Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 1 of 39 AO 106 (Rev. 04/10) Application for ¡¡ Frl Frì Search Warrant UNrrr,o Srares Dtsrzucr Counr JUt I S æÍt for the Clcrkr.U.S. Dlstrlct tnd mnlfuptcy Gourts District of Columbia In the Matter of the Search of (Brieflv desc'ribe the properts, to he searched or identift the person by name and address) INFORMATION ASSOCIATED WITH THE EMAIL ACCOUNT @GMAIL.COM ) ) ) ) ) ) Case: 1;17-mj-00503 Assigned To . Howell, BerylA. Assign. Date : 711812017 Description: Search and Seizure Warrant APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement offtcer or an attonley for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following persorì or property (denttþ rhe person or describe the property to be searched and give its location): See Attachment A. located in the District Northern of , there is now concealed 1den¡rtt California the person or describe the propert¡, to be sei=ed): See Attachment B. This warrant is sought pursuant to 18 U.S.C. S$ 2703(a), 2703(bX1XA), and 2703(cX1XA). The basis for the search under Fed, R. Crim. P. 4l(c) is þheckone or nrore)i úevidence of a crime; dcontraband, fruits of crime, or other items illegally possessed; dproperty designed for use, irrtended for use, or used in committing Û a person to be arrested or a person who is unlawfully restrained. a crime; The search is related to a violation of: Oj/bnse Description Code Seclion 18 U.S.C. S 951; 18 U.S.C. S Acting as a foreign agent without notice to the Attorney General; 1014 False Statements to a financial institution The application is based on these facts: See attached Affidavit. f, ü Continued on the attached sheet. Delayed notice of days (give exact ending date if more than 30 days: under l8 U.S.C. $ 3 103a, the basis of which is set forth on the attached sheet. --- ) is requested -- Reviewed by AUSA/SAUSA: ignalure SpecialAgent, FBI Prinled nane and title Sworn to before nre and signed in my presence. Date: 07t18t2017 ¿*¿ Judge's signature City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge Printed name and title Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 2 of 39 FTLED JUL I S ã¡ft IN THE UNIT'ED STA'I-ES DIS" RICT COURl' FOR THE DISTRICT OF COLUMBIA IN THE MATTER OF TI-IE SEARCH OF INFORMATION ASSOCIATED WITH THE EMAIL ACCOUNT GM Ar L.COM Clerk, U.S. Dl¡trlct and Bonkruptcy Courts Case: 1:17-mj-00503 Assigned To : Howell, BerylA. Assign. Date : Tl1Bl2O1T Description: Search and Seizure Warrant AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEARCH WARRANT being fìrst duly sworn, hereby depose and state as follows:. I, INTRODUCTION AND AGENT BACKGROUND L I make this affidavit in support of an application for a search warrant for infor¡nation associated with the email address provided for the Google Mail ("Gmail") Account gmail.com (hereinafter the "Target Account"), that is stored at premises owned, maintained, controlled, or operated by Google, an email provider headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043 (hereinafter "Google"). The information to be searched is described in the following paragraphs and in Attachment A. This affidavit is made in support of an application for a search warrant under l8 U.S.C. $$ 2703(a), 2703(bXlXA) and 2703(c)(l)(A) to require Google to disclose to the government copies of the information (including the content of communications) further described in Attachment information described in Attachment A, A. Upon receipt government-authorized persons information to locate the items described in Attachment B. will of the review that Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 3 of 39 3. The facts in this affidavit come from my personal observations, my training and experience, and information obtained from other agents and witnesses. This affidavit is intended to show merely that there is sufficient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 4. Based on my training and experience and the fbcts as set fbrth in this affidavit, there is probable cause to believe that MICI-IAEL DEAN COHEN has committed violations of l8 U.S.C. $ l0l4 as well as (false statements to a fìnancial institution), l8 U.S.C. l8 U.S.C.$ 951 (acting as an unregistered foreign Registration Act ("FARA"),22 U.S.C. $ {) 1956 (money laundering), agent) and the Foreign Agents 6l I el seq. There is also probable cause to search the information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities of these crimes, further described in Attachment B. JURISDICTION 5. This Court has jurisdiction to issue the requested warrant because it is "a court of competent jurisdiction" as defined (c)(l)(A). Specifically, by l8 U,S.C. ç 2711. Id. $$ 2703(a), (bXlXA), & the Court is "a district court of the United States (including a magistrate judge of such a court) . . . that has jurisdiction over the offense being investigated." l8 U.S.C. {i 27r r(3XAXi). PROBABLE CAUSE 6. As described below, the FBI is investigating COHEN in connection with, inler alia, statements he made to a known financial institution (hereinafter "Bank 2 l") in the course of opening Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 4 of 39 a bank account held in the name of Essential Consultants, LLC and controlled by COHEN. The F'Bl is also investigating COHEN in connection with funds he received from entities controlled by foreign governments and/or foreign principals, and the activities he engaged in the United States on their behalf without properly disclosing such relationships to the United States government, A. 7. Michael Cohen According to press reports and bank records collected during the investigation, COHEN served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings formerly controlled by President Donald Trump prior to his presidency. Until approximately January 2017, COHEN was reported to have held various positions within the Trump Orgarrization. During an interview withThe Wall Street Journal in or around January 2017, COHEN described his role as being "the fìx-it guy . . . . Anything that [then-President-elect Trumpl needs to be done, any issues that concern him, I handle."l 8. In or around January 2017,COHEN made public statements that he would resign from the Trump Organization to serve as the personal attorney for President Trurnp (serving as an attorney to the President in his personal capacity, as opposed to as a member of the White l{ouse Counsel's Office). COHEN recently has identifìed himself publicly-including on his personal Twitter account-as a personal attorney for the President. 