Case Document 43-6 Filed 03/19/19 Page 1 of 80 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York Case No. In the Matter of the Search of (Brie?y describe the property to be searched or identify the person by name and address) Three Electronic Devices, See Attachment A SEARCH AND SEIZURE WARRANT An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identijjz the person or describe the property to be searched and give its location): Three Electronic Devices, See AttachmentA The person or property to be searched, described above, is believed to conceal (identijy the person or describe the property to be seized): See Attachment A I ?nd that the affidavit(s), or any recorded testimony, establish probable cause to 583.1 ch and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before by", a. i i (not to exceed 1 4 days) CI in the daytime 6:any time in the day or night as I find. reast?jnable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant mid a?1ecr=1ptfor the property taken to the person from whom or from whose premises, the property was taken, or leave the cepy and receipt at the place Where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Coart. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court 694% USMJInitials if I ?nd that immediate noti?cation may have an adverse result listed iIi18 C. i? 2705?i(except tor delay of trial), and authorize the of?cer executing this warrant to delay notice to the epe?rs?on who, or Whose preperty will be searched 01? 861Zed (check the appropriate box) Elfor 30 days (not to exceed 30) Duntil, the facts justifying, the later specr?c date oI Date and time issued: 4/ :3 ?were?? rife, . 5/ Judge? City and state: New York, NY Hon. Henrv B. Pitman, U.S. Maoistrate Judoe Printed name and title .Case Document 43-6 Filed 03/19/19 Page 2 of 80 AC) 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant - to the Court. Date: Executing o?icer ?3 Signature Printed name and title Case Document 43-6 Filed 03/19/19 Page 3 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?1 A black and red USB drive with a White label that says ?Tracking 180208140208.? b. Subject Device-2: A silver DVD with a White label that reads ?Cohen 2018.03.07.? c. Subject Device?3: A White DVDL labelled ?2-28-18 Cohen SW Returns Google 311mm,? . . ., II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U. S. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: Case Document 43-6 Filed 03/19/19 Page 4 of 80 Case Document 43-6 Filed 03/19/19 . Page 5 of 80 A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of In the Matter of the Search of (Brie?y describe the property to be searched or t'dentt??t the person by name and address) Three Electronic Devices, See Attachment A APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I .have reason to believe that on the following person or property (tdenti?t the person or describe the ., . . 7 . 7 - See Attachment?A (rg located in the Southern District of New York there is now concealed (idehtz'?t the person or describe the property to be seized): PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): Mevidence of a crime; contraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O??ertse Description 52 USC 30116(a)(1)(A), 30109 Illegai campaign contributions The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. IEI Continued on the attached sheet. [if Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 18 USC. 3103a, the basis of which is set forth on the attached sheet. Ir?l' . 't Itht'tte?d name .attd tll?IESworn to before me and signed in my presence. i . at I I tit/7?? I77 ff no I- Date: [49/ ?r 3557/57 . W/?efi?rew 'j I gt? Judge - 5 ,City and state: 4/ hi5?? Rafa/4} M?ot/ Vet/37L Hon Henry Pitrnan, US gistiate Judge Prmted r?tarme and Case Document 43-6 Filed'03/19/19 Page6of80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United 0 BE FILED UNDER SEAL States Of America for a Search Warrant for Three Electronic Devices, USAO Reference No Agent Af?davit in Support of 2018R00127 5 Application for a Search Warrant SOUTHERN DISTRICT OF NEW YORK) ss.: Special Agent - of the United States Attorney?s Of?ce for the Southern District of New duly sworn, deposes and says: I. Introduction A. Af?ant 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the electronic devices speci?ed below (the ?fSubject Devices?) for the items and information described in Attachment A. This af?davit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis of 2 Case Document 43-6 Filed 03/19/19 Page 7 of 80 electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. Prior Warrants and the Subject Devices 3. The USAO and the Federal Bureau of Investigation have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 4. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the. account-@gmailcom (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17?mj-00503, is attached as Exhibit A (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account?). This warrant, which is numbered, l7?mj-005 70, is attached as Exhibit (the ?Cohen iCloud Warrant?). Case Document 43-6 Filed 03/19/19 Page 8 of 80 c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017. This warrant, which is numbered 17?mj?00855, is attached as Exhibit (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account-_the ?Cohen Account?) sent or received between the opening of the Cohen Account1 and November 13, 2017. This warrant, which is numbered 17-mj?00854, is attached as Exhibit (the ?First Cohen Warrant?). 5. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.2 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 6. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the. date of the warrant. - 2 The SCO had previously provided a subset of this non?privileged content on or about February 2, 2018. Case Document 43-6 Filed 03/19/19 Page 9 of 80 received between November 14, 2017 and February 28, 2018. These warrants, which are both numbered 18 Mag. 1696, are attached as Exhibits (the ?Third Cohen Gmail Warrant?) and (the ?Second Cohen Warrant?), reSpectively. The content produced pursuant to these warrants is being reviewed for privilege by an SDNY ?lter team. 7. The search warrants described above are referred to collectively herein as the ?Prior Warrants.? 8. The returns of the Prior Warrants are presently contained on three electronic devices. In particular: a. Subject Device-J The non?privileged emails and content returned in response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen Warrant are contained on Subject Device?1, which is particularly described as a black and red USB drive with a white label that says ?Tracking 180208140208.? b. ?Subject Device-2: The non?privileged content returned in response to the Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device-3: The content returned in response to the Third Cohen Gmail Warrant and the Second Cohen Warrant is contained on Subject Device?3, which is particularly described as one white DVD labelled ?2-28?18 Cohen SW Returns Google and 9. The Subject Devices are presently located in the Southern District of New York. C. The Subject Offenses 10. The af?davits in support of the Prior Warrants describe evidence of several different courses of conduct by Cohen, including, among other things, false statements to financial institutions relating to the purpose of an account he opened in the name of Essential Consultants 5 Case Document 43-6 Filed 03/19/19 Page 10 of 80 LLC and the nature of funds ?owing into that account; false statements and fraudulent omissions by Cohen in connection with this attempt to re?nance his debts with certain financial institutions; and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without having registered as a foreign agent. The Prior Warrants accordingly de?ne the evidence to be seized by reference to subject offenses and speci?c categories of information related to these courses of conduct. The subject offenses in the Prior Warrants are summarized as follows: EM Subject Offenses in Prior Warrant3 A First Cohen Gmail ,18 U.S.C. 371 (conspiracyto defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act Second Cohen Gmail 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen Warrant 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen iCloud Warrant 18 U.S.C. 1014 (false statement to ?nancial institution), 1344 (bank fraud), 195 6 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 etseq. (FARA) Third Cohen Gmail 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial. institution), 1343 (Wire fraud), 1344 (bank fraud) Second Cohen 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud) 1 1. Based on my participation in this investigation, including my review of documents obtained pursuant to subpoena and court order, my conversations with witnesses and review of reports of conversations with witnesses, and my review of publicly available information, I have 3 On or about February 28, 2018, the USAO sought and obtained a Rule 41 warrant, authorizing it to expand its search of the email returns for the warrants attached as Exhibits (the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and First Cohen Warrant) for additional offenses not authorized in the original warrants for those accounts. The below chart therefore lists both the subject offenses listed in the original warrants for these accounts and the subject offenses? authorized in the February 28, 2018 warrant. Case Document 43-6 Filed 03/19/19 Page 11 of 80 learned of evidence of an additional Subject Offense'committed by Cohen, described below, which was not listed in the Prior Warrants.4 12. I am therefore requesting authority to expand the search of the returns of the Prior Warrants, as contained on the Subject Devices, for evidence related to the additional Subject Offense. As set forth below, in addition to the categories of evidence already described in the Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?Subject II. Probable Cause Regarding the Subject Offense 13. As set forth above, the USAO and the FBI have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. During the course of this investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal 4 As set forth below, I base this application in part on my review of emails and text messages obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of the emails or texts returned pursuant to the applicable Prior Warrant. 5 The Prior Warrants describe categories of information that likely encompass evidence of the additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking explicit authorization to search the Subject Devices for evidence of the Subject Offense. 7 Case Document 43-6 Filed 03/19/19 Page 12 of 80 Case Document 43-6 Filed 03/19/19 Page 13 of 80 Case Document 43-6 Filed 03/19/19 Page 14 of 80 Case Document 43-6 Filed 03/19/19 Page 15 of 80 Case Document 43-6 Filed 03/19/19 Page 16 of 80 Case Document 43-6 "Filed 03/19/19 Page 17 of 80 Case Document 43-6 Filed 03/19/19 Page 18 of 80 Case Document 43-6 Filed 03/19/19 Page 19 of 80 Case DocUment 43-6 Filed 03/19/19 Page 20 of 80 _Case Document 43-6 Filed 03/19/19 Page 21 of 80 Case Document 43-6 Filed 03/19/19 Page 22 of 80 Case Document 43-6 Filed 03/19/19 Page 23 of 80 CaSe Document 43-6 Filed 03/19/19 Page 24 of 80 Case Document 43-6 Filed 03/19/19 Page 25 of 80 Case Document 43-6 Filed 03/19/19 Page 26 of 80 Case Document 43-6 Filed 03/19/19 Page 27 of 80 Case Document 43-6 Filed 03/19/19 Page 28 of 80 Case Document 43-6 Filed 03/19/19 Page 29 of 80 Case Document 43-6 Filed 03/19/19 Page 30 of 80 28. Therefore, there is probable cause to believe that a search of the Subject Devices will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: Case Document 43-6 Filed 03/19/19 Page 31 of 80 Procedures for Searching ESI A. Review of E81 29. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys forthe government, attorney support staff, agencypersonnel assisting. the government in this investigation, interpreters, and outside vendors or technical experts under government control) will review the E81 contained on the Subject Devices for information responsive to the warrant. 30. In conducting this review, law enforcement personnel may use various methods to locate evidence, fruits, and instrumentalities of the Subject Offense, including but not limited to undertaking a cursory inspection of all emails, texts or ?les contained on the Subject Devices. This method is analogous to cursorily inspecting all the ?les in a ?le cabinet in an of?ce to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of ?les commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and 27 Case Document 43-6 Filed 03/19/19 Page 32 of 80 consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. IV. Conclusion and Ancillary Provisions 31. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 32. In light of the con?dential nature of the c0ntinuing investigation, and for the reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent, USAO Sworn to before me on 7th day of April, 20,13} i . f} t" HON. HBNR PITMAN UNITED 1? A I ES MAGISTRATE JUDGE ., ., - v. 28 Case Document 43-6 Filed 03/19/19 Page 33 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?J A black and red USB drive with a White label that says ?Trackin 180208140208.? . b. Subject Device~22 A silver DVD with 'a White label that reads ?Cohen 2018.03.07.? 0. Subject Device?3: A White DVD labelled ?2?28?18 Cohen SW Returns Google and . . . . . .. II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the E81 contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: Case Document 43-6 Filed 03/19/19 Page 34 of 80 Case Document 43-6 Filed 03/19/19 Page 35 of 80 Exhibit A Case Document 43-6 Filed 03/19/19 Page 36 of 80 r: 4?23 JUL 22 an UNITED STATES DISTRICT COURT mm 3 Wm for the Edd District of Columbia A0 93 (Rev. 11MB) Search and Seizure Warrant In the Matter of the Search of 0-503 (Brie?y describethepropertyto be searched . 633821 17 ml 0 Ell Beryl A or identr?z the person by name and address) AS?lgFled TO ASSOCIATED WITH THE EMAIL pat? 7? and Warrant Dese'nptInn: 393m - SEARCH AND SEIZURE WARRANT To Any? authorizedlawenforcementofti oer - An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the . Northern District of California (identtfir the person or describe the properlyI to be searched and give its location): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (tdentt?; the person or describe the property to be seized): See Attachment 8. YOU ARE COMMANDED to execute this warrant on or before 1, 2017 1 {not to exceed 14 days) [ill in the daytime 6:00 am. to 10:00 pm. Cl at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hond?eryi A. Howell United States Magistrate Judge) El Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) Cl for days (not to exceed 30) [3 until, the facts justi?ling, the later speci?c date of Date and time issued: [145% .23? 453i?? Judge' signature City and state: Washington, DC. Hon. Howell Chief S. DIstrIct Judge Printed name and title um Case Document 43-6 Filed 03/19/19 Page 37 of 80 A0 93 (Rev I l/l3) Search and Seizure Warrant (Page 2) Return Case No:: I 7 Date and [in ?e warrant executed: Copy of warrant and inventory left With: inventory t?ade in the presence of Inventory of the property taken andnenie of any per?o'nts) seiiedt Delta" 55,; 1 Letter? {569067 119190501? 2017071q~ gap A ?For MC 'pwcfevf?lm? JUL 21? 23!? Clerk, U.S. an Bankruptcy Courts 7 . Certi?cation declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. A Date: 7/36/wa . Primed name and Inn: Case Document 43-6 Filed 03/19/19 Page 38 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmai1.com that is stored at premises owned, maintained, controlled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 43-6 Filed 03/19/19 Page 39 of 80 I. ATTACHMENT Information to be disclosed by? Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each accoUnt or?identi?er listed in AttachmentA: 7 a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log?in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log?in IP addresses associated with .session times and dates, aceount status, alternative e?mail, addresses provided Case Document 43-6 Filed 03/19/19 Page 40 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; g. All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; i i. All cookies, including third-party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and . 7 R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 101.4 (false statements to a ?nancial institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 95] (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 et seq, involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 43-6 Filed 03/19/19 Page 41 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or forej gnprinnipals: f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s. state of mind as it relates to the crimes under investigation; h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and it The identity of any records that help reveal the whereabduts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 43-6 Filed 03/19/19 Page 42 of 80 Exhibit Case Document 43-6 Filed 03/19/19. Page 43 of 80 A0 93 (Rev. 11/13) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia 1n the Matter of the Search of (Brie?y describe the property to? be searched or idenrpji the by name and address} INFORMATION ASSOCIATED WITH THE EMAIL ACCOUNT COM 0332: Assigned To: Chref Judge Howell, Beryl A Assign Date: 1111312017 Desc?riptien: Search and Seizure Warrant SEARCH AND smug}; WARRANT -- I An application by a federal iaW enforcement officer or an attorney for the government requests the sear-ch of the following ?perSOH Or property located in the Northern - District of Califbrnia the person or describe the property re be searched arid give its location): See Attachment A. I ?nd'that-the af?davitCs), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that search will reveal (ideht?r?) the person or describe'rhe property to be seized): See Attachment E3. YOU ARE COMMANDED to execute this warrant on or before November 20. 