Case Document 43-6 Filed 03/19/19 Page 1 of 80 . AU 93 (SDNY Rev. Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York 18MAG 2958 Case No. - In the Matter of the Search of (Brie?y describe the property to be searched or idenrr?i the person by name and address) 1; i Three Electronic Devices, See Attachment A SEARCH AND SEIZURE WARRANT *hr?r?lio. -. An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identify the parser: or describe the proper? to be searched ond?gr've its location): Three Electronic Devices, See Attachment A The person or property to be searched, described above, is believed to conceal (identi?) the person er describe the property to be seized): See Attachment A I 11d that the or any recorded testimony, establish probable cause to Se??iih' and seize the person or property . . YOU ARE COMMANDED to execute this warrant on or before a "(not to exceed 1'4 days) CI in the daytime 6:any time in the day or night as I find reasonable cause has been established I- . . - Unless delayed notice is authorized below, you must give a copy of the warrant and the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the mark of the Court Upon its return, this warrant and inventory should be led under seal by the Cleric of the Court Igp?j IUSMJInirr'cts if I ?nd that irnmediate noti?cation may have an adverse result listed in 13 C. 21'05 (except for delay of trial) and authorize the of?cer executing this warrant to delay notice to the person who, or Iwhosc property, will be searched or seized (checirth'e appropriate box) ?lter 30 days (net to exceed - Elunti], the facts justifying, the later Speci?c date of Printed more and title . F?l 5 Date and time issued: II I?i/ Leg were wer- i Judge a stgadmee' r" City and state: New York. uv Hon. Henrv a. Pitman. us. Maoistrate Judoe .Case Document 43-6 Filed 03/19/19 Page 2 of 80 A0 93 (Rev. Search and Seizure Warrant (Page 2) Return Case No; Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: 'moprvm wax-were" Certification to the Court. Date: I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant - Exeeurmg o?icar ?s signomre Printed Home and title Case Document 43-6 Filed 03/19/19 Page 3 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. SubjectDevice-J A black and red USB drive with a white label that says ?Tracking ii: 180208140203.? b. Subject DeviceHZ: A silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device?3: A white labelled ?2-28?18 Cohen SW Returns Google and . II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the govemment, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to 1evicw the E81 contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 S. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below. -. - 1 Case Document 43-6 Filed 03/19/19 Page 4 of 80 'J?tlinm: Case Document 43-6 Filed 03/19/19 . Page 5 of 80 A0 106 (Rev. cares} Application for a Search Warrant UNITED STATES DISTRICT COURT 2958 Southern District of Case No. In the Matter of the Search of (Brie?y describe the property to be searched or frien?? the person by Home ondndo?ress) Three Electronic Devices. See AttachmentA APPLICATION FOR A SEARCH WARRANT I a federal law enforcement of?cer or an attorney for the government request a search warrant and state under penalty oIf perjury that 1 have reason to believe that on the following person or property (identity? raepereen or describe the ?8ee- Attachment?A TkeztI Ei?c leer?i?i- located in the Southern District of New York there is now concealed (ident?jz the person or describe the property to be seized}: IDIcutI?trg - PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. The basis for the search under Fed. Crim. P. 4102'.) is {check one or more): lievidence of a crime; contraband, fruits of crime, or other items illegally possessed; El propertyr designed for use; intended for use, or used in committing a crime; a person to be arrested or a person who is milawfully restrained. The search is related to a Violation of: Code Section ij?ense Description 52 USC 30109 Illegal campaign conlribu?cns (can MATH) The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. ET Continued on the attached sheet. Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 13 U.S.C. 3103a, the basis of which is set forth on the attached sheet. - fretted hardened titre - Sworn to before me and signed in my presence. II A I, i .I Ir- Date: 51/? r?I eL?e -.. ?regimen I fr? Igua'ge ,Citj.r and state: 4/?ny {Wig/? geese.? Hon_. l-lenIrytIBr S. Magistrate Judge_ some rz?rtd ri?e I I ?In? A I: ll r: Case Document 43-6 Filed 03/19/19 Page 6 of 80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for Three Electronic Devices, USAO Reference No Agent Af?davit in Support of 20181100127 Application for a Search Warrant SOUTHERN DISTRICT OF NEW YORK) ss.: Special Agent - of the United States Attorney?s Of?ce for the Southern "District of New duly sworn, deposes and says: I. Introduction A. A?'iant 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Cn'minal Procedure for a warrant to search the electronic devices speci?ed below (the ?fSubject Devices?) for the items and information described in Attachment A. This affidavit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis Case Document 43-6 Filed 03/19/19 Page 7 of 80 electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. Prior Warrants and the Subject Devices 3. The USAO and the Federal Bureau of Investigation have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 4. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the. account-@gmailcom (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17?mj-00503, is attached as Exhibit A (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account?). This warrant, which is numbered, l7?mj-005 70, is attached as Exhibit (the ?Cohen iCloud Warrant?). Case Document 43-6 Filed 03/19/19 Page 8 of 80 c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017. This warrant, which is numbered 17?mj?00855, is attached as Exhibit (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account-_the ?Cohen Account?) sent or received between the opening of the Cohen Account1 and November 13, 2017. This warrant, which is numbered 17-mj?00854, is attached as Exhibit (the ?First Cohen Warrant?). 5. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.2 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 6. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the. date of the warrant. - 2 The SCO had previously provided a subset of this non?privileged content on or about February 2, 2018. Case Document 43-6 Filed 03/19/19 Page 9 of 80 received between November 14, 2017 and February 28, 2018. These warrants, which are both numbered 18 Mag. 1696, are attached as Exhibits (the ?Third Cohen Gmail Warrant?) and (the ?Second Cohen Warrant?), reSpectively. The content produced pursuant to these warrants is being reviewed for privilege by an SDNY ?lter team. 7. The search warrants described above are referred to collectively herein as the ?Prior Warrants.? 8. The returns of the Prior Warrants are presently contained on three electronic devices. In particular: a. Subject Device-J The non?privileged emails and content returned in response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen Warrant are contained on Subject Device?1, which is particularly described as a black and red USB drive with a white label that says ?Tracking 180208140208.? b. ?Subject Device-2: The non?privileged content returned in response to the Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device-3: The content returned in response to the Third Cohen Gmail Warrant and the Second Cohen Warrant is contained on Subject Device?3, which is particularly described as one white DVD labelled ?2-28?18 Cohen SW Returns Google and 9. The Subject Devices are presently located in the Southern District of New York. C. The Subject Offenses 10. The af?davits in support of the Prior Warrants describe evidence of several different courses of conduct by Cohen, including, among other things, false statements to financial institutions relating to the purpose of an account he opened in the name of Essential Consultants 5 Subject Offenses in Prior "titan-ant3 A First Cohen Gmail 13 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire Case Document 43-6 Filed 03/19/19 Page 10 of 80 LLC and the nature of funds ?owing into that account; false statements and fraudulent emissions by Cohen in connection with this attempt to re?nance his debts with certain ?nancial institutions; and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without having registered as a foreign agent. The Prior Warrants accordingly de?ne the evidence to be seized by reference to subject offenses and speci?c categories of information related to these courses of conduct. The subject offenses in the Prior Warrants are sunuuarized as follows: fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and USE. 611 et seq. (Foreign Agents Registration Act 13 Second Cohen Gmail 13 U.S.C. 3?21 (conspiracy to defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (PARA) Cohen Warrant 13 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (PARA) Cohen iCloud Warrant 13 U.S.C. 1014 (false statement to ?nancial instimtion), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 USC. 611 etseq. (PARA) 13 Third Cohen Email 13 U.S.C. 321 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial. institution), 1343 (wire fraud), 1344 (bank fraud) Second Cohen 13 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial institution}, 1343 (wire fraud), 1344 (bank fraud) 1 1. Based on my participation in this investigation, including my review of documents obtained pursuant to subpoena and court order, my conversations with wimesses and review of reports of conversations with witnesses, and my review of publicly available info?nnation, I have 3 On or about February 23, 2013, the USAO sought and obtained a Rule 41 warrant, authorizing it to expand its search of the email returns for the warrants attached as Exhibits A-C (the First Cohen Gmail Warrant, Second Cohen Grnail Warrant, and First Cohen Warrant) for additional offenses not authorized in the original warrants for those accounts. The below chart therefore lists both the subject offenses listed in the original warrants for these accounts and the subject offenses authorized in the February 23, 2013 warrantCase Document 43-6 Filed 03/19/19 Page 11 of 80 learned of evidence of an additional Subject Offense'committed by Cohen, described below, which was not listed in the Prior Warrants.4 12. I am therefore requesting authority to expand the search of the returns of the Prior Warrants, as contained on the Subject Devices, for evidence related to the additional Subject Offense. As set forth below, in addition to the categories of evidence already described in the Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?Subject II. Probable Cause Regarding the Subject Offense 13. As set forth above, the USAO and the FBI have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. During the course of this investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal 4 As set forth below, I base this application in part on my review of emails and text messages obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of the emails or texts returned pursuant to the applicable Prior Warrant. 5 The Prior Warrants describe categories of information that likely encompass evidence of the additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking explicit authorization to search the Subject Devices for evidence of the Subject Offense. 7 Case Document 43-6 Filed 03/19/19 Page 12 of 80 Case Document 43-6 Filed 03/19/19 Page 13 of 80 Case Document 43-6 Filed 03/19/19 Page 14 of 80 Case Document 43-6 Filed 03/19/19 Page 15 of 80 Case Document 43-6 Filed 03/19/19 Page 16 of 80 Case Document 43-6 'Filed 03/19/19 Page 17 of 80 Case Document 43-6 Filed 03/19/19 Page 18 of 80 Case Document 43-6 Filed 03/19/19 Page 19 of 80 Case DocUment 43-6 Filed 03/19/19 Page 20 of 80 ~Case Document 43-6 Filed 03/19/19 Page 21 of 80 Case Document 43-6 Filed 03/19/19 Page 22 of 80 Case Document 43-6 Filed 03/19/19 Page 23 of 80 Case Document 43-6 Filed 03/19/19 Page 24 of 80 Case Document 43-6 Filed 03/19/19 Page 25 of 80 Case Document 43-6 Filed 03/19/19 Page 26 of 80 Case Document 43-6 Filed 03/19/19 Page 27 of 80 Case Document 43-6 Filed 03/19/19 Page 28 of 80 Case Document 43-6 Filed 03/19/19 Page 29 of 80 Case Document 43-6 Filed 03/19/19 Page 30 of 80 28. Therefore, there is probable cause to believe that a search of the Subject Devices will reveal evidence, fruit and. instrumentalities efthe Subject Offenses, inciudirrg the following: Case Document 43-6 Filed 03/19/19 Page 31 of 80 Procedures for Searching ESI A. Review of E81 29. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys forthe government, attorney support staff, agencypersonnel assisting. the government in this investigation, interpreters, and outside vendors or technical experts under government control) will review the E81 contained on the Subject Devices for information responsive to the warrant. 