9, As described in more detail below, on or about March 23,2017, COHEN submitted paperwork to Bank l, with whom he had a prior banking relationship and several existing accounts, for the purpose of opening a nelv account. In the section for customers to provide contact information, COHEN, by hand, struck out a previously provided e-mail address and in its place I "lntelligence Dossier Puts Longtime Trurnp Fixer in Spotlight," Wall Street,lournal, Jan. 2017 J ll, Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 5 of 39 wrote the Target Account as his current e-mail address. B. 10. Essential Consultants, LLC In or around June 2017, federal agents reviewed information supplied by Bank based olr activity that Bank I had observed from a number of accounts related to COHEN. According to information provided by Bank June 201 I I l, COHEN has been â customer since approximately and controls several checking and loan accounts, some in his personal name and others in the names of corporate entities. Agents have subsequently reviewed documents and records provided by Bank ll. I related to COHEN and these various accounts. Accordirrg to information provided by Bank l, on or about October 26,2016, COHEN opened a new checking account in the name of Essential Consultants, LLC ("Essential Consultants"); COHEN was the only authorized signatory on the account. Corporate rccords show that Essential Consultants is a Delaware entity formed by COHEN on or about October 17,2016. 12. According to Bank l, when COHEN opened the Essential Consultants account, he represented during the course of Bank I's know your customer ("KYC") procedures that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work. COHEN further represented that he intended to use his experience in real estate to consult on commercial and residential real estate deals, and that his typical clients were expected to be high net-worth domestic individuals. COHEN also represented that his purpose in setting up this account was to keep the revenue from his consulting-which he said was not his main source of income-separate from his personal fìnances. 4 Case Document 12 Filed 05/22/19 Page 6'of 39 Case Document 12 Filed 05/22/19 Page 7 of 39 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 8 of 39 D. Foreign Transactions in the Essential Consultants Account with a Russian Nexus 19. According to information provided by Bank I , in or around October 2016, COHËN represented that he expected f'urrds deposited into the Essential Consultants account would constitute inco¡ne from COHEN's consulting work and that COHEN's consulting clients were expected to be domestic (that is, within the United States). COHEN also represented tlrat he expected his clients to be U.S.-based, high-net worth individuals. 20. However, records frorn Bank I show substantial transactional activity that appears to be inconsistent with COHEN's KYC representations. Bank I records shows that the account received numerous deposits f'rom fbreign businesses and entities that do not reflect the stated client profile for the residential and commercial real-estate consulting services osterrsibly being provided by Essential Consultants. Moreover, public records, media reports, and other publicly available sources indicate that some of these companies have significant ties to foreign governments or are entities controlled by f'oreign governments. 21. A search in or around July 2017 of the U.S. Departrnent of Justice agents currently database of all or previously registered under the Foreign Agent Registration Act ("FARA") confirmed that neither COHEN nor Essential Consultants is or has been a registered agent of a foreign government.6 All FARA registration is handled by the U.S. Department of Justice's National Security Division in Washington, D.C. 6 The database is publicly available at https://www.fara.gov/ 7 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 9 of 39 i. 22. Deposits b), Columbus Nova" LLC According to records obtained from Bank I through June I ,2017, in the first fìve months of 2017, the Essential Consultants bank account received five deposits, each in the amount of $83,333 (for a running totalof $416,665). The funds for allfive deposits-four of which were wire transfers and one by check-came from an account at another bank held in the name of Columbus Nova, LLC. 23. Public,records show that Columbus Nova, LLC is an investment management firm controlled by Renova Group ("Renova"), an industrial holding company based in Zurich, Switzerland. According to public news accounts, Renova is controlled by Viktor Vekselberg, a wealthy Russian national. Public news accounts also report that Vekselberg is an oligarch with various connections to Russian President Vladimir Putin and publicly met with Putin as recently as in or around March 2017.7 According to the news articles, Vekselberg and Renova cunentty are involved in various infrastructure projects in Russia, such as the building of an airport in Rostov in advance of the 2018 FIFA World Cup, which is to be held in Russia. Vekselberg has been involved in various symbolic acts seen to be in the Russian national interest, such as the purchase and repatriation of historic Faberge eggs.8 ii. 24. 