2017 (not to exceed 1:4 days) in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good caUSe has been established. Unless delayed notice is authorized below, you must give a copy of the remnant and a receipt for the property? taken to the person from?whoms or from Whose premises,- the propelty Was taken, Or leave the copy and receipt at the place where the property was, taken. The of?cer executing this Warrant, or an officm' preSent during the execution of the warrant, tnust prepare an invieritory as required by law and return this warrant and inventory to Hon. Beryl A. Howell A (Urrima? States Magistl are Judge) CI Pursuant to 18 3103a(b), i ?nd that immediate noti?cation may have an adVelse result listed at 18 C. 2-705 (except foi delay of trial), and authorize the af?ne executing this warrant to delay notice to the person Who, or whose property will be searched or seized (check the box) far days {not {a exceedSO) until, the facts justifying,_ the later speci?c date of Date-vandtirneissued; 3143/ 259/ ?it [egg/ff Jadge? Signaarre City and state: Washington, Dc Hon. Beryl a. Hewett, chier'us. District Judge Printed name and ri?e Case Document 43-6 Filed 03/19/19 Page 44 of 80 A0 93 (Elev. 11/13) Search and Seizure Warrant (Page 2) 3.493%. Return Case No.: Date and time warrant executEd: Copy 'of Warrant and inventory left with: Inventmy made in the presence of: Inventory of the prbp'e'rty taken and flame of any person(s) Seized: Certi?eatibn designated judge. Date: I declare Under penalty of perjury that this inventory is correct and was l?etufned along With the original warrant to; the Eat?euti?g o?icer? ?3 Signature ,Prfn'te?dnapie and title- Case Document 43-6 Filed 03/19/19 Page 45 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mai] Account -@gmail.com that is stored at premises owned, maintained, or operated by Google, acompany headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 43-6 Filed 03/19/19 Page 46 of 80 1. ATTACHMENT Information to be disclosed by Google To the extent that the information described in Attachment A is within the possession, custody, 01' control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted "but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment a. The contents of an emails associated vulth the account, including stored orpreserved copies of emails Sent to and from the account, draft entails, the source and destination addresses associated with each email, the date and time at which each email Was sent, and the sizeand length of each email; All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account Was created, the length of service, the iP address used to register the account, log-in IP addresses associated with schiOn times and dates, actiount status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and s?ourCe of payment (including any credit ?o?r'bank account number); The types of serviCe utilized; All records .or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les;- All, records pertaining to communications betWeen the Provider and any person regarding the account, including Contacts with support services. and records of actions taken; and other identi?ers, records of Session times and durations, the date on which the a'ccount'wes created, th'e length of Service, the types of serviCe utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided during registratidn, all other user names associated With the aecount, all account- names associated with the 'subScriber, methods of cennecting; Case Document 43-6 Filed 03/19/19 Page 47 of 80 All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a,login IP address or broWser cookie with the accounts; All cookies, including thirdnparty cookies, associated with the user; All records that are associated with the machine cookies associated with'th?e user; and All telephone or instrument numbers associated with the Account (including MAC II. Numbers Mobile Equipment Identifier Mobile Identi?cation Numbers Subscriber Identity Module-s Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section [that constitutes evidence, contraband, fruits! and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial institution), is use. 1343 (wire fraud), 18- 1344 (bank fraud), and 18 use. 1956 (money laundering), as well as 18 11.8.0. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 611 at S?tq., involving Michael Dean Cohen and occurring on or after June 1, 2015, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: _aa records, documents, and other ?les involving Essential Consultants, Communications, record's, documents, and other? ?les that false repreSentations to. a' ?nancial institution with relation to intended the purpOSe of an account Or lean at that ?nancial institution; the nature of-any business or entity associated withvan account a ?nancial institutibn; thesource of funds ?owing into 'an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document "43-6 Filed 03/19/19 Page 48 of 80 Records of any funds or- bene?ts received by or offered to MichaelDean Cohen by, or on behalf of, any foreign government, foreign of?oial's, foreign entities, foreign persons, or foreign principals; Communications, records, documents5 and other ?les that reveal efforts by Michael Dean Cohen to conduct activities On behalf of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; Evidence indicating how and when the account was accessed or used, to determine 11. user and events relating to the crimes under investigation and to the account owner; Evidence indicating the account owneris "state of mind as it relates to the crimes- under investigation; The identity of the person(s) who created ?or used the account,'including records that help reveal the whereabouts-of such personCs); and i The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals. Review Protocols, Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other Operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,?se atate and a the investivative team, in order to address otenti'al rivile es. a Case Document 43-6 Filed 03/19/19 Page 49 of 80 Exhibit Case Document 43-6 Filed 03/19/19 Page 50 of 80 Jammy?1 rm 9 um. A0 .93 (Rev. [1113) Search and Seizure Warrant UNITED STATES DISTRICT COURT - for the Disitrict of Columbia in the Matter of the Search of (Brie?y describe the. property to he: searched Case: 'o?r iderr?tp?lthEperson by name and address) Assigned T0 Chief Judge Beryl ASSOCIATED WITH THE ACCOUNT Date I 11/131'2017 '5 STORED AT THE Description: Search and Seizure Warrant PREMISES OF 1&1 INTERNET iNc SEARCH AND SEIZUREWARRANT of?cer .77 .. .A 7 An application 'by? a federal law enforcement of?cer or an attorney for the government requests the search pf the following person or property located in the Northern District of California (id?rr'rigfiz the person 0r describe Thepreperry to be searched and give ifs jeearfon)?: See Attachment A. I find that the af?davitCS), or any recorded testimony, establish probable cause to search and seize the person or property deSC-ribed above, and that such search will reveal (remap: tfiepersbn er derc?rrbe theproperzy-?m be seized): See Attachment 13. YOU ARE COMMANDED to execute this Walrant on or before November'ZO. 2017 (no: to exceed 14 days) Elf in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good cause has been established. Unless delayed notice is-authorize?d below. you must give a copy of the warrant and a receipt for the property taken to the person from whom, Or from" whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer ertecnting this Warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant'and inventory to Hon. Beryl A. Howell . . . rldagr'strme Judge) El Pursuant to 18 U. 7S. 5103510)), I ?nd that immediate noti?cation inay have an adverse result listed in 18 .C. 2705 (except for delay of trial) and authorize the of?cer executing this warrant to delay notice to the person who or WhoSe property be seal ched (check the appi opqule box) for days (170110 exceed 30) until, the facts justifying, the later Speci?c date of Date. and timei's?sued: [fit/ll sz?fiff?m 11/? fW Judge 5' sigrratur City and state: Washington, DC . Hon. Beryl A. Hewet? ?cmer'ue. District Judge Printed name and ri?e Case Document 43-6 Filed 03/19/19 Page 51 of 80 w- A0 93 (Rev. Seatoh and Seizure Warrant (PageZ) Return "Case No.: Date and time warrant executed: Copy ofwam?ant and inventory left with: Inventory made in'the presence of -: Inventory of the property taken and name of any lpei?SonCs) seized: CErii??a?On A designated judge. Date: I declare, under penalty of pel?jury that this inventory is correct and Was returned along with the original warrantto the Executing of?cer sigizqittre I P?n?r?ed name mid ri?e Case Document 43-6 Filed 03/19/19 Page 52 of 80 PIS-N .7 ATTACHMENT A This warrant applies to information associated with the. email -_hat is stored at premises owned, maintained, controlled, or operated ?by 1&1 Internet: Inc. an electronic communication arid/or remote computinglsetvice provider headquartered in Sunnyvale, California. Case Document 43-6 Filed 03/19/19 Page 53 of 80 I. ATTACHMENT Information to be disclosed by 1&1 To the extent that the information described in Attachment A is Within the possession, custody, or control ofthe 1&1 (hereinafter ?the Provider"), regardless of whether such infennation is stored, held 0r maintained inside or outside of the United States, and including any ?einails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: Va" The aerator? ?reserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was-sent, and the size and length of'each? email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephonenumbers and other identi?ers, records of session times and durations,the date on which the account was created, the length of serviCe, the IP- address used to register the account, log?in IP addresses associated'with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); Thetypes of-servi?ce utilized;- All records or other information stored at any time by an individual using the account, including. address books, contact and buddy lists, calendar data, pictures, and ?les; All rec01?ds pertaining to, communications between the Provider and any person regarding the account, including centac?ts with ?fservices and records of actions taken; and other identi?ers, records of ~ses:Sion'ti1nes and durations, the-date on which the account?was created, the length of service, the types of service utilized, the IP?address used: to register the account, log-in IP addresses associated with Session times and dates, account status, alternative carnal} addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; Case Document 43-6 Filed 03/19/19 Page 54 of 80 ?as m, i All search history or web history; All records indicating the services available to subscribers of the accounts; All usernarnes (associated with or sharing a lo gin IP address or browsercookie with the accounts; All Cookies, including tliird~party cookies, associated with the user; All records that are associated with, the machine cookies associated with the user; and All telephone or instrument numbers associated with. the Account (including MAC II. Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All informatiOn described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C-. 1014 (false statements to a financial institution), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1344 (bank fraud), and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 at 5351., involving Michael Dean Cohen, including, for each account or identifier listed. on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other tiles-that) false representations to a ?nancial institution with relation to intended the purpose of an amount (Dr loan at that, financial institution; the nature of any business or entity associated with an I aecount a financial institution; the'sour'ce of funds flowing into anaCcount; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document 43-6 Filed 03/19/19 Page 55 of 80 Q's, Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to cenduct activities on behalf'of, for the bene?t of, or at the directien "of any foreign government, foreign of?cials, foreign entities, foreign persons, 0r foreign principals; Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to the account owner;- Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; - The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such and The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities. conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals, Review Protocols Review of th'eitems described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorneyaclient and other operative privileges, When appropriate, the proCedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address- p?otential privileges. Case Document 43-6 Filed 03/19/19 Page 56 of 80 Exhibit Case Document 43-6 Filed 03/19/19 Page 57 of 80 A0 93 (Rev. Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter ofthe Search of Case: Nani?00570 Assigned To Howell, Beryl A. Assign.? Date 8172017 i {Brie?y describe the property to be searched ASSOCIATED WITH THE APPLE ID i I Descriptioni Search and Seizure Warrant or idemy?ji the person by name and address) THAT is STORED AT PREMISES CONTROLLED BY APPLE, SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal iaw enforcement of?cer or an attorney for the government requests the search of the following person or property located in the District of . California {he person or describe the preperry to be searched and girls its locan'bn)! See Attachment A. i ?nd that the or any recorded testimony, establish probable cause to search and seiZe the person or property described abOVe, and that such search will reveai (identi?r the person or describe (be properly (a be seized}: See Attachment YOU ARE COMMANDED to execute this warrant on or before . . August 2:1. 2017 (not to exceed days) in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. . The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to 7 Hon. Beryi A. Howell ?(Unir??b? States Magi'srrare Judge) [3 Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate notification may have an adverse result listed in 18 USS. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property. will be searched or seized (check (he apprapriale box} for days (not to exceed 30) until, the facts justifying, the later speci?c date of Date andtime issued: @f 733 .. @yfj? m?g? . Jndge ?s signalure City and state: Washington, DC Hon. Beryl A. Howell, Chief US. District Judge 7: Primed name and Iii/er tee Case Document 43-6 Filed 03/19/19 Page 58 of 80 A0 93 (Rev. llt13) Search and Seizure Warrant (Page 2) Return base Noni Date and tinie warrant executed-:- Copy of 'warrantand inventory le?r'With: Inventory made in of Inventory of the property taken and name oteny person(s) seized: 'Eer?ti?eetie?n- Date: I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Executing o?icer's signature Printed name and title Case Document 43-6 Filed 03/19/19 Page 59 of 80 ATTACHMENT A. This warrant applies to information ?associated with the Apple ID that is stored at premises owned, maintained, controlled, or operated by Apple, Inc. (?Apple?), a company headquartered at 1 In?nite Loop, Cupertino, CA 95014. Case Document 43-6 Filed 03/19/19 Page 60 of 80 1. ATTACHMENT Information to be disclosed by Apple, Inc. To the extent that theinformation described in Attachment A is within the possession, custody, or control of Apple, lnc. (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside ofthe United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session timesand durations, the date on which the account was created, the length of service, the 1P address used to register the account, log-in lP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); The types of service utilized; All recordsior other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the 1P address used to register the account, log?in lP addresses associated with session times and dates, account status, alternative e-_mail addresses provided Case Document 43-6 Filed 03/19/19 Page 61 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; All records indicating the services available to subscribers of the accounts; h. All usernames associated with or sharing a login IP address or browser cookie with the accounts; i. All cookies, including third?party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identification Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital?Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities .. Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a financial institution), [8 U.S.C. 1344 (bank fraud), 18 U.S.C. 1956 (money laundering), 18 U.S.C. ?95 1? (acting as an unregistered foreign agent), and 22 U.S.C. 611 at seq. (Foreign Agents Registration Act), involving Michael Dean Cohen and occurring on or afterJanuary I, 2016, including, for each account or identifier listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 43-6 Filed 03/19/19 Page 62 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign?principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; I h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and i. The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 43-6 Filed 03/19/19 Page 63 of 80 Exhibit Case Document 43-6 Filed 03/19/19 Page 64 of 80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated With the Email Accounts @grnailcom, . _@gmail.com, and Maintained at Premises Controlled by Google, Inc., USAO Reference No. 201 SROO 127 SEARCH WARRANT AND ON-DISCLOSURE ORDER . TO: Goo gle, Inc. (?Provider?) United States Attorney?s Office for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -of the United States Attorney?s O?ce for the Southern District of New York, and pursuant to the? provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable cause to believe the email accounts -@gmail.com, -@grnail.com, and g. maintained at premises controlled by Google, Inc., contain evidence, fruits, and instrumentalities of crime, all as specified in Attachments A and hereto. Accordingly, . the Provider is hereby directed to provide to the Investigative Agencies, Within 7 days of the date of service of this Warrant and Order, the records specified in Section II of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider Within 7 days of the date of issuance. The Warrant and Order may be served via Case Document 43-6 Filed 03/19/19 Page 65 of 80 electronic transmission or any other means through which the Provider is capable of accepting service. a 2. Non~Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the eXistencepf scrib er ~orrtov any otherp'erson'vforap erio d7 of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice, 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon Which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 4? 1f 11.: a; SI my; I 4 fl" Sid-3Bate Issued Time Issued isomers Gasman Chiernited States'Magistra?Le Judge Southern District oi New York 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 66 of 80 4 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account _@gmail.com' (the ?Subject Account?) for the time period referenced below. Arlaw~enforcement~ email: or?another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section l1 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section 111 below. I II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: I a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header . information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book information. All address book, contact list, or similar information associated with the Subject Account. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 43-6 Filed 03/19/19 Page 67 of 80 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated and records of actions taken, limited to items sent, received, or created-between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history and/or web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, tiles, maintained on Google Drive,and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. Preserved or backup records. Any preserved or baclcup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 use. 2793(1) or otherwise. 111. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, .attomeys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?uits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 68 of 80 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (Wire fraud), and 1344 (bank fraud), including the following: a. Con?ununications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Account; I b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; I d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to'or from Essential Consultants or Michael D. Cohen Associates, e. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated With the Subject Account about any matters relating to Essential Consultants, LLC, . or about any plan or proposal oragreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _1Ild/ or entities associated with him; i f. Communications between the Subject Account and -relating to Michael D. Cohen?s bank accounts, taxes, debts, and] or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations .to a financial institution with relation to the intended purpose of an account or loan at that financial 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 69 of 80 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under mvestigation and to the account owner; and 1. b?v1dence indicating th?SnbjEtiAccount?owner?s intent as i?elatesvtovthevSubj'e?ctr" Offenses under investigation. IV. Re?ew Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect anyattorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ??orn the investigative team, in order to address potential privileges. 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 70 of 80 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 i Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s ossession, custod or control associated with the email accounts -gmail.com and?