30. In conducting this review, law enforcement personnel may use various methods to locate evidence, fruits, and instrumentalities of the Subject Offense, including but not limited to undertaking a cursory inspection of all emails, texts or ?les contained on the Subject Devices. This method is analogous to cursorily inspecting all the ?les in a ?le cabinet in an of?ce to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of ?les commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and 27 Case Document 43-6 Filed 03/19/19 Page 32 of 80 consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. IV. Conclusion and Ancillary Provisions 31. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 32.1nlight of the con?dential nature of the continuing investigation, and for the reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this affidavit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent, USAO Sworn to before me on 7th day fad-kw? saga; HON HENRY PITMAN UNIT ED: fares MAGISTRATE IUDGE 28 - . . Case Document 43-6 Filed 03/19/19 Page 33 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device-I A black and red SE drive with a white label that says ?Tracking 180208140208.? b. Subject Device-2: A silver DVD with ?a white label that reads ?Cohen 2018.03.07.? c. Subject Device-3: A white DVD labelled ?2-28-18 Cohen SW Returns Google and II. Review of on the Subject Devices Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the E31 contained on the ect Devices for evidence, fruits, and of one or more violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: ?fun-[u . .. .. Case Document 43-6 Filed 03/19/19 Page Case Document 43-6 Filed 03/19/19 Page 35 of 80 Exhibit A I --.- - 'a Case Document 43-6 Filed 03/19/19 Page 36 of 80 A0 93 (Rev. Search and Seizure Warrant . I Eur ITED STATES DISTRICT COURT JUL 31 an? stage us. District: and for the ?twp?? c?lli't? District of Columbia 111 the Matter of the Search of 0.503 - (Brie?y describe thepr'cpertjt to the searched . 0353: .ml 3W1 A or tdentr?t the person by some and address) TD . l'iEiWB . 2017 turoeuartow ASSOCIATED WITH THE EMAIL Assign.- Date - 7713? - Warrant ACCOUNT?northwest Description: Search and . SEARCH AND SEIZURE WARRANT An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Northern District of California {identg'?r the person or describe the properht to he Searched t?ts fermion): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal t?t?dentf?t the person or describe the preparer to he setzer?: See Attachment 13, YOU ARE CDMMANDED to execute this warrant on or before 1t 2017 rest to exceed t4 days) 5 in the daytime 6:09 31.11]. to l0:00 pm. l3 at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to .. Hon, Earp! A. Howell 1? United States Magistrate Judge) Cl Pursuant to 18 U.S.C. 3103a(b], i ?nd that immediate noti?cation may have an adverse result listed in IE U.S.C. 27115 (except for delay of trial], and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (sheet: the apptepstate eat-,1 CI for days {not to exceed 3t?) until, the facts justifying, the later speci?c date of Date and time issued: f3: 3g? 453/141 ?gs/?r137 Judge 's signature City and state: Washington, DC . .. .. Hon. Beryl A. Howell, Chief LLS. District Judge .. l" . 3.: .. .. - Case Document 43-6 Filed 03/19/19 Page 37 of 80 93 [Rev I 3] Scarab and Saiaura Warrant [Page 2] Return Cane Mn; Date and [in a warrant executed: Copy of warrant and left with: r?ade in tha presence of 7/1'3 ?243:? {Easy}? Gaog?? In?at?fa?arg?m?j of the property taken and' nanra of any patents) scliedf Il?0369r20l70714*) A [19% "g Hat. Uqlwar? aw nova/swim F799 FILED Jum'zmz Clark; u.s. District 5 Eankruptcy Can rtsm:l . I declare under penalty of perj ury that this Inventory ls correct and was returned along with the: original warrant to the designatedjudga. . Printed ?ame and Case Document 43-6 Filed 03/19/19 Page 38 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmail.eon1 that is stored at premises owned, maintained, controlled, or operated by Googie, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043Case Document 43-6 Filed 03/19/19 Page 39 of 80 I. ATTACHMENT Information to be disclosed by Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google {hereina?'er ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or?identi?er listed in AttachmentA: El. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, loghin IP addresses associated with session times and dates, account status, alternative e-mail addresses provided - - - .- - Case Document 43-6 Filed 03/19/19 Page 40 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; All records indicating the services available to subscribers of the accounts; All usernarnes associated with or sharing a login address or browser cookie with All cookies, including third-party cookies, associated with the user; All records that are associated with the machine cookies associated with the user, f. All search historyr or web history; g. h. the accounts; i. j. and k. II. All telephone or instrument numbers associated with the Account (including MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identifier Mobile Identi?cation Numbers Subscriber Identit}r Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identifiers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, andt'or instrumentalities of violations of 18 USE. 101.4 (false statements to a financial institution) and 18 U.S.C. 1956 (money laundering), as well as 13 U.S.C. 95] (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 61] et seq, involving Michael Dean Cohen and occurring on or alter January 1, 2016, including, for each account or identifier listed on Attachment A, information bertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other files that false representations to a financial institution with relation to intended the purpose of? an account or loan at that ?nancial institution; the nature of any business or entity associated with an um? ram: . .apnm-emw-I Case Document 43-6 Filed 03/19/19 Page 41 of 80 account a ?nancial institution; the source of funds ?owing into an account; or-the purpose or nature of any ?nancial transactions involving that ?nancial institution; Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other files that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; Evidence indicating the account oWner?s? state of mind as it relates to the crimes under investigation; The identity of the person(s} who created or used the account, including records that help reveal the whereabouts of such person(s); and The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. w. .- - 'urr'W?mm?J'IS'T" - Case Document 43-6 Filed 03/19/19 Page 42 of 80 1 Exhibit .- .: a .- .- -- . . ?mm-l .