7 I Plan to Lift Russian Sanctions On orabout February 19,2017,The New YorkTimes published an article reporting See, e.g., "Russiats Putin Meets Tycoon Vekselberg," Reulers,Mar. 14,2017. On or about September 5, 2016, media outtets repofted that Russian authorities arrested two of Vekselberg's closest associates in connection with allegations that a subsidiary had paid over Sl2 million in bribes to Russian government officials. Some media accounts speculated that the arrest of Vekselberg's associates, as well as the commensurate searches of Renova's head office, were intended as a warning from the Russian government that it wanted some form of cooperation or value from Vekselberg See, e.g., "Another Billionaire Incurs Putin's Wrath," Bloomberg, Sept. 6, 20t6. I Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 10 of 39 that COHEN had been involved in distributing a proposed plan to the then-National Security Adviser, Michael T. Flynn, for the United States to lift sanctions on Russia as part of a negotiated end to the hostilities in Ukraine. The tenns of the proposal appear to have been favorable to the Russians, according to The New York Times article.e 25. According to the article, prior to meeting with Flynn, COHEN had been approached by a Ukrainian politician ("Person 2") and a Russian-American businessman ("Person 3") who had prior business dealings with COHEN and the Trump Organization. According to the news report, Person 3 had previously been responsible for scouting deals in Russia fcir the Trump Organization through his company. According to the news reporting, COHEN met personally with both Person 2 and Person 3 about the proposal; during the meeting with Person 3, COHEN received the written plan in a sealed envelope. 26, According to The New YorkTimes, COI{EN has confirmed that he met with Person 2 and Person 3 and received the plan in a sealed envelope. In or around February 2017, COHEN then traveled to the White House and met the President in the Oval Office (the subject of the meeting is unclear). According to COHEN, during that trip, he left the proposal in the office occupied by then-National Security Adviser Flynn. According to The New York Times, COHEN stated that he was waiting for a response at the time that Flynn was forced from his post as the National Security Adviser. 27. The United States continues to investigate if any of the payments _or financial relationships described above, or other relationships described further below, were connected to COHEN's involvement in the distribution of a plan to lift Russian sanctions. e "A Back-Channel Plan for Ukraine and Russia, Courtesy of T'rump Associates," Neu, York Times, Feb. 19,2017. 9 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 11 of 39 E. Other Foreign Transactions in the Essential Consultants Account i. 28. Deposits by Korea Aerospace Industries Ltd. According to Bank l, on or about May 10,2017 and June g,20l7,the Essential Consultants bank account received two deposits in the amount $150,000 (totaling $300,000 between the two deposits) from a bank account in Seoul, South Korea. According to documents obtained from Bank l, the account holder from which the money was sent is Korea Aerospace ("KAI"). According to its public website, KAI Industries Ltd. is a South Korea-based company that produces and sells fìxed-wing aircraft, helicopter aircraft, and satellites. Public news accounts report that KAI has partnered with Lockheed Martin to bid later this year on a$I6 billion U.S. Air Force T-X Trainer Jet Replacement Program. 29. According to publicly available materials and press accounts, as well as the company's financial disclosures, the Republic of Korea (South Korea) government has significant ties to KAI. KAI itself was formed in 1999 as part of a governr¡ent-led effort to consolidate South Korea's aerospace industry manufacturers into a new sirrgle entity. KAI holds the exclusive rights for all of the government's military logistics and aerospace projects.l0 The South Korean government, through the Korea Development Bank, is the largest shareholder largest debt holder.ll According to information provided by Bank l, transfer of funds from KAI indicated that the purpose of these payments ii. 30. in KAI and its messages related to the was "consulting services." Wire Transfers from a Kazakhstani Bank According to Bank 1, on or about May 22,2017, the Essential Consultants bank f0 e.g., Andrew Tylecote & Francesca Visintin, Corporale Governance, Finance and the ^See, Technological Advantage of Nations (2008), at 165-66; International Business Publications, Korea South: A "Spy" Guide (2016), af 229-31. rl KAI, Annual Report 2014, available at https://www.koreaaero.com/upload_images/new_pdf/ I 4.pdfì annual/PDF/Annual_report_eng_2O r0 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 12 of 39 account at Bank I received a $ 150,000 Kazakhstan. According to Bank l, deposit from an account at Kazkommertsbank, a bank in the listed account holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, AO. Bank I reported that a message accompanying the wire payment indicated that the agreement was a "monthly corrsulting fee as per lnv BTA-101 DD May 10, 201 7 consulting agreement 3l . Wn{ DD 08 05 201 7 CNTR W/I\DD 0810512017 ." According to press reports, BTA Bank has been rnired in a multi-billion dollar fraud that implicates its former top executives. According to a Forbes article published in or around February 2017, for example, BTA Bank's auditors PricewaterhouseCoopers previously identified a $10 billion discrepancy on the bank's balance sheets.l2 Subsequent investigation by forensic accountants revealed that a unit of BTA had been used to issue billions of dollars' worth of credit for property development and other deals in Russia, Ukraine, and Belarus. The investigation also indicated that funds illicitly had been re¡noved from the bank through shell companies set up irr the names of executives' family members. iii. 32, Bank I Wire'Iransfers from Novartis Investments. SARL also repofted that on or about April 15,2017 and May 15,2017. the Essential Consultants account at Bank I received deposits in the amount of $99,800 (totaling $199,600) from a Swiss bank account held in the name of Novartis Investments, SARL. Novartis Investments, SARL is the in-house financial subsidiary of the Swiss pharmaceutical company Novartis AG. F. r2 Bo and Abe r'How To Get Back A Lost $ Realty,LLC l0B: One Bank's Tale in Europe's Biggest Alleged Fraud." Forbes, Feb,6,2017. lt Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 13 of 39 Records show that the ultimate source of funds used to repay the HELOC funds came from a different company associated with COI-IEN, operating under the name Bo and Abe Realty, LLC ("Bo and Abe Realty"). 