

The device to be searched (the ?Subject Device?) is described as a black and red USB drive
with a white label that says ?Tracking 180208140208?, which contains emails and other content
information obtained pursuant to the three search warrants, numbered 17?mj?00503, l7-mj-0085 5
and 17?mj -00854, obtained by the Special Counsel?s Of?ce less the emails that were
screened and removed by the privilege team.

II. Review of ESI on the Subject Devices

Law enforcement personnel (including, in addition to law enforcement of?cers and agents,
and depending on the nature of the ESI and the status of the investigation and related proceedings,
attorneys for the government, attorney support staff, agency personnel assisting the government in
this investigation, interpreters, and outside vendors or technical experts under government control)
are authorized to review the ESI contained on the Subject Device for evidence, fruits, and
instrumentalities of one or more violations of 18 U.S.C. 371 (conSpiracy to defraud the United
States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (Wire
fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?), as listed below:

a. Communications, records, documents, and other ?les involving Sterling National
Bank, Melrose Credit Union, and/or taxi medallions;

b. Communications, records, documents, and other ?les involving a plan, proposal, or
agreement for Michael D. Cohen and] or entities associated with him to transfer any interest in taxi
medallions, and any associated debts or liabilities, to others, including to_and/ or
entities associated with him; i

c. The identity of any person(s) including records that reveal the whereabouts of the
person(s) who communicated with -@gmail.com and/or - (the
?Subject Accounts?) about any plan or proposal or agreement for Michael D. Cohen and/ or entities
associated with him to transfer any interest in taxi medallions, and any associated debts or
liabilities, to others, including to _and/or entities associated with him;

d. Communications between the Subject Accounts and _telating to

Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances;

 

Case Document 43-4 Filed 03/19/19 Page 105 of 105

e. Evidence indicating the ewner ef the Subject intent as it relates to the

Subject Offenses under investigation.