-. Case Document 43-6 Filed 03/19/19 Page 43 of 80 AD 93 [are 11:13) Search and seizure Warrant UNITED STATES DISTRICT COURT for the District of'Columbia In the Matter of the Search of (Brie?y describe the property to be searched {335$ 1 - or tdehthji the person by some ondocidrers} QHEJ Beryl A INFORMATION essoomreo WITH THE EMAIL 3 Assign Date: 11 I1 3201 7' ACCOUNT Description: Search and Seizure Warrant SEARCH AND SEIZURE WARRANT Any? authorised ?law? enforcement officer?+- An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Northern - District of California (ldenrt?a the person or describe the property to be searched and give its locatioty: See Attachment A. I find'that the af?dayi?s), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identity the person or describet?he property to be seized): See Atla chment 3. YOU ARE COMMANDED to execute this warrant on or before November EU, 2017 (not to exceed tat days) 95 in the daytime 5:00 am, to 10:60 p.111. at any time in the clay or night because good cause has been established. Unless delayed notice is authorised below, you must give a copy of the warrant and a receipt for the property taken to the person from wheat, or f1 orn whose premises, the pi operty was taken, or ieave the copy and receipt at the place where the property was taken The of?cer executing this warrant, or an of?cer present during the execution of? the warrant, tnust prepare an in?entoty as required by law and return this warrant and inventory to Hon. Beryl A. Howell Waited States Judge} El Pursuant to 13 I ?nd that immediate notification may have an adverse result listed in _13 THUS (exec-pt for delay of trial), and authorise the of?cer executing this warrant to delay notice to the person who, or. whose property, Will be searched seized (check the box} for days (not to exceedii?) Cl until, the facts justifying, the later speci?c date of Date-and tirhcis'stledt- f; ?rs-'M 1? Judge '3 signature City and state: Washington. DC Hon, Beryl A. Howell, ChieftJ?. District Jhdge Printed noise and-title - - .. .. Case Document 43-6 Filed 03/19/19 Page 44 of 80 93 (Flee. '1 Search and Seizure Warrant [Page 2) Return Case Ne: Date and time warrant executed: ten}! ef Warrant and inventory left with: I mention; made in the presence of 'Inventery ef the prep'erty taken and name ef any persenls) SeizedCer??ea?bn Date: I declare under penalty of perjuryr that this inventeijr 'le enrree-t and was retufned along with the erigina] warrant to the designated judge. a?eer ?3 ?gimme: and Erle- .. - - ..-- Case Document 43-6 Filed 03/19/19 Page 45 of 80 ?a ATTACHMENT. A This warrant applies to infonnation associated with the Google Mai] -@gmail.eom that is stored at premises owned, maintained, controlled, or operated by Google, aeompany headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 9404-3. F7 . ..-. .- -. -..- -.- . - - I an --1 Case Document 43-6 Filed 03/19/19 Page 46 of 80 II In formation to be disclosed by Gnogle To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, tiles, logs, or information that have been deleted "but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: 'The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the. account, draft entails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the sizeand length of each email; All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identi?ers, records oi? session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, amount staths, alternative email addresses provided during registration, methods of' connecting, log files, and means and source of payment (including any credit 'o?r'bank account number); The types of service titiliaed; All records .or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar- data, pictures, and files; All. records pertaining to commtmications betWeen the Provider and an},r person regarding the account, including contacts With support services and records of actions taken; and other identi?ers, records of session tithes and durations, the date on which the account was created, the length o'i?ser'vice, the types of service utilized, the IP address used to register the account, log-in addresses associated with session times and dates, account status, alternative e?mail addresses provided during registration, all other user names associated with the account, all account names associated With the subscriber, methods of connecting; Case Document 43-6 Filed 03/19/19 Page 47 of 80 A-ll search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a. logic iP address or browser cookie with the accounts; All cookies, including tI'iirdnpartj,l cookies, associated with the USer; All records that are associated-with the machine cookies associated with-the. user; and All telephone or instrument numbers associated with the Account including MAC II. Numbers Mobile Equipment identi?er Mobile Identi?cation Numbers Subscriber Identity Module-s Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identifiers or International Mobile Equipment Identities (raters. Information to be Seized by the Government All information described above in Section Ithat constitutes evidence, contraband, fruits, andfor instrumentalities of violations of 18 U.S.C. 10.14 {false statements to a ?nancial institution), is use. 1343 {wire fraud}, 13 use, a 1344 fbank' fraud}, and is use. less (money laundering), as well as 18 UZSFC. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act U.S.-C.. ?611 et seq., involving Michael Dean Cohen and occurrin on or after June 1, 2015, including, for each account or' identi?er listed on Attachment A, information pertaining to the following matters: Communications, records, documents, and other tiles involving Essential Consultants, Communications, records, documents, and other ?les that false representations to. a' ?nancial institution with relation to intended the purpose of an account or loan at that financial institution; the nature business or entity associated with an account a ?nancial institution; the-source of ?tnds ?owing into'an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; - - - - - -.--..- Case Document '43-6 Filed 03/19/19 Page 48 of 80 A e. Records of an},r funds or bene?ts received by or offered to Michael?Dean Cohen by, or on behalf of, any foreign government, fereigh of?cials, foreign entities, foreign persons, or foreign principals; d. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to. the acebunt evvner; f. Evidence indicating the account ownerts "state of mind as it relates to the crimes under investigation; g. The identity of the personis) who created or used the account,'including records that help reveal the whereabouts of such person(s); and h. The identityl of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Review Preteeols . Review of the items described in Attachment A and Attachment shall .be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professipnal responsibility requirements concerning the maintenance ofattomey?client and other operative privileges. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apatti'from the imresti'gative team, in order to address potential privileges. Case Document 43-6 Filed 03/19/19 Page 49 of 80 Exhibit we . mm .1 ?ma- -- . . .. Case Document 43-6 Filed 03/19/19 Page 50 of 80 . no as (Rev- I it I 3} Search and Seiznre Warrant . UNITED STATES DISTRICT COURT - I for the District of Columbia in the Matter of the Search of E?tlir'r?ej'bt describe thepmper-t?y to {researched Case: ?1 '1 7?]le?00854 . 'o'n fdenrg'?: researson by some and address) ASSEQH ed TU . Chle Judge Beryl A. neeoots'reo WITH THE ACCOUNT Assign. Date: 11r13t2017 STORED AT THE 3 Description: Search and Seizure Wenent PREMISES OF 1&1 INTERNET INC. . SEARCH AND SEIZURE WARRANT . An application by a federal law enforot'sment officer or an attorney for the government requests the search of the following person o1 property located In the Northern District of Dalifernia 5, {Henri}? the person or describe the property to be searched and gtse :rs rosettes): . 3? See Attachment A. I?nd that the af?davids?), or any recorded testhnony, establish probable cause to search and seize the person or property described above, and that such search will reveal (reserpi- reaper-sen arses-eras the propernr'to be seized: See Attachment 3 YOU ARE CDMMA-NDED to execute this Warrant on or before November 20. 2017 (no: to exceed (days) a in the daytime 6:30 am. to l?z?li p.111. at any time in the day or night because good cause has been established, Unless delayed notice i-s-aothorizeti below, you meet give a copy of the warrant and the propertyr taken to the person from whom, or front Whose premises, the property was taken, or leave the copy and receipt at the place where the was taken. . The officer estecnting this wan-ant, or an officer present during the execution of- the warrant, must prepare an inventory- as required by law and return this warrant and inventory to Hon. ?ler-vi Howell . . (United-Store's Magistrate .hrn?ge) l3 Pursuant to 18 I find that immediate noti?cation may havean adverse result listed in 13 U.S.C. 2105 {except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or Whose property, will be searched or seized (sheet.- the trppi'oprr'?fe best El for days (not re exceedso) El until, the facts justifying, the later speci?c date of Date. and time-issued: [fr? W/f JEFW thdge? .r signature City and state, Washington, on Hon. Beryl a. Howell,? chiet'ue, District Judge Printed Home and ri?e Case Document 43-6 Filed 03/19/19 Page 51 of 80 AD 93 {Rest I 1! l3.) and Sateen: Warsaw: {Bagel} Return Case Ne.: Date and time warrant exeeuted: Cepy efwsn'ant and inventery with: Inventory made in the presence ef: I nventery' nf the property taken and name ef any 'pel's'nmsj s?ized: Crierti?eatinn designated ju?ge. Date: I declare. under penalty of perjury that this inventory is eerreeta?nd was returned along witlt the origins] warranug the Eaceeyifng 0.333291: '3 Pi-mrea?mme undress . -. Case Document 43-6 Filed 03/19/19 Page 52 of 80 ATTACHMENT A This warrant applies to information associated with the email -_hat is stored at premises owned, maintained, controlled: or operated by 1&1 Internet, Inc an electronic communication andfc'r remote computing service provider headquartered in Sunnyvale, California. 1 Case Document 43-6 Filed 03/19/19 Page 53 of 80 I. Information to be disclosed by 1&1 To the extent that the information, described in Attachment A is within the possession, I custody, or control of the Idea] (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, In gs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identifier listed in Attachment A: out: i'n?eiudin stored or lite served copies of emails sent to and from the account, 'dra? emails, the source and destination addresses associated with each email, the date and time at 1which each email was sent, and the size and length of'each' email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of? session times and durations,_thc date on which the account was created, the length of service, the IP- address used to register the account, log-in IP addresses associateCi'with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log. ?les, and means and source of payment (including any credit or bani-r account number); The-types of service utilized; All records or other information stored at any time by an individual using the account, including. address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contests with support 'serrices and records of actions taken; and other identi? er's, records of session times and durations, the date on which the ace'ount'vvas created, the length of service, the types of service utilized, the ZIP-address used; to register the account, log?in IP addresses associated with Session times and dates, account status, alternative e-rnail addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting-.- 'rrFr' ?rm?F72"? 'vv?wmc Case Document 43-6 Filed 03/19/19 Page 54 of 80 f. All search history or web history; g. All records indicating the services available to subscribers of the accounts; 11. All usernames associated with or sharing a login IP address or browser-cookie with the accounts; i. All cookies, including cookies, associated with the user; j. All records that are aSsociated with. the machine cookies associated with the user; and k. All telephone or instrument numbers associated with the Account (including MAC Numbers Mobile Equipment Identifier Mobile Identification Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or- International Mobile Equipment Identities II. Information to be Seized by the Government All information described above in Section 1 that constitutes evidence, contraband, fruits, andfor instrumentalities of violations of 18 1.1.3.8. 1014 (false statements to a ?nancial institution), 13 U.S.C. 1343 (wire fraud), 13 U.S.C. 1344 (bank fraud), and 13 11.8.13. 1956 (men-e}r laundering), as well as 13 U.S.C. 951 {acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. ?611 at seq? involving Michael Dean. Cohen, incltuiing-l For each account or identifier listed. on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les-that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that. financial institution; the nature of any business or entity associated with an' 1 account a financial institution; discourse of funds flowing into anaCcount; or the purpose or nature of any ?nancial transactions involving that ?nancial institution;- -. -..