35. According to records of incorporation obtained from the New York Department of State, Division of Corporations, Bo and Abe Realty LLC was incorporated on or about luly 29, 2013. Documents show that the organizer was Michael Cohen and the associated business address New York, NY 10022. No other was COHEN's residentialaddress af 502 Park Avenue, agents or addresses were listed on the incorporating paperwork. 36. On or about.luly 31,2013, Bank I records show that COHEN signed account opening documentation in order to open a bank account in the name of Bo and Abe Realty. In the documentation, COHEN identified himself as the President of Bo and Abe Realty; the opening documentation described the purpose of the business as the "purchase of real estate." The account opening documentation also listed two other signatories on the account; COHEN's brother ("Person 4"), and Person 4's mother-in-law ("Person 5"). Both Person 4 and Person 5 were identifìed l2 as Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 14 of 39 l4 "members" of the company. G. 39. Use of the Target Account On or about MarchZl,20l7, an employee f'rom Bank I sent an email to an email address associated with the Trump Organization that had in the past been used by records obtained from Bank address I COHEN. Bank show that the employee received an automatic reply from the email with the following message: "Effective January 20, 2017, I have accepted the role as to President Donald J. Trump. All future emails should be directed to personal counsel la A sizeable portion of the funds deposited into the Bo and Abe Realty account came from an account in Person 5's name. A review of documents provided by Bank I as well as information provided by other financial institutions indicate that both Person 4 and Person 5 are involved in and receive significant funds through a different entity operating under the name Ukrethanol, LLC ("Ukrethanol"). Ukrethanol has been involved in a series of suspicious transactions and has been suspected of possible money laundering or structuring. For example, in or around June 2013, Bank 3 closed a business account held in the name of Ukrethanoland exited its relationship with the company as a result of suspicious activity in the business account. The government continues to investigate the source of the Ukrethanol funds and the ultimate disposition of these monies. r3 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 15 of 39 mdcohen2l2@gmai[.com [the Target Account] and all future calls should be directed should be directed to 646-853-0 4A. 1 1." On or about March 23,2017, COHEN submitted new paperwork to Bank I in order to open another account (this one in the name of a newly incorporated entity with the name "Michael D. Cohen & Associates P.C."). In the section for customers to provide contact information, COHEN by hand struck out a previously provided e-mail address affiliated with the Trump Organization. In its place, COHEN wrote the Target Account as his e-mail address for contact purposes. 41. On or about April 6, 2A17, COHEN, using the Target Account, emailed employee at Bank I an about a pending wire to the Essential Consultants account. COHEN attached images of another conversation with another person who asked COHEN to confirm the routing numbers to his bank account. BACKGROUND CONCERNING GOOGLE MAIL 42. Irr my training and experience, I have learned that Google provides a variety of on- line services, including electronic mail ("email") access, to the public. Google allows subscribers to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers obtain an account by registering with Google Mail. During the registration process, Google Mail asks subscribers to provide basic personal inforrnation. Therefore, the computers of Google are likely to contain stored electronic communications (including retrieved and unretrieved email for Google Mail subscribers and information concerning subscribers and their use of Google Mail services, such as account access information, email transaction information, and account application information. In my training and experience, such infonnation may constitute evidence l4 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 16 of 39 of the crimes under investigation because the information can be used to identify the account's user or users. 43. In rny training and experience, email providers generally ask their subscribers to provide certain personal identifying inf'ormation when registering for an email account. Such information can include the subscriber's full name, physical address, telephone numbers and other identifiers, alternative email addresses, and, for paying subscribers, means and source of payment (including any credit or bank account number). In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account's user or users. Based on my training and my experience, I know that, even if subscribers inseft false information to conceal their identity, this information often provides clues to their identity, location, or 44. illicit activities. In my training and experience, email providers typically retain certain tansactional information about the creation and use of each account on their systems. This information can include the date on which the account was created, the length of service, records of log-in (i.e., session) times and durations, the types of service utilized, the status of the accou¡rt (including whether the account is inactive or closed), the methods used to connect to the account (such as logging into the account via the provider's website), and other log files that reflect usage of the account. In addition, email providers often have records of the Internet Protocol address ("lP address") used to register the account and the IP addresses associated with particular logins to the account. Because every device that connects to the Internet must use an IP address, IP address information can help to identify which computers or other devices were used to access the email account. l5 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 17 of 39 45. In my training and experience, in some cases, email account users will communicate directly with an email service provider about issues relating to the account, such as technical problems, billing inquiries, or complaints from other users, Email providers typically retain records about such communications, including records of contacts between the user and the provider's support services, as well as records of any actions taken by the provider or user as a result of the communications. In my training and experience, such information may constitute evidence of the crimes under investigation because the information can be used to identify the account's user or users. 