(the ?Subject Accounts?) for the time A law enforcement of?cer will serve this warrant by transmitting it Via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section Ii below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Email content. All emails sent to or from, stored in dra? form in, or otherwise associated with the Subject Accounts, sincluding all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone Case Document 43-6 Filed 03/19/19 Page 71 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, type-s of services utilized, means and source of payment, and payment history, d. Transactional records. All transactional records associated with the Subject Accounts, including any IP logs or other records ofsession times and durations. e. I Customer correspondence. A11 correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services f. Search History. All search history and/or web history associated with the Subject Accounts. g. Associated content. All Goo gle Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup re cords. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside te chnical, experts under government control). are authorized to review the records produced by the Provider in order to locate any evidence,fruits, and instrumentalities of violations of .1 8 US . C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire ?aud), and 1344 (bank including the following: a. Communications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 02.23.2013 Case Document 43-6' Filed 03/19/19 Page 72 of 80 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to and/or entities associated with him; A c. Cormnunications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who oreproposaleor agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to _and/ or entities associated d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that financial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 73 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 74 of 80 Exhibit Case Document 43-6 Filed 03/19/19 Page 75 of 80 is are res UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account maintained at Premises Controlled by 1 85 1 Internet, Inc., USAO Reference NoInternet, Inc. (?Provider?) United States Attorney?s O?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?), 1. Warrant. Upon an af?davit of Special Agents-of the United States Attorney?s Office for the Southern District of New York, and pursuantto the provisions of the Stored Communications Act, 18 U.S.C. and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account-?naintained at premises controlled by 1 85 1 Internet, Inc, contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto; Accordingly, the Provider is hereby directed to provide to the hlvestigative Agencies, Within 7 days. of the date of service of this Warrant and Order, the records speCi?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as . authorized in Sections and IV of Attachment D. The Government is required to serve a copy of this Warrant and Order on the Provider Within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document43-6 Filed 03/19/19 Page 76 of 80 2. Oil-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date. of this Order, subject to extension upon application to the Court if for the purpose of receiving legal adviCe. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the War-rant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure . obligations in any prosecutions related to this matter. Dated: New York, New York Date-Issued Time Issued United States 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 77 of 80 Email SearchAttachment I. Subject Account and Execution of Warrant This warrant is directed to 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087, and applies to all content and other information within the Provider? possession, custody, or control associated with the email account -- (the ?Subject Account?) for the time period between November 14, 2017 -. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement I officer an electronic copy of the information speci?ed in SectiOn 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To?the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account; 3.. Email content. All emails Sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment information. All subscriber ?and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 43-6 Filed 03/19/191 Page 78 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations. 6. Customer correspondence. All correspondence withthe subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services andrecords?ofa'cti'onstaken. f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation reuuest issued pursuant to 18 U.S.C. 2703(f) or otherwise. Ill Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under goverrnnent control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 USC. 371 (conspiracy to commit offense or to de?aud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other files'necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ??les' involving Sterling National Bank, 'Melrose Credit Union, and/or taxi medallions; I 0. Communications, records, documents, and other files involving a plan, proposal, or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 2 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 79 of 80 medallions, and any associated debts or liabilities, to others, including to -i'nd/ or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen 85 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. The identity of anylperson(s) including records that reveal the whereabouts of the Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him; 3 f. Communications between the Subject Account and -felating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with'relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 43-6 Filed 03/19/19 Page 80 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney~client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart fromthe investigative team, in order to address potential privileges. 02.28.2018