-.I- . . Case Document 43-6 Filed 03/19/19 Page 55 of 80 B- Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, - or on behalf of, any foreign government, foreign officiais, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf-of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to the account ouster; Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; - The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such and The identity of any records that help reveal the whereabouts of the communicated with the account about anjpr matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals. Review Protocols Review of the?items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements consenting the maintenance of attotiteyaclient and other operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potentiai privileges. T: Twain?s-m Case Document 43-6 Filed 03/19/19 Page 56 of 80 Exhibit 4 Case Document 43-6 Filed 03/19/19 Page 57 of 80 93 (Rev. if! Search and Seizure Warrant- UNITED STATES DISTRICT COURT for the District of Columbia In the Matter ofthe Search of C3881 17411130570 {Brie?y describe the property to be searched To A. or identity the person bynome and address} . - . 71201? Ass-.1 n. Date . at 3 3 Wessoctareo THE APPLE 1D Description: Search and Seizure Warrant sentences: THAT ts sroaeo er PREMISES CONTROLLED ev APPLE, SEARCH AND SEIZURE WARRANT .u-qlit?I-E: To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Northern District of California the person or describe the proper-n! to be searched and give its formic-n}: See Attachment A. I ?nd that the a??idavitis}, or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (firearm: the pet-sea or describe the praperty to be seized}: See Attachment B, YOU ARE CDMMANDED to execute this warrant on or before . ?nalist f1. 2017 (not to mead t4 days) 6' in the daytime 6:00 am. to 10:00 pm. [3 at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer ettecuting this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hon. Beryl A. Howe-3 (Us t't'eh' States Magistrate Judge) Pursuant to [8 USE. 3103a(b), [?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. EMS [except for deiay of trial}, and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (street the appraprtam not} for days fact to exceed 3t}; CI until, the facts justifying, the later speci?c date of Date and-time issued: 7?6 7i . .. SE in? City and state: Washington. DC Hon. Beryl A. Howell, Chief LLS. District Judge Printednnme mIt?fn'Ifi't- . - Case Document 43-6 Filed 03/19/19 Page 58 of 80 AU 93 (Rev, lit] 3} Search and Seizure Warrant (Page 1} Return Case Nos Date and time warrant executed: Copy of warrant and inventor}r left with: Inventory made in the presence of': Inventory of the property taken and name of an}.r parser-(s) seized: eminent-un? I declare under penaltyr of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. DateExecuting re?ner signa?tre Printed Heme and title - - - u. .. Case Document 43-6 Filed 03/19/19 Page 59 of 80 ATTACHMEET a This warrant applies to infennatinn ?associated with the Apple ID -@gmail.eem that is stored at premises owned, maintained, controlled, or operated by Apple, Inc. (?Apple?), a company headquartered at 1 In?nite Loop, Cupertine, CA 95014. Case Document 43-6 Filed 03/19/19 Page 60 of 80 I. Information to be disclosed by Apple, Inc. To the extent that theinformation described in Attachment A is within the possession, custody, or control of Apple, Inc. (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: . a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physicai address, telephone numbers and other identi?ers, records of session timesand durations, the date on which the account was created, the length of service, the IP address used to register the account, login IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); The types of service utilized; Ail recordsor other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilised, the IP address used to register the account, log-in addresses associated with session times and dates, account status, alternative e-rnail addresses provided .-.-. .-..-.-: -- -. c- wua-srh-n- we-m?-e-ncm-r -.-.-.- -. - -. 'v . w- Case Document 43-6 Filed 03/19/19 Page 61 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search historyr or web history; g. All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; i. All cookies, including third-party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and k. All telephone or instrument numbers associated with the Account (including MAC IL addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identifier Mobile Identification Numbers Subscriber identity Modules Mobile Subscriber integrated Services Digital Network Number International Mobile Subscriber Identifiers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, andior instrumentalities of violations of 13 U.S.C. 1014 (false statements to a ?nancial institution), [8 U.S.C. 1344 (bank fraud), i8 U.S.C. 1956 (money laundering), 3 U.S.C. ?951' (acting as an unregistered Foreign agent), and 22 U.S.C. {i (ii 1 efseq. (Foreign Agents Registration Act), involving Michael Dean Cohen and occurring on or afterlanuary 1,2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records. documents, and other ?les involving Essential Consultants, . Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or ioan at that ?nancial institution; the nature of any business or entit}I associated with an - - it Case Document 43-6 Filed 03/19/19 Page 62 of 80 account a financial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, Foreign entities, foreign persons, or foreign principals; :3 e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or g, foreign~principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s}; and i: i. The identity of any records that help reveal the whereabouts - of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals. .-. Case Document 43-6 Filed 03/19/19 Page 63 of 80 Exhibit .: - -. Case Document 43-6 Filed 03/19/19 Page 64 of 80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Accounts @gtnail coin, . _@amail com and Maintained at Premises Controlled by Google, Inc? USAO Reference No 213183100127 u: Ins-'wrl'l'rzmm SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Google, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -of the United States Attomev?s Office for the Southern District of New York, and pursuant to the provisions of the I Stored Communications Act, 13 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accounts -.