46. This application seeks a warrant to search all responsive records and information under the control of Google, a provider subject to the jurisdiction of this court, regardless of where Google has chosen to store such information. The government intends to require the disclosure pursuant to the requested warrant of the contents of wire or electronic communications and any records or other information pertaining to the customers or subscribers if such communication, record, or other information is within Coogle's possession, custody, or control, regardless of whether such communication, record, or other information is storedo held, or maintained outside the United States. 47. l5 As explained herein, information stored in connection with an email account may provide crucial evidence of the "who, what, why, when, where, and how" of the criminal conduct l5 lt is possible that Google stores some portion of the infonnation sought outside of the United States. lnMicrosoftCorp.v.UnitedStates,20l6WL3TTA056(ZndCir.20l6),theSecondCircuit held that the government cannot enforce a warrant under the Stored Communications Act to require a provider to disclose records in its custody and control that are stored outside the United States. As the Second Circuit decision is not binding on this court, I respectfully request that this warrant apply to all responsive information-including data stored outside the United Statespertairring to the identified account that is in the possession, custody, or control of Google. The government also seeks the disclosr¡re of the physical location or locations where the information is stored. t6 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 18 of 39 under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion. In my training and experience, the information stored in connection with an email account can indicate who has used or controlled the account. This "user attribution" evidence is analogous to the search fbr "indicia of occupancy" while executing a search warrant at a residence. For example, email communications, contacts lists, and images sent (and the data associated with the foregoing, such as date and time) may indicate who used or controlled the account at a relevant time. Further, information maintained by the email provider can show how and when the account was accessed or used. For example, as described below, email providers typically log the Internet Protocol (lP) addresses from which users access the email account, along physical location associated íith with the tirne and date of that access. By determining the the logged lP addresses, investigators can understand the clrronological and geographic context of the email account access and use relating to the crime under investigation. 'l"his geographic and timeline infor¡nation may tend to either inculpate or exculpate the account owner. Additionally, information stored at the user's acçount may further indicate the geographic location of the account user at a particular time (e.g., location information integrated into an image or video sent via email), Last, stored electronic data may provide relevant insight into the email account owner's state of mind as it relates to the offense under investigation. For example, information in the email account may indicate the owner's motive and intent to commit a crime (e.g., communications relating to the crime), or consciousness of guilt (e.g., deleting communications in an effort to conceal them from law enforcement). l7 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 19 of 39 PRESERVATION OF THE TARG.ET AqCOUNT 48. pursuant to On or about June 21,2A17, the Federal Bureau of Investigation sent a request, l8 u.s.c. $ 2703(Ð, to Google, requesting that Google preserve all content associated with the Target Account. FILTER REVIEW PROCEDURES 49. Review of the items described in Attachment A and Attachment B will be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and o'filter team," separate and other operative privileges. The procedures include use of a designated apaft from the investigative team, in order to address potential privileges. lRemainder af this page left intentionally blankl l8 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 20 of 39 coNcLUsroN 50. Based on the forgoing, I request that the Court issue the proposed search warrant. REOUEST FOR SEALING 5l. I further request that the Court order that all papers in support of this application, including the application, affidavit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to allof the targets of the investigation. Accordingly, there is good cause to sealthese documents because their premature disclosure may give targets an opportunity to flee/continue flight frorn prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates, or otherwise seriously jeopardize the investigation. Respectfu lly submitted, SpecialAgent Federal Bureau of Investigation Subscribed and sworn to before me on thisi{ffiof July,2017. rlnozr- /fue The Honorable BerylA. Howell Chief United States District Judge t9 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 21 of 39 ATTACHMENT A This warrant applies to information associated with the Google Mail Account @gmail.com that is stored at premises owned, maintained, conholled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 20 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 22 of 39 ATTACHMENT B I. Information to be disclosed by Google To the extent that the infbrmation described in Attachment A is within the possession, custody, or control of the Google (hereinafler "the Provider"), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following informatio¡r to the government for each account or identifier listed in Attachment A: a. The contents of all emails associated with the account, includirig storcd or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and tirne at which each emailwas sent, and the size and length of each email; b. All records or other information regarding the identifìcation of the account, to include full name, physical address, telephone nurnbers and other identifiers, records o1'session ti¡nes and durations, the date on which the account was created, the length ofservice, the IP address used to register the account, log=in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); c. d. The types of service utilized; AII records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and files; e. All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided 2t Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 23 of 39 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. g. h. All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; i. j. All cookies, including third-party cookies, associated with All the user; records that are associated with the machine cookies associated with the user; and k. All telephone or instrument numbers associated with addresses, Electronic Serial Numbers Numbers the Account (including MAC ("ESN"), Mobile Electronic Identity ("MEIN"), Mobile Equipment ldentifier ("MEID"), Mobile ldentification Numbers ("MIN"), Subscriber ldentity Modules ("SIM"), Mobile Subscriber lntegrated Services Digital Network Number ("MSISDN"), International Mobile Subscriber Identifiers ("lMSI"), or International Mobile Equipment ldentities (*lMEI"). il. Information to be Seized by the Government All information described and/or instrumentalities above in Section I that constitutes evidence, contraband, fruits, of violations of l8 U.S.C. $ l0l4 (false statements to a financial institution) and l8 U.S.C. $ 195ó (money laundering), as well as l8 U.S.C. {) 951 (acting as an unregistered foreigrr agent) and the Foreign Agents Registration Act ("FARA"), 22 U.S.C. $ 6l I et seE., involving Michael Dean Cohen and occurring on or afterJanuary 1,2016, including, for each account or identifier listed on Attachment a. A, information pertaining to the following matters: Communications, records, documents, and other files involving Essential Consultants, LLC; b. Communications, records, documents, and other files involving Bo and Abe Realty, LLC; c. Communications, records, documents, and other files that false representations to a financial institution with relation to intended the purpose of an account or loan at that financial institution; the nature of any business or entity associated with an 22 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 24 of 39 account a financial institution; the source of funds flowing into an account; or the purpose or nature of any financial transactions involving that financial institution; d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other files that reveal efforts by Michael Dean Cohen to conduct activities on behalf of for the benefit of, or at the direction of any foreign government, foreign ofÍicials, foreign entities, foreign persons, or foreign principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context ofaccount access, use, and events relating to the crimes under investigation and to the account owner; (l Evidence indicating the account owner's state of mind as it relates to the crimes under investigation; h The identity of the person(s) who created or used the account, including records that help reveal the whereabouts ofsuch person(s); and The identity of any person(sþ-including records that help reveal the whereabouts of the person(s)-who communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of for the benefit of, or at the direction of any foreign govemment, foreign officials, foreign entities, foreign persons, or foreign principals. 23 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 25 of 39 CERTIFICATE OF AUTHENTICITY OF DOMESTIC BUSINESS RECORDS PURSUANT TO FEDERAL RULE OF EVIDENCE 902(11) [, o attest, under penalties of perjury under the laws of the United States of America pursuant to 28 U.S.C . ç 1746, that the information contained in this declaration is true and correct. I am employed by Google, and my official title is.IamacustodianofrecordsforGoogle.Istatethateach of the records attached hereto is the original record or a true duplicate of the original record in the custody of Google and that I am the custodian of the attached records consisting of (pages/CDs/kilobytes). I further state that: a. all records attached to this certificate were made at or near the time of the occurence of the matter set forth, by, or from information transmitted by, a person with knowledge of those matters; b. such records were kept in the ordinary course of a regularly conducted business activity of Google; and c. such records were made by Google as a regular practice. I further state that this certifTcation is intended to satisfy Rule 902(11) of the Federal Rules of Evidence. Date Signature 24 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 26 of 39 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA Case: 1:17-mj-00503 Ãu.iãn"O To : Howell, BerylA' Ássiõn. Date : 7t1812O17 Warrant rjãtËi'pitn: Search and Seizure IN THE MATTER OF THE SEARCH OF INFORMATION ASSOCIATED WITH THE EMAIL ACCOI.INT :GMATL.COM MOTION TO SEAL WARRANT 4.ND.RELATED DOCUMENTS AND TO REOUIRE NOlr-DrS CLOS*URE r.rNpFR_l I U. S. C. $. 