@gmail.ootn, -@grnail.con1, and maintained at premises controlled by Google, Inc, contain evidence, fruits, and instrurnentalities of crime, all as speci?ed in Attaclunents A and hereto. Accordingly, the Provider is hereby directed to provide to the hivestigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider within ?7 days of the date of issuance. The Warrant and Order may be served via WF?nv Case Document 43-6 Filed 03/19/19 Page 65 of 80 electronic transmission or any other means (through which the Provider is capable of accept-mg service. . 2. Non-?Disclosure Order. Pursuant to 13 U.S.C. 2705(b), the Cornt ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight ?om prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the Order to- therlisted" subscriberor?trr an}r other p?erson'rforarperio 130 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice, 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it Was issued, be ?led under seal, except that the Government may without ?irther order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. I Dated: New York, New York "Ll-I?if. 1'3. fl 'rl I Iii-Er? bate Issued Time Issued fr" Newman Base somerset Chief United States- Magistrate {fudge Southern District arms vars 02.23.2013 "Wm-m1" Case Document 43-6 Filed 03/19/19 Page 66 of 80 Email Search Attachment A 1. Subject Account and Execution of Warrant This warrant a directed to Google, Inc. (the ?Provider?), headquartered at 1600 mnphitheatre Parkway, Mountain View, California 94043, and applies to all content and. other information within the Provideris possession, custody, or control associated with the email account _?gmai1.ccm (the ?Subject Account") for the time period referenced below. A?law?enforcement- oruaaother appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic cup}; of the speci?ed in Section l1 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. 11. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accotmt: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header . information [specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 201?? and the date of this warrant, inclusive. 13. Address book information All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, uscmame, address, telephone "non-mm I .. - "we Case Document 43-6 Filed 03/19/19 Page 67 of 80 ranr?n?qwr?-{ -. - -.- -- number, alternate email addresses, registration IP address, account creation date, account status, length of service", types of services utilized, means and source of payment, and payment history. I d. ironsoctiorro?l records. All transactional records associated with the Subject Account, including any legs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. 5 e. Customer correspondence. All correspondence with the subscriber or others associated m, and records of actions taken, limited to items sent, received, or created-between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history andior web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, ?les maintained on Google Drive, and histant messages or Gchats associated with the Subject Account, limited to items sent, received, or cleared between December 1, 2014 and the date of this warrant, inclusive. h. I Preserved or backup records. Any preserved or baclcup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 1 . hum-n- U.S.C. 2703(1) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and - agents, attorneys for the govenunent, attomey support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control] are 17-191: inn?.r authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2. [1223.21313 Case Document 43-6 Filed 03/19/19 Page 68 of 80 the United States), 1'005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s} who created or used the Subject Account; I b. records, documents, and other ?les imrolving Sterling National Bank, Melrose Credit Union, andr'or taxi medallions; agreement for Michael D. Cohen audior entities associated with him to transfer any interest in taxi medallions, and any associated debts or habili?es, to others, including to -andr'or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen ?is Associates, including those which indicate the nature and purpose of payments made test from Essential Consultants or Michael D. Cohen 35 Associates, - e. Conununications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about an}r matteIs relating to Essential Consultants, LLC, or about any plaii or proposal oragreement for Michael D. Cohen andlor entities associated with him to transfer an}! interest in taxi medallions, and any associated debts or liabilities, to others, including to _md!or entities associated with him; I f. Communications between the Subject Account and -relating to Michael D. Cohen?s bani: accounts, tastes, debts, andf'or ?nances; Communications, records, documents, and other ?les re?ecting false representations to a financial institution with relation to the intended purpose of an account or loan at that financial ?2.23.2013 a .- - - Case Document 43-6 Filed 03/19/19 Page 69 of 80 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that financial institution; h. Evidence indicating horar and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and 1. Evidence indicating Offenses under investigation. IV. Ravie'viI Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect anvattcmey-client or other applicable privilege When appropriate, the procedures shali include use of a designated ??lter team,? separate and apart from the hivestigative team, in order to address potential privileges. 02.28.2{113 Case Document 43-6 Filed 03/19/19 Page 70 of 80 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed re G?ogl?, Inc. (the ?Provider?s, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email accounts -gmai1.com and (the ?Subject Accounts?) for the time -.- A law enforcement officer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items fallin ndthin the categories specified in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accotmts: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and dine at which each email was sent, and the size and length of each email). b. Address hoof: information. i111 address book, contact list, or similar infonnation associated. with the Subject Accounts. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone u-qu -. - . - ?guru-man. -. .