2705 &) The United States of America, moving by and through its undersigned counsel, respectfully moves the Court for an Order placing the above-captioned warrant and the application and affÏdavit in support thereof (collectively herein the'oWarrant") under seal, and precluding the provider from notifying any person of the Warrant pursuant to 18 U.S.C. $ 2705(b). In regard to the non- disclosure, the proposed Order would direct Google, an electronic communication and/or remote computing services provider headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, not to notify any other person (except attorneys for Google for the purpose of receiving legal aclvice) of the existence or content of the Warrant for a period of one year or until further order of the Court. 1. The Court has the inherent power to seal court filings when appropriate, including the Waruant. Uniîed States v. Hubbard,650 F.2d 293,315-16 (D.C. Cir. 1980) (citing Nixon v. Vlarner Communications, lnc.,435 U.S. 589, 598 (1978)). The Court may also seal the Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of the Wan ant . See lAashington PosÍ v. Robínson,935 Y .2d 282,287 -89 (D,C. Cir. 1991). Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 27 of 39 2. In addition, this Coun has jurisdiction to issue the requested order because it is "a court of competent jurisdiction" as defined by l8 U.S.C. ç 2711. Specifically, the Court is a o'district court of the United States . . . that jurisdiction over the offense being investigated." * has 18 U.S.C. $2711(3XAXÐ. As discussed fully below, acts or omissions in furtherance of the offense under investigation occurred within Washington, D.C. Søe 3. l8 U.S.C. ç 3237. Further, the Court has authority to require non-disclosure of the Warrant under 18 U.S.C. $ 2705(b). Google provides an q'electronic communications service," as defined in l8 U.S.C. $ 2510(15), and/or "remote computing service," as defined in l8 U.S.C .5 27li(2). The Stored Communications Act ("SCA"), l8 U.S.C. çç2701-2712, governs how Google may be compelled to supply communications and other records using a subpoena, court order, or search wanant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic "subscriber information" using a subpoena, Section 2703(d) allows the Government to obtain other "non-content" information using a court order, and Section 2703(a)-(bXlXA) allows the Government to obtain contents of communications using a search warrant. 4. ^See 18 U.S.C. ç 2703. The SCA does not set forth any obligation for providers to notify subscribers about subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such notification. In relevant part, Section 2705(b) provides as follows:l (b) Preclusion of notice to subject of governmental access. entity acting under section 2703 A governmental .. . may apply to a court for an-order commanding a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or courl order is directed, fbr such period as the court I Section 2705(b) contains additional requircments for legal process obtained pursuant to 18 U.S.C. $ 2703(bXl)(B), but the Government does not seel< to use the proposed Order for any legal process under that provision. 2 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 28 of 39 deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order. The court shall enter such an order if it determines that there is reason to believe that notification of the existence of the warant, subpoena, in- or court order will result (1) endangering the life or physical safety of an individual; (2) flight from prosecution; (3) destruction of or tampering with evidence; (4) intimidation of potential witnesses; or (5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 18 U.S.C. $ 2705(b). The United States District Court for the District of Columbia has made clear that a nondisclosure order under Section 2705(b) must be issued once the Govemment makes the requisite showing about potential consequences of notification: The explicit terms of section 2705(b) make clear that if a courts [szc] finds thatthere is reason to believe that notifying the customer or subscriber of the court order or subpoena may lead to one of the deleterious outcomes listed under $ 2705(b), the court must enter an order commanding a service provider to delay notice to a customer for a period of ti,me that the court determines is appropriate. Once the government makes the required showing under $ 2705(b), the court is required to issue the non-disclosure order. In re Application for Order of Nondisclosure Pursuant to 18 Subpoena #GJ2014031422765,41 F. Supp. 3d 5. l, 5 (D.D.C. U.S.C. S 2705(b) þr Grand Jury 2014). Accordingly, this motion to seal sets forth facts showing reasonable grounds to command Google not to notify any other person (except attorneys for Google for the purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until further order of the Court. 6. At the present time, larv investigation into violations related to 1 I enforcement officers U.S.C. $ of the FBI are conducting 10 14 (false statements to a an financial institution), 18U.S.C.$ 1956(moneylaundering),aswellas18U.S.C.$951(actingasanunregisteredforeign agent) and the Foreign Agents Registration Act ('FARA"), 22 U.S.C. J $ 611 et seq. arising out of Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 29 of 39 the conductof Michael D. Cohen. It does not appearthat Cohen is currently aware of the nature and scope of the ongoing FBI investigation into him. REOUEgI FOR SEATTING ,{}rD NON-DTSCLOSURE 7 . In this møtter, the government requests that the Warrant be sealed until further order of the Court and that Google and its employees be directed not to notify any other person of the existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal advice) for a period ofone year or until further order ofthe Court. Such an order is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither public nor known to the targets of the investigation, and its disclosure mây alert these targets to the ongoing investigation and its scope. Once alerted to this investigation, potential targets would be immediately prompted to destroy or conceal incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid future prosecution. In particular, given that they are known to use electronic communication and remote computing services, the potential target could quickly and easily clestroy or encrypt digital evidence relating to their criminal activity. 