-- Case Document 43-6 Filed 03/19/19 Page 71 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Accounts, including any IP logs or other records of?session times and dtnations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services 1 n?n-Twc f. Search History. All search history andior-web history associated with the Subject Accounts. g. Associated cement All Google Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Accotmts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2793 or otherwise. Review of Information by the Gorernment Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical, experts under government control)- are authorized to review the records produced by the Provider in order to locate any evidence, ?nite, and instrumentalities of violations of ?18 ESE. 371 (conspiracyto commit offense or to dc?'aud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bani: including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; - 2 consents Case Document 43-6 I Filed 03/19/19 Page 72 of 80 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D._Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to andfor entities associated with him; i e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who agreement for Michael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to _andfor entities associated ?as; has; d. Conununications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution[s), regarding h?ehael D. Cohen?s ?nances; e. records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entitj,I associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial histitution; f. Etddence indicating host} and When the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crirnes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners" intent as it relates to the Subject Offenses under hivestigation. DZZEEDJE numun?huwup- #1 a; .. Case Document 43-6 Filed 03/19/19 Page 73 of 80 IV. Review Protocols I Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonath designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart fromthe investigative team, in order to address potential privileges 02.23.2013 ?Mus?. . .- .- . . Case Document 43-6 Filed 03/19/19 Page 74 of 80 Exhibit -.- I: - - Case Document 43-6 Filed 03/19/19 Page 75 of 80 rattan tea a STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Infonnation Associated with the Email Account mahrtamed at Premises Controlled by I 85 1 Intemet, lnc., USAO Reference No. 201 ERUOIZT . F?rv- TO: 1 8; Hammer Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent-of the United States Attorney?s Office for the Southern District of New York, and pursuantto the provisions of the Stored Communications Act, 18 U.S.C. and ?2703(o)(1)(25r), and the relevant provisions of Federal Rule er Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accoun1-?naintained at premises controlled by i 1 internet, Ina, contains evidence, fruits, and of crime, all as speci?ed in Attachment heretoe Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speoitied in Section II of Attachment hereto, for subsequent review by lavv enforcement personnel as authorized in Sections In and IV of Attaclnnent o. The Governrnent is required to serve a copy of this Warrant and Order on the Ptovider 1Within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or anv other means through which the Provider is capable of accepting service.tl: .. .. .. Case Document43-6 Filed 03/19/19 Page 76 of 80 2. Non?Disclosure Order. Pursuant to 13 U.S.C. 2705(1)), the Court finds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if neces'sarjfrexcept for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, he ?led under seal, except that the Government inav without further order of this Court serve the War-rant and Order on the PTovider; provide copies of the Af?davit or Warrant and Order as need he to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure . obligations in anv prosecutions related to this matter. Dated: New York, New York if? XDIQQM - irr' Date) Issued Time Issued em 5 no osasfs eas ef United States ate?ludge Southern District ofeNervi York, 5 ,1 as I rate-.1 ?1 I 012331318 -: "qwerw-m-Irwu?m-u Case Document 43-6 Filed 03/19/19 Page 77 of 80 Email SearchAttachruent I. Subject Account and Execution of Warrant This warrant is directed to 1 ?it 1 Internet, Inc. (the ?Trovider?}, headquartered at 701 Lee Road, Suite 300, Chesterbroolc, 1908?, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -- [the ?Subject Accotmt?) for the titne period between November 14, 2017 A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement - o?icer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To'the extant within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with. the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). 13. Address book information All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment in?rmor?ion. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone -Case Document 43-6 Filed 03/19/191 Page 78 of 80 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. records, All transactional records associated with the Subject Account, including any logs or other records of session times and durations. e. Customer corrs3pcndence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and recordsofactions'taken. f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a presentation reducst issued pursuant to 18 U.S.C. 27036) or otherwise. - Ill Reviewr of Information by the Government Law enforcement personnel {who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 13 ULSC. 3711 (conspiracyto commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les'necessary to establish the identity of the pcrson(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving Sterling hiational Bank, ?Melrose Credit Union, andfor taxi medallions; - c. records, doctnnents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest in taxi 2 mascots "1r Case Document 43-6 Filed 03/19/19 Page 79 of 80 medallions, and any associated debts or liabilities, to others, including to -tndfor entities associated with him; d. Communications, records, documents, and othei' ?les involving Essential Consultants, LLC or Michael D. Cohen (95 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen 35 Associates; e. The identity of any,person(s) including records that reveal the whereabouts of the pcrson(s)t about anvtnattersretatin g- to-Essential" Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_andfor entities associated with him; . f. between the Subject Account and -relating to Michael D. Cohen?s bank accomlts, taxes, debts, andfor ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institutionwith relation to the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of?uids ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under hivestigation. 02.23.2013 .A I'm-rum wt. .. .. r" Case Document 43-6 Filed 03/19/19 Page 80 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-rciient or other applicable pritdlege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the hivestigatitre team, in order to address potential privileges. {12.23.2013 I . .. - - -