8. Given the complex and sensitive nature of the crirninal activity under investigation, and also given that the criminal scheme may be ongoing, the Govemment.anticipates that this confidential investigation will continue for the next year or longer. However, should círcumstances change such that couft-ordered nondisclosure under Section 2705(b) becomes no longer needed, the Government will notífy the Court and seek appropriate relief. 9. Warrant There is, therefore, reason to believe thàt notification of the existence of the will seriously jeopardize the investigation, including by giving the targets an opportunity to flee from prosecution, destroy or tamper with eviden ce, and intimidate witnesses, See 18 U.S.C. 4 Case 1:19-mc-00044-BAH Document 12 Filed 05/22/19 Page 30 of 39 $ 2705(bX2)-(5). Because of such potential jeopardy to the investigation, there also exists a compelling governmental interest in confidentiality to justify the government's sealing request. See Robínson, 935 F .2d at 287 -89. 10. Based on prior dealings with Google the United States is aware that, absent a court order under Section 2705(b) commanding Google not to notiff anyone about a legal request, it is Google's policy and practice, upon receipt of a warrant seeking the contents of electronically stored wire or electronic communications for a certain account, to notify the subscriber or customer of the existence of the warrant prior to producing the material sought. WHEREFORE, for all the fbregoing reasons, the government respectfully requests thatthe above-captioned wanant, the application and affidavit in support thereof, and all attachments thereto and other related materials be placed under seal, and furthermore, that the Court command Google not to notify any other person of the existence or contents of the above-captioned warant (except attorneys for Google for the purpose of receiving legal advice) for a period of one year or until fuither order of the Court. Respectfully submitted ROBERT Special Dated 4/ft/zc'v 5 S ilI Case Document 12 Filed.05/22/19 Page 31 Of 39 A0 93 (Rev. 11/13) Search and Seizure Warrant I JUL 2.1 201? UNITED STATES DISTRICT COURT Clark, 5 Dist - ?at 3 for the Bl?kl'uptcy coumnd District of Columbia In the Matter of the Search of ._00503 (Brie?y describe the property to be searched 1 '1 7' Beryl or identi?) the person by name and address) TO . 1 INFORMATION ASSOCIATED WITH THE EMAIL A8990. pate - 7 and Seizure Warrant ACCOUNT Descriptlon. Seam . . SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the ?orthe? District of California (identi?l the person or describe the property to be searched and give its location): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search Will reveal (identi?l the person or describe the property to be seized): See Attachment B. YOU ARE COMMANDED to execute this warrant on or before 1. 2017 (not to exceed 14 days) in the daytime 6:00 am. to 10:00 pm. CI at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hon. Beryi A. Howell (United States Magistrate Judge) Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) CI for days (not to exceed 30) El until, the facts justifying, the later speci?c date of Date and time issued: 7/429] Zz?i'i 450,441 . Judge?1s signature Hon. BerylA. Howell, Chief US. District Judge Fri?'rEed naine andtitie City and state: W?5hingtoni DC Case Document 12 Filed 05/22/19 Page 32 of 39 A0 93 (Rev I l/l3) Search and Seizure Warrant (Page 2) Return Case N0.: Date and [in warrant executed: Copy of warrant and inventory left with: 7/19 2017 0006314; Lege/ Iamvfje?-sgwa?J Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Orng?al Has: Mike ?5006?? ?room, 201707144 A ltf?c 01C ?act. Ugly?; -For? Produce?AM FILED JUL 21 2017 Clark, u.s. District an Bankruptcy Courts Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. Date: 7/79/9290 Primed name and title Case Document 12 Filed 05/22/19 Page 33 of 39 Attachment A: Hgs_h Values for Production Files [Google Ref. No. 1150069) Preserved .txt: MD5- SHA512- 5f8 MD5- SHA512- df MD5- 5061 a4e43e73f026898d8a5ff8b0eea1 SHA512- b4 mdcohen212.Drive.Metadata.zip: 431 db7ff8fe79236571f8005f4007273 406 mdcohen212.Drive_001.zip: MD5- SHA512- fb7 mdcohen212.Gmail.Contacts.vcf: MD5- a5d644bde145431dd9599e20f2671 1 d1 df18feaZcOSa3e9f675fBab7f401 1501 57 3141 Case Document 12 Filed 05/22/19 Page 34 of 39 MD5- SHA512- a2 mdcohen212.Photos.Albums.zip: MD5- SHA51 2- 562f95 9f36 b66df0580a94f38405fc1 a3925f062d7b68f21 758 b86581 71 32 mdcohen21 2. Photos. Preservedzip: D5- SHA512- 06d260f4566f7 ch a2 mdcohen212.Photos.zip: MD5- SHA512- 035 mdcohen212.Search.txt: Cb2661 1777b8b1f2f3049336625f74af SHA512- 188d9d2036dd683633363635 cOd MD5- SHA512- 056 Case Document 12 Filed 05/22/19 Page 35 of 39 MD5- 5658e050ee7ccfa3a7fbf71 10755e032 SHA512- d195fbf672310e43e47fed96d60271 Case Document 12 Filed 05/22/19 Page 36 of 39 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmail.eom that is stored at premises owned, maintained, controlled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 12 Filed 05/22/19 Page 37 of 39 I. ATTACHMENT Information to be disclosed by? Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each accoUnt or identi?er listed in Attachment A: a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with .session times and dates, acCount status, alternative e-mail addresses provided Case Document 12 Filed 05/22/19 Page 38 of 39 II. during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; All cookies, including third-party cookies, associated with the user; All records that are associated with the machine cookies associated with the user; and All telephone or instrument numbers associated with the Account (including MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 et seq., involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 12 Filed 05/22/19 Page 39 of 39 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and i. The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals.