Case Document 48-5 Filed 07/18/19 Page 1 of 73 UNITED STATES DISTRICT 8 MAG 2 8 7 7 SOUTHERN DISTRICT OF NEW YORK In the Matter of a Walrant for All TO BE FILED UNDER SEAL Content and Other Information Associated with the Email Accounts AGENT AFFIDAVIT @gmail.com, -@gmail.com, and 1, Maintained at Premises Controlled by Google, Inc, 3 USAO Reference No. 201 811001 2? Agent Af?davit in Support of Application for a Search Warrant Electronic?Communicati?s STATE OF NEW YORK ss. COUNTY OF NEW YORK Special Agent of the United States Attorney's Of?ce for the Southern District of New York, being duly sworn, deposes and states: I. Introduction 1. I am a Special Agent with the United States Attorney?s Of?ce for the Southern District of New York (the I have been a Special Agent with the USAO since August 2016. I previously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. 2. I make this affidavit in support of an application for a search warrant pursuant to 13 U.S.C. 2703 for all content and other information associated with the email accounts and (the ?Subject Accounts"), maintained and controlled by Google, Inc. (the ?Provider?), headquartered at 1600 Case Document 48-5 Filed 07/18/19 Page 2 of 73 Amphitheatre Parkway, Mountain View, California 94043. The information to be searched is described in the following paragraphs and in Attachments A and to the proposed warrant. 3. On or about February 28, 2018, 1 submitted an Affidavit in support of an application for a search warrant pursuant to 18 U.S.C. 2703 for all content and other information associated with ?re Subject Accounts maintained and controlled by the ?Provider, a true and correct copy of which is attached hereto as Exhibit A (the ?Original Af?davit?), and which is incorporated by reference as if fully set forth herein.1 4. On?that?same date, the l?Itmorahle Gabriel Gore?neteiri, United States-Magistrate Judge, issued a search warrant for the requested data, a true and correct copy of which is attached hereto as Exhibit (the ?Original Search Warrant?). Shortly thereafter, the Provider was served with the Original Search Warrant. On or about March 7, 2018, the Provider provided a response to the Original Search Warrant. That return was incomplete because the Provider declined to produce data that it stored on computer servers located outside of the United States. It is my understanding, from speaking with the Assistant United States Attorney assigned to this matter as well as other law enforcement agents, that the Provider? 3 refusal to provide foreign stored data was in light of the Second Circuit?s decision in which it held that Microsoft Corporation was not required to produce foreign stored data pursuant to a warrant issued wider the Stored Communications Act. See Matter of Warrant to Search a Certain E?Mail Account onri?oli'ad and Maintained by Microso?? Corporation, 829 F.3d 197 (2d Cir. 2016), cert. granted 138 S. Ct. 356 (2017) (the ?Microsoft Litigation"). The Original Affidavit also sought content information for two additional email accounts hosted by different providers. This af?davit only requests a search warrant with respect to the Subject Accounts described herein. 201103.25 Case Document 48-5 Filed 07/18/19 Page 3 of 73 5. On March 23, 2018, the Clarifying Lawful Overseas Use of Data Act (the Act?) was enacted and became law. The CLOUD Act clari?es that in responding to legal process issued under the Stored Communications Act, providers are required to disclose data even if it is stored abroad. Speci?cally, section 103 of the CLOUD Act amended 18 U.S.C. 2713 as follows: 2713. Required preservation and disclosure of communications and records A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider?s possession, custody, or control, regardless of whether such communication, record, or otherinformationis located withinonoutside of the United_ . . States. From my background, training, and experience in this investigation and in others, I knew that, in general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form in the account, is maintained on the Provider?s servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Provider?s computers inde?nitely, Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period of time. In addition, from my review of other search warrant returns in this investigation, I know that the subjects of the investigation maintained email data relevant to the investigation in email . accounts for many months after the email was sent or received. 7. Accordingly, I respectfully submit this Af?davit seeking the issuance of the attached proposed search warrant which seeks the same data as was sought in the Original Search Warrant, for the reasons set forth in the Original Af?davit and herein. II. Request for Non-Disclosure and Sealing Order 8. The existence and scope of this ongoing criminal investigation are not publicly known. As a result, premature public disclosure ofthis affidavit or the requested warrants could alert target 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 4 of 73 subject Michael Cohen that he is under investigation, causing him to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as Set forth in the Original Af?davit, Cohen uses computers and electronic communications in furtherance of his activity and thus could easily delete, _o?therwise conceal such digital evidence fromlaw enforcement were he to learn of the Government?s investigation. See 18 U.S.C. 2705(1))(3). Cohen also appears to have the ?nancial means that would facilitate his ?ight from prosecution. See 18 U.S.C. (5). 9. Accordingly, there is reason to believe that, were the Provider to notify the subscriber or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 U.S.C. 2705(b), I therefore respectfully request that the Court direct the Provider not to notify any person of the existence of the warrant for a period of 130 days from issuance, subject to extension upon application to the Court, if necessary. 10. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. 219110325 Case Document 48-5 Filed 07/18/19 Page 5 of 73 HI. Conclusion 11. Based on the foregoing, I respectfully request that the Court issue the warrant sought herein pursuant to the applicable provisions of the Stored Communications Act, 13 [1.8.0 2703(b)(1)(A) (for contents) and 2703(c)(1)(A) (for records and other information), and the relevant provisions of Federal Rule of Criminal Procedure United States Attorney?s U?lce Southern District of New York Sworn to before me this {Li dag.r of April, 2018 LDENRY B. PITMAN United States Magistrate Judge Southern District of New York 2m 103.25 Case Document 48-5 Filed 07/18/19 Page 6 of 73 Exhibit A Case Document 48-5 Filed 07/18/19 Page 7 of 73 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of 3. Warrant for All . . . Content and Other Information A TO BE FEED UNDER SEAL A ?restated With the Email Accounts @gmail.com, AGENT -@g1nail.eom, and Maintained at Premises Controlled bv Gooale. 1110., the Email Account? 6 . Maintained atPren?ses Controlled by 1 8 MAG. - Oath, - ?maintained at Premises Controlled by 1 dz: 1 Internet, Inc, USAO Reference No. EDIERODIET Agent Af?davit in Support of Application for a Search Warrant for Stored Electronic Communications STATE OF NEW YORK COUNTY OF NEW YORK 3 SS. Special Agent _3f the United States Attorney?s D?ice for the Southern District of New York, being duly sworn, deposes and states: I. Introduction A. Affiant l. I am a Special Agent with the United Staten Attorney? 5 Of?ce for the Southern District of New York (the Ihave been a Special Agent with the USAO since August 2016; I previously served as a special Agent 1aritlt the United States Department of Labor Inspector General ?rorn May 2011 to August. 2016. In the course of my experience and training in these positions, I have partieip ated in criminal investigations into federal offenses involving a wide array Case Document 48-5 Filed 07/18/19 Page 8 of 73 of ?nancial crimes, including frauds 'on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. B. The I'rcvider, the Subject Account and the Subject Offenses 2. I make this af?davit in support of an application for a search warrant pursuant to 18 USE. 2703 for all content and other information associated with the email accounts _@gmail.con1 (the ?Cohen Account"), {the ?more . (the ant-@aolcom (the (collectively, the "Subject Accounts?). The Cohen Account, _.ccount, and? Account are maintained and controlled by Google, Inc, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043 (?Google?), the Account is maintained and controlled by .1 dc 1-lntemet, Ina, headquartered at 701 Lee Road, Suite 300, Chesterbroolc, 19037 dz and is maintained and controlled by Oath, Inc, 22000 AOL Way, Dulles, Virginia 20166 (?Oath?) (together, the ?Providers?). The information to be searched is described in the following paragraphs and in Attachments A, B, C- and to the preposed wairants. 3. As detailed below, there is probable cause to believe that the Subject Accounts contain evidence, ?nite, and instrumentalitiesof violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?). The Target Subjects of this investigation are COHEN (?Cohen?) and others knoWn and m?mown. This af?davit is based upon my personal knowledge, my review of documents produced pursuant to grand jury subpoenas and prior search wan'ants, my review of interview reports prepared by other law enforcement of?cers, and my conversations with other law enforcement officers, as well as 2 02.2mm Cas - - e1.18cr00602?WHP Document48?5 Filed 07/18/19 Page90f73 my training and experience concerning the use of email in criminal activity. Because this af?d avit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts I have learned during my investigation. Where the contents of do cements and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. C. Services and Records of the Provider 4. I have learnedthe following.aboutthel?roviders: . - a. The Providers offer email services to the public. In particular, Google permits subscribers to maintain email accounts under the domain name gmailnom. Googic also allows a subscriber to maintain email accounts under any domain name under the subscrib er?s control. For example, if a subscriber controls the domain namr_ Google enables the subscriber to host any email address under this domain name on servers operated by Google. Oath permits subscribers to maintain email accounts under the domain name aol.com. 1 85 1 permits subscribers to maintain email accounts under any domain name under the subscriber's cohtrol. For example, if a subscriber controls the domain namr? 1 3r. 1 enables the subscriber to host any email address under this domain name on servers operated by '1 8c 1. A subscriber using the Providers? services can access his or her email account from any computer connected to the Internet. b. The Providers maintain the following records and information with respect to every subscriber account: i. Email contents. In general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form in the account, is maintained on the Providers? servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Providers? computers 3 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 10 of 73 inde?nitely. Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period of time. ii. Address book. The Providers also allow subscribers to maintain the equivalent of an address book, comprising email addresses and other contact information of other email users. Subscriber and billing information. The Providers collect and maintain (typically-unveri?ed) identifying?mformation about each subscriber, including, for. example, name, usemame, address, telephone number, and alternate email addresses. The Providers also maintain records concerning the date on which the account was created, the Internet protocol address of the user at the time of account creation, the current status of the account (nag, active or closed), the length of service, and the types of services utilized by the subscriber. Additionally, for'paving subscribers, the Providers maintain records of the subscriber?s means and source of payment, including any credit card or bank account number. iv. Iransucrionoi information The Providers also typically retain certain transactional information about thense of each account on its system. This information can include records of logic session) times and durations and the methods used to connect to the account (such as logging into the account through the Providers? website). v. Customer correspondence. The Providers also typically maintain records of any customer service contacts with or about the subscriber, including any inquiries or complaints concerning the subscriber?s account. I vi. Search history. Google and Oath also typically maintain records of any search historyr or web history associated with the subscriber?s account. 02.23.2{118 ?an Case Document 48-5 Filed 07/18/19 Page 11 of 73 vii. Associated content. Google also typically maintains content and records relating to the following applications that are associated with its e?mail accounts: (A) ?Google Docs,? which provides document-editing software that can be used to create, share, store, and manage documents online; (13) ?Google Drive,? which enables users to store ?les on Google servers, where they can be accessed remotely by the user and others; and (C) ?Gchat'? or ?Instant Messenger,? which provides a chat hater-face through which users can communicate with each ?other'in real time: Oath also typically maintains content and records relating to AOL instant? message, vvhich provides a chat interface through users can communicate with each other in real time. Preserved and backup records. The Providers also maintain preserved copies of the foregoing categories of records with respect to an account, for at least 90 days, upon receiving a preservation request from the Government pursuant to 13 U.S.C. 2703a). The Providers may also maintain backup copies of the foregoing categories of records pursuant to its own data retention policy. 1). Jurisdiction and Authority to Issue Warrant 5. Pursuant to 13 U.S.C. 2703(a), (1)91) 35 the Govermnent may require a provider of an electronic communications service or a remote computing service, such as the Providers, to disclose all stored content and all non-content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure, 6. A search warrant under 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a. court)? that ?has jurisdiction over the offense being investigated.? 13 U.S.C. 2711(3)(A)(i). 02.23 .2013 ?v . Case Document 48-5 Filed 07/18/19 Page 12 of 73 7. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), 8t: (3). Additionally, the Gorernment may obtain. an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 11.8.0. {3 2705(1)). - E.-PriorApplicaticns - - 8. On or about Iuly 18, 2017, in connection with an investigation being conducted by the O?iee of the Special Counsel the Federal Bureau of Investigation-CTR?) sought and obtained from the Honorable Beryl A. HcWell, Chief United States District Judge for the District of Columbia, a search warrant for emails inthe Cohen Account sent or received between January 1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from Judge HOWell search warrants for emails in the Cohen Account sent or received between June 1, 2015 and November 13, 2017, and emails in the Account sent or received between the opening of the account and November 13, 2017. The 800 has since referred certain aspects of their investigation into Cohen to the USAD, which is working with the New York Field oraoe. As part of that referral, the sco provided the case with emails and other content information obtained pursuant to the search warrants executed by the SCO, which had already been reviewed for privilege.1 As discussed below, this af?davit is based in part on my review of 1 In an abundance of caution, in a separate application the USAO has sought authorization, pursuant to Fed. R. Grim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account Warrants for evidence related to certain additional conduct that was not the focus of the Prior Cohen Account Wan-ants. The emails obtained from the Prior Cohen Account Warrants that relate to that additional conduct do not form a basis for the instant application. 6 02.23.2013 Ir?l?h?I?e Case Document 48-5 Filed 07/18/19 Page 13 of 73 responsive materials pro duced pursuant to the July 18 and November 13, 2017 warrants (the ?Prior Cohen Account Warrants?). 9. On or about November 7, 2017, and January-4, 2018, as well as certain prior dates, the SCO sought and obtained from Judge Howell orders authorizing and extending the installation and use of pen registers and trap and trace devices to record conununications sent to or ?oor the Cohen Account The 800 has provided pen registe1 data obtained pursuant to those orders to the USAC) This af?davit, as discussed below, is based in part on my review of? the- pen register data obtained? pursuant to the November 7, 2017 and January 4, 2018 orders (the ?Pen Register Data?). 10. On or about Februaryr 16, 2018, the USAO sought and obtained from the Honorable Debra Freeman, United States Magistrate Judge for the Southern District ofNew York, an order pursuant to 18 U.S.C. 2703 for email header information associated with the Account. This af?davit, as discussed below, is based in part on my review of email header information produced by d: 1 in response to that order (the Header Information?). Probable Cause A. Overview 11. The United States Attm?ney?s Of?ce for the Southern District of New York and FBI are investigating, among'other things, a scheme by Target Subject Michael Cohen to defraud multiple banks. Cohen is an attornev who currently holds himself out as the personal attorney for President Donald and who previously served for over a. decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. - 12. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from ?nancial statements and other disclosures that Cohen provided to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in- debt he owed on taxi medallion loans from the banks. As set forth. 7' 02.23.2013 ?Ln?hhauuF-V Case Document 48-5 Filed 07/18/19 Page 14 of 73 in detail below, in these ?nancial statements, and in his oral and other Written statements to these banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017 item new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; and failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash paymentto a third party,_ in connection with - acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material-omissions, Cohen-avoidedmaldng payments on his - loans, and attempted to and had assured proposed agreements from the banks to relieve him of certain repayment obligations worth millions of dollars. 13. Based on my review of emails obtained from the Prior Cohen Account Warrants, MUCPC Header Information, and documents produced pursuant to subpoenas, I have learned that Cohen has used the Cohen Account andfor WCPC Account to, among other things, communism with? ad the ?ame- about the proposed transfer of Cohen?s medallions and associated debts; (ii) negotiate spay-down of the principal amount of the taxi medallion loans; communicate with his accountant about the contents of the false ?nancial statements at issue; and (iv) send these false ?nancial statements to have Account?Account an -rccount, respectively, to communicate with Cohen about the status of the taxi medallion transaction, and to send relevant ?nancial statements to . banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Accounts will include evidence of the Subject Offenses. B. Cohen?s Statements to Sterling National Bank 14. As set forth a detail below, in 2014, Cohen, through limited liability corporations controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 8 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 15 of 73 National Bank C?Sterling?) and the Maltese Credit Union C?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions were devalued, Cohen sought to renegotiate the terms of the se lo ans audior relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his not worth, assets, avm'lable cash, and ?nancial outlook. Speci?cally, based on my-t'eview'of-reoords maintained by? Sterling and Meh'ose, and public sources concerning the taxi industry and the value of taxi medallions, as Well as my review of reports prepared by law enforcement of?cers of interviews with a Sterling executive vicepresident (the ?Sterling Employee-1?) and my participation in an hiterview with a Sterling employee (the ?Sterling I have leamed, among other things, the following: a. Taxi medallions are small metal plaques affixed to taxis. Without a medallion, it is illegal to operate ataxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions) .2 Cohen?s purchase of these New York taxi medallions was originally ?nanced by loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi operator, and leased his medallions to a third party. That third party made payments to Cohen, who in mm used some ofthose proceeds to pay his loan payments. b. In early 2014, Cohen became a customer of Sterling when he sought to re?nance a mortgage on a rental preperty that he owned. In or around April 2014, Cohen raised with Sterling 1 One of these companies, Mad Dog Cab Corp, was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 03.28.2018 Case Document 48-5 Filed 07/18/19 Page 16 of 73 the prospect of re?nancing his taxi medallion loans, which were then at Capital One Back. By in or about September 2314, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay o? his loans at Capital One and borrow more money from the then-increase in value of the medallions. According to Sterling Employee?1, in 2014, prior to the recent upheaval in the taxi i11dust1y?~as a result of the emergence of ride-sharing services, such as Uberrtaxi medallion loans were viewed by banks and investors as-safe, short term credits, as the market value "oftaxi medallions was-consistently rising. Consequently?asi medallion loans?like the-loans held by Cohen?rwei'e frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employeed, borrowers typically cashed out the increase in the loan amount and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when- he agreed to re?nance his medallion loans for approximately $22 million, which? according to letters from Capital One Bank in Sterling?s tiles?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. c. Based on my leview of records maintained by Sterling, I have learned that on or about December 8, 2014, each of Cohen?s sixteen taxi medallion corporations entered into loan agreements and promissory notes vvith Sterling for the principal sum of$ 1,3 75,000, with repayment due on December S, 2016. Each loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the comoration. The loans Were also each secured by a security agreement, dated the same day, making the medallions collateral for the notes. To give Sterling additional seem-ity, Michael and Laura Cohen. signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens' personal assets were their corporations to default under the loan agreements. In total, Sterling agreed to lend 02232013 - Case Document 48-5 Filed 07/18/19 Page 17 of 73 approximately $22 million to the Cohens? companies. Pursuant to participation agreements, Sterling transferred. 45 percent of that debt to Melrose.3 Under the terms of Sterling?s participation agreements with Melrose, Sterling was precluded from amending or modifying the loans without the consent of Melrose. d. In cyaluating Cohen?s requested refinancing of the taxi. medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s request, Cohen provided Sterling-with a-statement-of ?nancial?condition, dated August?l, 2014? (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.4 From my review ofa Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because, accounting for loan payments, cash ?ows from the medalli0ns were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements?ewes over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approVal of the loans for substantially the same reasons. e. Based on my review of records maintained by Sterling and public sources, I have is amed that over time, the collateral Cohen?s loans (taxi medallions) less ened in value due to the rise in ridesharing companies and signi?cant devaluation of taxi medallions. Additionally, 'Cohen began falling behind on loan payments to Sterling and Melrose. II know from necords maintained?by 'Sterlingand? an'interview with beginning- in- or-aremid 3 Melrose, which had a business principally focused on teed medallion loans, is now in conseivatorship by the National Credit Union Administration 4 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a networth of $75,370,000. 11 02.23.2013 -I Case Document 48-5 Filed 07/18/19 Page 18 of 73 September 2.015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in melting payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from-Sterling Employee?2, dated September 9, 2015, sutmnarizing a call with Cohen?which'according to the email and toll records for Cohen?s cellphone occurred on September 8, 2015-?during winch Cohen told Sterling -Employee-2, in sum and substance, about his cash ?ow problems and shortfall of approximately $16,000. ln'that same email, Sterling Employee-2 commentedthat despite Cohen?s statements, his personal ?nancial information ?indicate[d] a strong ability to malce up the difference in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction r? in Cohen?s payments. f. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee?2, I have learned that Cohen and Sterling Employee-2 spoke again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. I know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks. According to these records, however, Cohen resistedthese requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 12 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 19 of 73 among other things, reducing the interest rate Cohen paid to Mali-nae and extending the loan maturity date to December 3, 2017. g. I know from interviews with Sterling Employee?l and Sterling Employee~2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee-1 that Cohen had a potential buyer of his tairi medallions, named_ who would agree to assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by as the interviews with-Sterling Einployee=1and?terling Employee?-referenoed above, llmow that by or before October 2016, Cohen had entered into negotiations to sell his shrieen corporate taxi medallions to - who is a medallion and taxi operator, for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a condition of the transfer of the medallion loans?and because Sterling was unfamiliar wit}- -?Sterling requested that Cohen make a substantial principal payment on the loan, .of approximately one million dollars, prior to the hamster. Cohen rejected this request initially. But on or about January 3 I, 20 Cohen told Sterling Employeel, in sum and sub stance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal witl- Indeed, in an email sent from the Cohen Account to Sterling Employee-2. on or about February 22, 201?, Cohen continued that he ?agreed to pay down 1 million from the loan amount.? h. Pursuant to the participation agreements betWeen Sterling and Melrose, Sterling Was requiredto secure Melroso?s agreement-to participate in the transfer of the taxi medallion debt from Cohen to _fJn or about April 17, 2017, Sterling sent a memorandum to Melrose summarising the terms of the proposed transaction, and noting the requirement that 13 consents Case Document 48-5 Filed 07/18/19 Page 20 of 73 Maltese agree to the terms. On or about May 2, 2017,_emailed Sterling Employee?l from the _.dlccount to inquire about the status of the transaction. Sterling Employee-l responded to the?Account that Melrose had agieed to the deal, and that Sterling would be sending? term sheet shortly. i. In order for the banks to evaluate the proposed transaction fully, they requested ?nancial parties. On or about Gctober 26, 2016, a Sterling employee emailed - the -Accounl: about the ?Cohen Medallion Purchase,? and stated order to proceed with the assumption of Michael?s loans,? Sterling needed certain ?nancial information ?esdd eds at tin?Account, that he would send a ?nancial statement and tan retains shortly. Additionally, on or about I one 7, 2017, Sterling Employee?__1 emailed Cohen to request an ??rpdated personal ?nancial completed jointly with Cohen?s strife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employeesl item the Cuban Account, attaching a Sterling personal ?nancial statement form that had been ?lled out by hand, which re?nanced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?), that was also attached. ?l?he May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came from Cohen and that Getzel had not con?rmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in I 14 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 21 of 73 cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $1 1,00 0,000 personal residence. j. Based on my review of reports of law enforcement interviews of Sterling Employee-1, Ihave learned?t'hat Sterling Employee?1 reviewed each line ofthe May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-1 asked - Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling 'Emplovcml; in sum and substance, that the May 20 17 - Financial Statement vvas accura 11.011 or about August 16, 2017, Sterling Employee-1 emailed Cohen at the Cohen Account and_ at the _Account, attaching a non-binding term sheet memorializing the potential transaction between Sterling, Meh'ose, Cohen, and - - On or about August 29, 2017, -:ruailed Sterling Employee?1 from the- Aceount, requesting that he be included on ?all future e?mails tt_ andfor - concerning this matter,? and providing proposededits to the term sheet. On or about August so, 2017, Sterling Employee-1 emailed a the Account, Cohen at the Cohen ant-at the-account, and provided them with a revised term sheet. 011 or about Septembe 5, 2017, Sterling Employeed sent. at the_ Account, Cohen at the Cohen Account, an-Lt thi-tccount a copy of the executed term sheet. According to the tem sheen?would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that-was to acquire from Cohen. 1. As part of the agreement, according to the term sheet, $1,265,913 in principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by- Cohen and-the into banks, with Cohen paying ?fty percent and the banks dividing the 15 cansacts Case Document 48-5 Filed 07/18/19 Page 22 of 73 remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, M17, the panics reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $3 57,167 and $236,789 respectively in the form of charge?offs. According to Sterling Employeo- 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay-down of at least one million dollars?because Cohen represented 'on'atelephone call with Sterling Employee-1, in contend-substance, that he ha - insu?icient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing tin-ransaction, Cohen aton no longer have had any outstanding obligations to Sterling or Maltese. m. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by lSterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling required and requested additional ?nancial statements for Cohen and - for its credit underwriting process. In response to Sterling?s requests, on or about October 5, 2017, - -:nt from the _Aecount to a Sterling employee acopy of- _}ersonal ?nancial statement. The ?nancial statemant lists the Account as the email contact fo:_ Additionally, on or about October 5, 2017, (Johan, using the Cohen Account, re-sent Sterling Employee?2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling Employee-2 a statement of ?nancial condition, dated September 30, 2017 (the "September 2017 Financial Statement?). 16 mascara . . m?I mu.- Case Document 48-5 Filed 07/18/19 Page 23 of 73 11. Like the. May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter ?'om Jeffrey Getael, Cohen?s accountant, stathig, in sum and substance, that the information in the statement came ??nm Cohen, and that Getzel had not confirmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,631 0,000, and a negative net worth of $12,200,000. Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement representedtc Sterling that Cohen?had a negative net worth.? The September 20151-Financial Statement indicatecl that Cohen?s assets were comprised of $1,250,000 in cash, $17,030,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), 5 $3,200,000 in real estate myesttnents, and his $11,000,000 personal residence (which, for the ?rst time, he indicated was held in trust). The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some? of his real estate investment entities. c. From my participation in an interview with Sterling Employee?2, and my review of records maintained by Sterling, I have also learned that at or around the time Cohen provided Sterling with these ?nancial statementsgin or around September stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee? 2, Cohen informed Sterling, in arm and substance, that he had insu?icient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest J?H'payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the 5 Notably, the September 2.01? Financial Statement valued each of Cohen?s thirty-two New York taxi medallions at approximately $130,137.50, which was considerably less than the $65 0,000 valuation ascribed to each medallion in the Cohen- tennsheet. - 17 02232013 Case Document 48-5 Filed 07/18/19 Page 24 of 73 September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialiaed in a I December 2017 memorandum) that the Cohen-transaction was favorable for the bank that is, that-would be a better than Cohen. p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of pastndue loan payments. On December 29, 2017, Sterling sent Cohen a 'letter stating tharhe?was' in default under the-loans- between Sterling and-Cohen?s medallion- corporations. Cohen did not make an immediate payment on the loans, but instead sent an e-mail to Sterling Employeel on or about January 24, 20 18, from the Cohen Account, stating that during the closing of the Cohen-1 transaction, Cohen would ?bring all payments up to date as. well as deposit the payoff differential.? Cohen also requested by email sent from the Cohen Account on January 24, 2013, that at the closing of the Cohen-transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. q. The Cohen-ransaction, however, did not close. On or about January 29, 2013,. the -attorney, emailed attorneys for Sterling from ?re-tecount and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? r. Based on my participation in the interview with Sterling Employee?! and my review of records maintained by Sterling, Ilmow that a?er the Genet-deal fell apart, Sterling assigned Cohen?s loans to an employee at Sterling 1:th specializes in collecting on defaulting loans (?Sterling Employee?3?). From my review of telephone call notes, I lmow that Sterling Employee?i spolre to Cohen on or about January 30, 2018 about paying andfor 13 02.232013 Case Document 48-5 Filed 07/18/19 Page 25 of 73 restructuring Cohen?s outstanding taxi medallion loans. Based on my review of an email between Sterling Employee-3 and Cohen, I loiow that on the January 30, 2018 call, Cohen stated that he would send a ?corrected current" version of his personal ?nancial statement. Following that call, on or about January 31, 2018, Cohen emailed Sterling E1nployee~3 ??om the Cohen Account a copy of the September 2017 Financial Statement. Later that day, Cohen again entailed Sterling Employee-3 from the Cohen Account and proposed paying $500,000 to bring the loans current and-$05 0,000 to bring the princip al-balance to 00,000 .- Cohen also suggested revised interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to I Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approxhnatcly 1,75 0,000), and would need to make larger interest payments. - s. On or about February 1, 2018, Cohen emailed Sterling Employee?3 from the Cohen Account and proposed ?[p]ayment of $125013: which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m.? (Emphasis in original.) Cohen alSo stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pro?fund payments. Based on my participation in an interview with Sterling e?2, I have learned that Sterling continues to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. 19 02.23.2012 Case Document 48-5 Filed 07/18/19 Page 26 of 73 C. Cohen Made Material Msrepresentations About His Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 15. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, by extension, Melrose?) that he had insufficient funds to pay down the principal balance of the medallion loans, make interest payments, or pay past-due amounts, it appears that between 20 16 and the present, Cohen opened and maintained bank accounts at First Republic Bank - (?First millions of dollars in purported?consulting payments in these. . . accounts, which he did not disclose to Sterling. Cohen setup these accounts and received these ?mds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bani?: accounts by his accountant?Cohen withheld information about liquid ?nancial assets at First Republic. 16. Specifically, based on my review oi? documents and banlt records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with twe First Republic employees, I have learned, among other things, the following: a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts, some in his own name and others in the names of corporate entities. 5 Based on my review of a. report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen?s ?nancial statements and other records in Sterling?s possession were foiwarded to Melrose so that Melrose could make a determination as to whether to approve of the Coher transaction. Based on my review-of reports of interviews with Melrose employees, I also know that Cohen called employees at Melrose regarding-the Coher? transaction. 20 02232012 Case Document 48-5 Filed 07/18/19 Page 27 of 73 b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Account?). Cohen was the only authorized signatory on the account. When Cohen opened the Essential Consultants Account, a First Republic employee (?First Republic Employee conducted an in-person interview of Cohen.- In reaponse to a series of know~yotir?custcme1' questions"? about the purpose of the answers to which First Republic Employee-1 "entered into a forms?Cohen?stated, in sum and substance, that he was opening --Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?~which he said was not his main source of income?separate from his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account Were false. Speci?cally, the account was not intended to receiyewand does not appear to have recei_ved??Inoney in connection with real estate consulting work; in addition, the account has received substantial. payments from foreign sources. I o. First, on or about October 2'7, 2016hthe day after he opened the Essential Consultants Account, Cohen. used the account to wire $130,000 to an account held in the name of attorney Keith Davidson? law firm. Based on my review of emails between Cohen and Davids on, 7 Certain ?nancial institutions are required to conduct such procedures poi-slant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 (1F .R. 1020.220. 3 First Republic Employee-1 ?rst ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic updated the form to add more detail about Cohen?s statements. 21 02.28.2018 Case Document 48-5 Filed 07/18/19 Page 28 of 73 obtained pursuant to the Prior Cohen Account Warrants, I believe that this payment did not relate to any real estate consulting work, but rather was a ?settlement? payment made to Davidson?s client. 9 Based on my review of public sources, I have learned that Davidson?s client is alleged to have had an extramarital affair with Donald Tnunp. On or about February 13, 2018, Cohen made a public statement that a private transaction in 2016, I used my own personal funds to facilitate a payment of $13 0,000 to [Davidson?s c1ient].? from my review of First Republic'b'ank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign'businesses and entities that do not re?ect the stated client pro?le for the residential and commercial realuestate consulting services. Speci?cally, from my review of the Essential Consultants Account schedule and public sources, I lmovv the following: 1. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 ?om an entity called Cclumbuslcha LLC, which were deposited into the Essential Consultants Account. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017', the Essential Consultants Account received seven payments totaling $583,332.93 from Columbus Nova LLC. 5' Speci?cally, I have learned ?'om my review of bank records that on or about October 26, 2016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 from the Essential Consultant Account to an account held in the name ofDavidscn?s law ?rm at a bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of approximately $96,645 was made from Davidson?s account to a bank account in the name of Davidson?s client. 22 02.232013 Case Document 48-5 Filed 07/18/19 Page 29 of 73 ii. Beginning on or about April 5, 2017, Cohen began receiving payments from Novastis Investments, SARL, which I believe to be the in-house financial subsidiary of the Swiss pharmaceutical company,r Nevattis Intemational AG (?Novartis?). Between April 2017 and January 2013, the Essential Consultants Account received ten wire payments from a Swiss bank account held in the name ofNovartis, each in the amount of $99,980, for a total of $999,800. Beginning in or about April 201 7, the Essential Consultants Account started feceitmg'whe payments from a bank account'associated?with the telecomnnmications company Inc. Speci?cally, on or about April 14, 2017, wired $100,000 to the Essential Consultants-Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received nine $50,000 payments from In total, wired $550,000 to the Essential Consultants Account. iv. On or about May 10, 2017, lime 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder from which the money was sent is Korea Aerospace Industries Ltd. KAI is a South Korea-based company that produces and sells fated?wing aircraft, helicopter aircraft, and satellites to the United. States Department of Defense, among other customers. it. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named?BTA Bank, A0. A mes sage accompanying the wire payment indicated that the payment was a consulting fee as per luv era-.101 on May 10, 2017 agreement WIN on as as 2017 cars W?tDb 03f05f2017.? 23 ceasama W. .Imer??u. Case Document 48-5 Filed 07/18/19 Page 30 of 73 vi. In total, ?'om on or about January 31, 201?? to on or about auuary 10, 2018, the Essential Consultants Account received approximately $2,883,132.19? in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance inthe Essential Consultants Account-was $1,369,474.23. I e. On'or about April 4, 2017, Cohen opened another newchecking account at First Republic, this one in the name of Michael D. Cohen Associates, P.C. (the Account?). Cohen was mainly autholi'zecl'sig?at?rfo? the account. Among?other things, the mean;- Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law ?rm. In total, from on or about April 5, 2.017, to on or about January 2, 2018, the MDCM Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2013, was $344,541.35. 'As discussed below, Cohen never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the -transaction, including in his May 2017 Financial Statement and September 2017 Financial Statement. 17. Based on my review of emails from the Cohen Account that were seized pursuant to the Prior Cohen Account Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and 11211304th Account ostensibly were for political consulting work, including consulting for international clients on issues pending before the Trump administration.? Speci?cally, ?oor my review of emails hen: the Cohen Account and public sources, I have learned the following: 1? Based on my review of public sources, I have learned that Cohen 13 not registered as a lobbyist o1 as a person acting as an agent of foreign principals, as may have been required by the Foreign Agents Regi station Act. 24 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 31 of 73 a On or about April 23, 201?, Cohen sent an email from the Cohen Account to an individual whom I believe is affiliated with KAI. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 20.17. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand US Dollars," disbursed through-eight $150,000 installments between May 120 1-7 and December 2017; - b. On or about May 10, 2017, Cohen sent an email from an alternate email address, copying the Cohen Account, to an employee of ETA Bank. To the email, Cohen attached an invoice to ETA Banlc in the name of Essential Consultants. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? c. On or about February 13, 2017, Cohen emailed employee from the Cohen Account what appears to be a consulting agreement, which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential ConsultantsJ?s assistance and advice." The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, Ihave learned that retained Cohen to consult on political issues, including net neutrality, the merger hetwaen and Time Warner, and tax reform. d. On_or_ about I 313110le 2017, Cohen emailed to a representative of Nevada from the Cohen Account a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advismy services to Novartis on matters that 25 {32.232013 Case Document 48-5 Filed 07/18/19 Page 32 of 73 relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to [Essential Consultants] and Novartis." The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in even installments over the course of a year. Based on my review of reports of interviews with Nevartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration c. On or about April 3, 2017, Squire Patton Boggs, a law ?rm, announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent slice 18. Despite the signi?cant amount of money that Cohen received into the Essential consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Metrose. Speci?cally, based on my review of documents provided by Getzel, and my review of notes anr? I have learned the following: a. In or about May 2017, Gctzel met with Cohen at a law ?rm in Manhattan, New York. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen 32; Associates P.C., and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in oonnecti on with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six: million dollars annually. b. In or about October 2017, if not earlier, Getael was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 26 02232013 Case Document 48-5 Filed 07/18/19 Page 33 of 73 Account in which Getzel wrote that is a draft of the new PFS as of September 30, and attached a dralt of the September 2017 Financial Statement The drait statement reflected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised after-ti medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact "that'the ?nancial statement?did not list any assetsasso'ciated either the-Essential Consultants Account or the MDCM Account: did not add any 1value for you[r] two operating entities - Michael D. Cohen Associates POC [sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. on or about October 6, 2017, Cohen called Getzel by telephone?which is re?ected on toll records for Cohen?s cellphone?and told Gates], in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. d. On or about October 6, 2017, following? the call with Getzel, Cohen, usingthe Cohen Account, responded to Getzel?s email with the answer goodlto me.? Cohen neVer directed Getzel to make an},Jr changes to his cash position as listed in the September 2017 Financial Statement. Neither Essential Consultants nor was listed on the September 2017 Financial Statement. that was provided to Starling. . i 19. Based on the foregoing, and from my leview of-banlc records and emails sent by Cohen to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of assets that Cohen held in the Essential Consultants Account or the Account. As of September 30, date of the September 2017 Financial Statement?Cohen had 27 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 34 of 73 approximately $623,729.95 in the Essential Consultants Account and $248,619.23 in the Account. As of October 6, 2017, the date when Getzel asked Cohen about the two accounts, Cohen had approximately $823,709.95 in the Essential Consultants Account and $248,151 9.28 in the WCM Account. Cohen Understated His Available Cash 20. In addition to withholding the existence of the Essential Consultants Account and the Account from Sterling and Melrose, it appears thatCohcn' also substantially understated his available each and cash equivalents in his ?nancial disclosures. Specifically, I know from my review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,125 0,000 in cash as of September 30, 2017. But, from my review of a I summary of hard: records that were scheduled by an FBI forensic accountant, I have learned that Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2012. Speci?cally, from my review of the account schedule and bank records, I have learned the following: a. Cohen has three checking andfor savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,932.29 in total in the three accounts at Capital One Bank. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,60 0.41. c. As of September 30, 2017, Cohen had $260,689.13 in an account at Signature Bank. d. .In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,376,209.27 in total in his four accounts at First Republic. 23 assume Case Document 48-5 Filed 07/18/19 Page 35 of 73 6. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife?and the total balance across the two accounts as of September 30, 2017 was $300,096.72. h. In total, as of September 30, 2017, Cohen had at least $5,014,051.80 in his accounts '?"?atCapital One BankTSignature-Bank, TD Banis-Bethpagc Credit Union-First Republic, and Morgan Stanley.- 21. based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable tense in his renegotiation of his medallion loan. Based on my: participation in an interview with Sterling Employee-2, and my review of reports of intewiews with Sterling Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose would View Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or approve of the transfer of these loans to Cohen Had a Side Agreement With- 22. As set forth in detail below, it appears that during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to_ Cohen not only misrepresented his ?nancial position to Sterling, but also failed to disclose a side deal he had negotiated with - it appears that - agreed to pay an above-market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay-pproximately 29 mascara Case Document 48-5 Filed 07/18/19 Page 36 of 73 $3.8 million in-cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and reports prepared by law enforcement of?cers of interviews with Sterling Employee-1, as Well as my participation in an interview with Sterling Employee-2, Ihare learned, among other things, the follondng: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee] to Cohen and - Sea supra if 140;). According to the term shoe.- -Wouldhoirow Sterling and Melrose:to'be secured'by the medallions that-sac to acquire from Cohen. At aprlce of $20 million for thirty-two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment ?'om Cohen to - or any other form of payment or ?nancial transaction between the parties. 13. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen-transaction and the new loan 1-iid not mention any payments from Cohen to - including a $3.8 million payment. The memorandum also noted that the ?loan amount of indicates a pinchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling Employee?1 and Sterling Employee"; they were never told ths- agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make any payment. a - 30 amazon; Case Document 48-5 Filed 07/18/19 Page 37 of 73 23. While Cohen and -did not disclose any payment from Cohen to -in conmnmications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and a report prepared by law enforcement agents of an interview with Getael, I have learned the following, in substance and in part, regarding the proposed side-payment from Cohen tu? a On or about September 19, 2017, Getzel prepared a memorandum for Cohen ?enti?ed, ?Sale of?NYC?Medallion Entities and Debt Assumption? (the-?Getzel The Getzel Memorandum summarized the proposed transaction between Cohen and- in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, up on the [Cohens?] paying down the or? debt portfolio of the 13 entities by $5 00,000 and a cash payment to the Buyer of $3,800,00 13. According to Getael, Cohen told him the parameters of the deal, including the payment of $3,800,000 t-It Gates] did not know where Cohen was going to obtain $3,300,000 to paj- As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2.017, but had only disclosed in his September 201?? Financial Statement that he had $1.25 million in cash. 24. Based on my retdew of records maintained by Sterling (as well as Maltese, the bank I With the participating interest in the loans) and reports of interviews of representatives of Sterling - (and Maltese), I have seen no evidence that Sterling, Maltese, or any other ?nancial institution 0 involved in the potential deal with Cohen and-was aware of the planned $3.8 million side payment from Cohen t- 11 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 3 1 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 38 of 73 D. Probable Cause Regarding the Subject Accounts 25 . As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling that he has dif?culty making payments on his medallion loans and, since at least October 2015, Cohen has been acutely engaged in an attempt to sell his taxi medallions and the associated debts 111?. In the course of doing so, Cohen has used the Cohen Account andlor Account to engage in email communications regarding the terms of the transactions and the tmdisclosed?side?payment with_ at the-_ Account; -- -at the-Account, an- at the-iccouut. Speci?cally, as described above, there is probable cause to believe that the Subject Accounts have been used regarding the proposed Cohen-transaction with Sterling: 9.. Cohen has used the Cohen Acootmt to, among other things, negotiate a pay-donor of the principal amount of the loan, see supra 11 Mfg), to send term sheets to Sterling, see supra 1[ 140), to communicate with his accountant about the contents of ?nancial statements, see supra 1 16, to send financial statements to Sterling, see supra 1[ 14(i), (1), to check on the status of the transaction as of January 2.4, 2?18, see supra 1i 14(n), to negotiate a reduction of his debt with Sterling on or around January 31, 2013, see supra '11 14(0), to tell Sterling on February 1, 2018, he does not have the ability to pay more than $1,115 0,000, sea supra 11 14(p), and to with individuals responsible for sources of payments to the Essential Consultants Account, see supra 1[ 15. In other words, from the conununications described above, it appears likely that the Cohen Account will contain recent evidence of the Subject Offenses, including communications and potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling are false or misleading. I). _1as used the _Account to communicate about the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 32 02.28.2013 .-. Case Document 48-5 Filed 07/18/19 Page 39 of 73 as October 2016. See supra 14(g). 12 Speci?cally, as described above, as early as May 2, 2017, used the-recount to inquire about the status of the transaction, sec supra 1i 1461). He used tit?Account to exchange drafts of the proposed term sheet with and Sterling, sac snore 1 14G). was also used by send a personal ?nancial statement for?to Sterling, see supra 1i 14(1). The?Account was copied on emails ?'om the "Account ?abcut'thc transaction, sac saprar?? 1'46), and was 'h'sted-on'_ ?nancial? statement as the contact email for_ sea supra 'll 14(m). Additionally, based on my review of Header Information, Ilmow that on or about September 1, 2017?at or around the time ?it-and Cohen were negotiating a term sheet?_used the Account to send and receitre eight emails ?'om Cohen at the MIDCPC Account. c. -has used tht-chcunt to communicate with Sterling employees, Cohen, and?about the proposed taxi medallion transaction since at least December 20 1 6. See supra 1m 14(g), 24c). Speci?cally, on or about August 29, 2017, -tcld Starling that he should be included on ?all ?xture e?mails" involving the proposed transaction, sea supra 1i 146). Additionally,-was involved in making revisions to the parties? term sheets, and he told Sterling on January 29, 2013 that- would not go forwatd with the planned transaction, sea 31.;er ll 14G), (11). Accordingly, there is probable cause to believe that the-Account will contain evidence of the negotiations between Sterling and the parties, etddence of a payment ?om Cohen to- and the reasons for the collapse of the Cuber-hansaction. ?2 For instance. ?'cm records provided by Sterling, that on or about December 2, 2016? out an email to a Sterling emplovee using the Account. The email forwarded correspondence betweei who was using the - Account, and an employee of Capital One regarding extending loan with Capital One. 33 02.232013 Case Document 48-5 Filed 07/18/19 Page 40 of 73 26. Additionally, it appears that Cohen setup the Account to receive emails he was previously receiving at the Cohen Account. Speci?cally, based on my review of records maimained by I have learned that on or about May 5, 2017, Cohen sent an mn'ail from the Account to a blind copy list of recipients stating that ?[d}ue to the overwhelming volume of phone calls and emails coming into my previous cellular number and e-mail address, There elected to create for Clients Only the following. Kindly use this new information for all future sonnet and Communications.? 'Tl? signattue line on ?ie'em?a'illi'sted ?Essential and ?Michael D. Cohen ch Associates, as well as Account as the email address. 13 2.7. In addition, based on. my review of emails from the WCPC Account produced pursuant to the Prior Cohen Account Warrants and Header Information, I have learned that Cohen has used the Account to send and receive emails from the Cohen Account, to commtmicate with thr-Account, and to send and receive emails from other email accounts about his political consulting business. Additionally, from my review of the Header Infonnation, it appears that since the November 13, 2017 search warrant on the Account, Cohen has continued to send and receive emails at the Account that appear liker to be relevant to the commission of the Subj ect Offenses. For example, emails obtained pursuant to the Prior Cohen Account Warrants, as well as the Header Information hare revealed. the following: a. On approximately eight occasions in August and September 2017, while Cohen, ?vere communicating about a term sheet for the Coho-taxi 13 Based on my review of emails ?'om the Account obtained pursuant to subpoena, I here learned that Cohen has used the account to communicate with numerous individuals with whom he does not enjoy an attorney-client privilege, including some of the individuals described below. See train 34 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 41 of 73 medallion uansaction, sea supra 1i 14(Ic), Cohen used the Account to send or receive emails fret-at the-Account. For instance, on or about August 22, 2017 ,-used tit-account to send an email to Sterling Employee-1 and copied Cohen on the email at the Account. Oaths same day, Ste?ing Employee-1 responded to-at tin-Account and Cohen at the Account. On or about August 22, 2017, Cohen also used the Account to send an email to Sterling Employeed. b. ?As noted above, 'on or aboutSeptemher 1, 201-7, Cohen-used-the Accotmt to send or receive eight emails with the - Account. c. Cohen used the Account to send and receive emails from individuals who work at companies with whom it appears Cohen has a political consulting agreement. For example, beginning in April 2017-??th same month when Cohen began receiving payments from see supra 16(d), ?(tn?Cohen used the Account to send and receive emails from ATri?eT employees. These emails contain, among other things, invoices from Cohen to for consulting work by Cohen. Sbnilarly, beginning in April EON?which is also the month Cohen began receiving payments from Novartis for consulting work, see supra 16(d), 17(d)? Cohen used the Account to send and receiVe emails from employees ofNovartis. These emails concern, among other things, invoices from Cohen and requests for Nevartis for Cohen?s assistance on an initiative relating to drug pricing. d. From my review ofthe Header Information, I have learned that Cohen-has continued to use the MIJGPC Account to send and receive emails ?om individuals who work at companies with whom it appears Cohen had a political consulting agreement, such as Novartis and For instance, on approximately six: occasions between November 28, 2017 and January 30, 2018, the Account was used to send and receive emails from accounts belonging to 3-5 transom Case Document 48-5 Filed 07/18/19 Page 42 of 73 individuals using @att.com email addresses. Similarly, on approximately seventeen occasions between December 1, 2017 and February 20, 2013, the Account was used to send and receive emails from accounts belonging to individuals using @novartisnom email addresses. Since November 15, 201 7, has also sent and received emails with individuals using the email domains @btalte, which I believe is the email domain used by employees Bank, see supra 16(d), 17(b), and @squirepb.com, which I believe is the email domain used by eifplojfees of the lavtr??mi'Squire Patton of which Cohen appears'to have a consulting relationship with, sea supra 16(e), 17(e). Accordingly, it appears that Cohen continues to use the WCPC Account to send and receive emails that will be relevant to whether he is maintaining a consulting business, what type of consulting work he is doing, and whether he is receiving money for that consulting work. 23. In addition to the foregoing; based on my review of the Pen Register Date, see more 9, it appears that since the date of the last search Warrant on the Cohen Account (in, November 13, 2017), Cohen has continued to use the Cohen Account to communicate with the - -3count, the -ltccount, and other email accounts that app ear likely to be relevant to the of the Subject Offenses described above. For example, the Pen Register Data has revealed the following: a. Emails sent by the Cohen Account to the-recount on or about December 13, 2017 at 3:26 December 21, 2017 at 9:35 December 22, 2017 at 4:32 January 3, 2013 at 3:01 a.n1., Jsmuary 3, 2013' at 2:56 and January 4, 2013 at 3:31 p.111. b. An email sent by the Cohen Account to the _Lccount on or about January 25, 2013 at 3:55 pan. 36 caasscis Case Document 48-5 Filed 07/18/19 Page 43 of 73 c. Emails from the Cohen Account to the email accouII?on or about December I, 201? at 2:14 December 29, 2017 at 10:20 13.11, January 2, 2018 at 3:52 January 2, 2018 at 5:44 and January 8, 2018 at 6:38 pm. Based upon my review of emails contained in the Cohen Account, Ihave learned that the- email account belongs to e?i'ey Getzel, Cohen?s accountant, through whom Cohen made misrepresentations to ?nancial institutions, as discussed above. - 'dj' Emails from me Cohen?eeount to email accounts belonging to Sterling employees;?- including Sterling Employee?1, on or about anuary 2.5, 2018 at 10:23 January 26, 2018 at 12:55 am, January 29, 2013 at5:30 January 29, 2013 at 3:29 January 30, 2018 at 6:44 p.111. ei An email sent ?om the Cohen Account to the email account on or about January 25, 2013 at 5:29 pan. As stated above, First Republic is the bank at which the Essential Consultants Account is held. f. Ntunerous emails sent from the Cohen Account to the email account including emails on or about December 4, 2017, at 2:17 pan. and auuary 29, 2018 at 5 :43 pm. Based upon the email address and domain name, as Well as my review of reports of interviews and documents re?ecting that Cohen?s taxi medallions were leased, and operated by I believe that the email address belongs to 29. Based on my review of records mamtained by Sterling, I know that Cohen used the Cohen Account to send and receive documents related to the Centaur-transaction. Based on my training and experience, Iknow that Goo gle allows users of e?mail accounts to easilyr save docmnents to ?le sharing and retention platforms such as Google Docs and Google Drive. I 37 amazon Case Document 48-5 Filed 07/18/19 Page 44 of 73 also lorovv, from my training and experience, that users of e?mail accounts often use instant messaging interfaces linked to their email accounts. Further, I have learned that the Providers maintain records of search and Web histories associated with email accounts and, based on my training and experience, users of c-ma? accounts use associated web search browsers associated with a subscriber?s account to research topics they are e?mailing about. Accordingly, there is probable cause to believe that content information associated with the Subject Accounts will also ??ccntain evidence related't? the Subject Bft'enses. 30. Thus, Iresp ectt?ully submit that there is probable cause to believe that emails and other content information from the Subject Accounts will contain evidence of Cohen?s efforts to sell his taxi medallions and the associated debt, and his nnsnepresentations and emissions to Sterling and Melrose in connection with these negotiations. Although Cohen appears to have communicated with?nimarily through the Cohen Account and - Account, Ilcnovv, based on my involvement in the investigation, that Cohen also used at least one other email account associated with his position at the Trump Organization. Thus, I respectfully submitthat there is probable cause to believe that emails and other content information from the _Account, 4-.Account and -Account since on or about October 1, 201 6?t11e approximate date of when Cohen?s efforts to sell his taxi medallions and the associated debt began?will re?ect communications with the Cohen Account, IVEIDCPC Account, and possibly one or more additional accounts used by Cohen, and probable cause to believe that such emails will constimte evidence of Cohen?s connoission of the Subject Offenses, including the extent to which Cohen did or did not inform other individuals involved in the conduct assesses awn s?sf ss ass emissions to ?nancial institutions. 38 amazon Case Document 48-5 Filed 07/18/19 Page 45 of 73 31. Temporal Limitation. This application seeks all emails and other requested content information speci?ed in Attachments B, C, and for the following periods: a. For the Cohen Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, . pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAU emails from the Cohen Ace cunt that were sent, created, or received before November 14, 2.017. This ap?u?arWso seeks other hitc?rfn?zition speci?ed above'associated withthe Cohen Account-- that was created between December 1, 2014 (the month when Cohen entered into the medallion loans with Sterling), and the date of the proposed warrant, inclusive, b. For the Account, this application seeks all emails sent, created, or recciVed between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, pursuant to aprior warrant, the SCO obtained and provided to the USAO emails from the Account that were sent, created, or received before November 14, 2017. I c. For the-account and ._Account, this application seeks emails and all other content information speci?ed above sent, created, or received between October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 2016 is the month in which Cohen began negotiating the taxi medallion sale with tl- d. For the -tccount, this application seeks emails and all other content information speci?ed above sent, created, or received between December 1, 2016, and the date of the proposed warrant, inclusive. As described above, December 2016 is the month in which. began representing tl- relation to the taxi medallion transaction. E. Evidence, Fruits and Instrumentalities 32. Based upon the foregoing, I respectfully submit there is probable cause to believe that information stored on Google?s servers associated with the Cohen Account will contain evidence, 39 02.23.2013 senior taxi medallions; Case Document 48-5 Filed 07/18/19 Page 46 of 73 fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section 11 ofAttachmentAto the proposed warrant for the Cohen Account and Account, including the following: a. records, documents, and other ?les necessary to establish the identity of the person(s)- who created or used the Cohen Account or Account. b. Communications, records, documents, and other ?les involving Sterling, Mclrose, o. Communications, records, documents, and other ?les involving a plan, proposal,'or agreement for Cohen and! or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tt_lttd/01? entities associated with him; I d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michaell?). Cohen dz Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen 35 Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) - including records that reveal the whereabouts of the person(s) who communicated with the Cohen Account andfor Account about any matters nelating to Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -md/or entities associated with him; f. Communications between the Cohen Account Account and Jeffrey Getzel relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; 40 02.23.2015 Case Document 48-5 Filed 07/18/19 Page 47 of 73 g. Communications, records, documents, and other ?les reflecting false representations to a?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Cohen Account and Account was accessed bins?edito detennine the'g'ec?aphic and chronological?context of account access-mac,- and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Cohen Account and WCPC Account owner?s intent as it relates to the Subject O?fenses under investigation. 33. Based upon the foregoing, I fin-that submit there is probable cause to believe that information stored on Google?s servers associated with the_ Account and- will contain evidence, fruits, and insnumentalities ofviolations of the Subject O??enses, including the following: a Communications, records, documents, and other ?les necessary to establish the identity of the .person(s) who created or used tl?_Account and- Account; b. Communications, records, documents, and other files involving a plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tt-andfor entities associated with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who 41 02.23.2013 .n-aua-vuu- Hm. was m?im-ma? Im?W-Wm?u Case Document 48-5 Filed 07/18/19 Page 48 of 73 communicated with the-account and Account about any matters relatingto any plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to - -tndi?or entities associated with him; d- Comntunica?ons between tit-Account and - Account and others, including employees or representatives of Sterling, Meh'os e, or other ?nancial institutionCis), ?nances; 3. Communications, records, documents, and other ?les re?ecting false representations to a?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a fmancial institution; the source of funds ?owing into an account; or the purpose or nation of any ?nancial transactions involving that ?nancial institution; f. Etddence indicating how and when the _Account and - -Account were accessed or used, to determine the geograpl?c and chronological content of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating thI-l Account and r_Account owners? intent as it relates to the Subject Offenses under investigation. 34. Based upon the foregoing, I ?lrther submit there is probable cause to believe that info1n1a?on stored on Oath?s servers associated with the-recount wiIl contain evidence, ?nite, and insh'umentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or usedthe-ccount; 42 canes-ms Case Document 48-5 Filed 07/18/19 Page 49 of 73 13. Communications, records, documents, and other ?les involving apian or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tu_and/cr entities associated with him; c. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the -Account_aboth any matters Elatii? to any plan or granted or agreement for Cohen and] or entities associated with- him to transfer any interest'in taxi medallions, and any associated debts or liabilities, t_ndfor entities associated with him; d. Communications between t-account and others, including employees or representatives of Sterling, Meirose, or other ?nancial institution(s), regarding Cohen?s ?nances; and I e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; ?ne nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. 111. Review of the Information Obtained Pursuant to the Warrant 35. Pursuant to 13 U.S.C. the presence of a law enforcement of?cer is not required for service of a search warrant issued under 2703, or for the collection or production of responsiVe records. Accordingly, the warrant requested herein will be transmitted to the Providers, which shall be directed to produce a digital copy of any responsive records to law enforcement personnel within 30 days from the date of service. Law enforcement personnel (including, in addi?on to law enforcement of?cers and agents, and depending on the nature of the ESI and the 43 02.28.2131}? Case Document 48-5 Filed 07/18/19 Page 50 of 73 status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will retain the records and review them for evidence, fruits, and instrumentalities of the Subject O?enses as speci?ed in Section of Attaclnnents A, and to the proposed wan-ant. 36. In conducting this review, law enforcement personnel may use various methods to "l?fe evidence, finit?s,Tndi?striimentalities of the Siihject Offenses, including" but not limited to undertaking a cursory inspection of all emails within the Subject Account. This method is analogous to cursorily inspecting all the ?les in a ?le cabinet in an office to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of ?les commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to test data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to lmovv in advance all of the unique words or phrases that investigative subjects will use in their communications, and consequently there are o?en many conununications in an account that are relevant to an investigation but that do notcontain any keywords that an agent is likely to search for- 37. .Because Cohen ant-Ire attorneys, the review of the content within the Subject Accounts will he conducted pursuant to established screening procedures to ensure that the lav'v enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attomeyuclient or otherapplicable 44 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 51 of 73 privilege. When appropriate, the procedures will include use of a designated ?filter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. IV. Request for Non-Disclosure and Sealing Order 38. The existence and scope of this ongoing criminal investigation are not publiclyr known. As a result, premature publicdisclosnre of this af?davit or the requested warrants could alert Cohen?that he is under hivesligation, causing him to destroy'evidenee, ?ee from prosecution, or otherwise seriously jeopardize the investigation. - In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an. investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as also set forth above, Cohen. uses computers and electronic communications in ?ntherance of his activity and thus could easily delete, or otherwise conceal such digital evidence from lawr enforcement were he to learn of the Government?s investigation. See 18 U. S. C. Cohen also appeals to have the ?nancial means that would facilitate his ?ight from prosecution. See 18 U.S.C. 2705(b)(2), (5). 39. Accordingly, there is reason to believe that, were the Providers to notify the subs crib er or others of the existence of the warrant, the investigation would be seriously jeopm?diZed. . Pursuant to 18 U.S.C. 2705(b), Itherefore respectfully,r request that the Court direct the Providers not to notify any person of the existence of the warrant for a period of 180 days from issuance, subject to extension upon application to the Court, if necessary. 40. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as 45 02.232013 Case Document 48-5 Filed 07/18/19 Page 52 of 73 need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. V. Conclusion 41. Based on the foregoing, I respectfu?y request that the Court issue the warrants sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 2703 (for?contents) and 2TO3 and otherinfortnation), and the - releVant provisions of Federal Rule of Criminal Procedure 41. United States Attomey?s Of?ce Southern District of New York Sworn to before me this 28th day of February, 2013 46 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 53 of 73 Exhibit Case Document 48-5 Filed 07/18/19 Page 54 of 73 tetrac- fies UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Accounts ngaileorn, . Maintained at Premises Controlled by Google, Inc, USAO Reference No. 201 81100127 SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Google, Inc. (?Provider?) United States Attoniey?s Office for the Southern District of New York and the Federal Bureau of Investigation (c oIIectiveljr, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent?if the United States Attomey?s Of?ce for the Southern District of New York, and pursuant to the" provisions of the I Stored Comunr'cations Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email and maintained at premises controlled by Google, Inc, contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the hirestigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. ?re Govermnent is required to some a copy of this Warrant and Order on the Provider within 7 days of the date of issuance. The Warrant and Order may he served via a Case Document 48-5 Filed 07/18/19 Page 55 of 73 electronic transmission or any other means. through which the Provider is capable of accepting service. 2. Non-Disclosure Order. Pursuant to 18 U.S.C. 2705(1)), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight ?orn prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence- of this Warrant and Order to the listed subscriber or to any- other person for a? period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, he ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Eml?lvl (I I 2,97 7'5 [i rs if I hate Issued Time Issued :v I if. -. I creases]; . 1 - manner? Chief Southern Disaster ili?lb??i 02.23.2013 .7-- Case Document 48-5 Filed 07/18/19 Page 56 of 73 Email Search Attachment A 1. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the i?Pro?videri?li, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@gmail.com' (the ?Subj ect Account?) for the time period referenced below. A law enforcement of?cer will. servethis warrant by transmitting ittda email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. 11. Information to he Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accotmt, including all message content, attachments, and header . information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, receired, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book All address book, contact list, or similar information associated with the Subject Accomtt. c. Jabscriber- and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, nsername, address, telephone Mum?u. . Case Document 48-5 Filed 07/18/19 Page 57 of 73 number, altemate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including an}r 1P logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence Withthe subscriber or others associated with the Subject Account, including complaints, inquiries,- or other contacts with support- services and records of actions taken, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history audior web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, files. maintained on Google Drive-and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. Preserved or beam records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 13 U.S.C. 27936) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and - agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?nite, and instrumentalities of violations of 13 U.S.C. 371 (conspiracy to commit offense or to de?'aud 2 masses V.) un . Case Document 48-5 Filed 07/18/19 Page 58 of 73 the United States), 1005 (false bank entries); 1014 (false statements to a?nancial institution), 1343 (Wire trend), and 1344 (bank fraud), including the following: a. records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; I b. Communications, records, documents, and other ?les inrolving Sterling National Bank, Melrose Credit Union, andfor taxi medallions; c. Communications, records, documents,- and other ?les involving a plan, proposal; on?- agreement for Michael D. Cohen and/or entities associated with him to transfer an}r interest inta'si medallions, and any associated debts or liabilities, to others, including-.ndfor entities associated with him; Commrmicaticns, records, documents, and other ?les imrolving Essential Consultants, LLC or Michael D. Cohen :35 Associates, including those which indicate the nature and purpose of paments made to'or from Essential Consultants or Michael D. Cohen 32: Associates; e. Commtmications, records, documents, and other ?les necessary to establish the identitjr of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LLC, or about any plari or proposal oragreernent for Mohael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including 1- and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating? to Michael D. Cohen?s bank accounts, taxes, debts, andJ'or ?nances; Communications, records, documents, and other files re?ecting false representations to a fmancial institution with relation to the intended purpose of an account or loan at that ?nancial 02,23 .2013 Case Document 48-5 Filed 07/18/19 Page 59 of 73 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the 1311113036 or nature of any ?nancial transactions involving that ?nancial institution; 11. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. I Evidence indicatingthe'Suhject Account-owner?s intent as it relates-to-the-Subject Offenses under investigation. W. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedtu'es designed to collect evidence in a manner reasonably designed to protect. anyattomey-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ?'orn the hivestig'ative team, in order to address potential privileges. {12.2 3.1018 Case Document 48-5 Filed 07/18/19 Page 60 of 73 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain Wow, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated 1with the email accounts ar_ (the ?Subject Accounts?) for the time period between-Qctober l, 2016 and the dateof this warrant, inclusive. A law enforcement of?cer can serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel 1still review the information for items falling witlnn the I categories speci?ed in Section below. 11. Information to be Produced by the Provider To the extent within the Provider's possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: 3. Email cement. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, usernanie, address, telephone Case Document 48-5 Filed 07/18/19 Page 61 of 73 number, alternate email addresses, registration JP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Accounts, including any logs or other records of session times and durations. e. Customer correspondence. All conespondencc with the subscrib or or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services ?and records of actions'taken: - f. Search History. All search history andfor web history associated with the Subject Accounts. g. Associated content All Google Docs, ?les maintained on Googlc Drive, and instant messages or Gchats associated with the Subj ectAccounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. ?27D3(i) or otherwise. Review of Information by the Government Law enforceth personnel (who may?include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the in this hivestigation, and outside technical, experts under government control). are authorized to review the records produced by the Provider in order to locate any and inshumentalitics of violations of 18 U.S.C. 3?1 (conspiracy to commit offense or to defraud the United States), 1005 (false bani: entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 01.28.2013 Case Document 48-5 Filed 07/18/19 Page 62 of 73 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest intaxi medallions, and any associated debts or liabilities, to -and/or entities associated with him; I c- Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the personCs) who communicated-with the Subject Accounts-about any matters relating to any planer-proposal or agreement for Melisa] D. Cohen andlor entities associated with him to transfer any interest in taxi medallions, and anyr associated debts or liabilities, to _1ndfor entities associated with him; d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to detennine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account unmet; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.232013 Case Document 48-5 Filed 07/18/19 Page 63 of 73 IV. Re?ew Protocols Review of the items deseribed in this Attachment shall he conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect an}; atto1*ney?client or other applicable prisilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and ap art from the investigative team, in order to address potential privileges. 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 64 of 73 remap STATES DISTRICT COURT SOUTHERN DISTRICT or NEW YORK - the Matter of a Warrant for All a Content and Other Information 5 Associated with the Email Accounts ?agmaircom _@grnail.com, and r, Maintained at Premises Controlled by Google, Inc., USAO Reference No. 2018110012? WARRANT AND NON-DISCLOSURE ORDER- TO: Googlc, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -:1f the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the Stored Comniunications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accounts -@gmail.com, -@gmail.com, and maintained at premises controlled by Google, Inc, contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachments A and hereto, for subsequent review by law enforcement personnel as authorized in Sections Ill and IV of Attachments A and B. The Government is required to serve a cop}r of this Warrant and Order on the Provider within 14 days of the date ofissuance. The Warrant and Order may he served via Case Document 48-5 Filed 07/18/19 Page 65 of 73 electronic transmission or any other means through which the Provider is capable of accepting service. 2. oil?Disclosure Order. Pursuant to 13 U.S.C. 270503), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber 01' to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Waii'ant and Order on the Provider; provide copies of the Af?davit or Wairant and Order as need be to personnel assisting the Goverrnnent in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosrn'e obligations in any prosecutions related to this matter. Dated:New York, New York We 5" {219/ Date issued Time Issued 7 MOI/l?sa?m HONORABLE HENRY shirts/mu UNITED ST MAGISTRATE JUDGE Southern District of New Yerk 20 I 113325 Case Document 48-5 Filed 07/18/19 Page 66 of 73 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?; headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@gmai1.com (the ?Subject Account?) for the time period referenced below. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider isdirecgd to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated With the Subject Account: it. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and February 28, 2018, inclusive. I b. Address book information. All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment iry?hrmatz'on. All subscriber and payment information regarding the Subject Account, including but not limited to name, user-name, address, telephone Case Document 48-5 Filed 07/18/19 Page 67 of 73 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and February 28, 2018, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and records of actions taken, limited to items sent, received, or created between December 1, 201:5r and February 28, 2018, inclusive. f. Search History. All search history andfor web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and February 28, 2018, inclusive. g. Associated content. All Google Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and February 28, 2013, inclusive. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 13 U.S.C. 27036) or otherwise. Review of Information by the Government Law enforcement persmnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 68 of 73 and of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, andfor taxi medallions; c. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and an),r associated debts or liabilities, to others, including to-andz'or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen :95 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen 6r Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen andz?or entities associated with him to transfer an},r interest in taxi medallions, and any associated debts or liabilities, to others, including tt_andjor entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, andfor ?nances; 201103.23 Case Document 48-5 Filed 07/18/19 Page 69 of 73 g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the sotu'ce of funds ?owing into an account; or the pu1pcse or nature of any f'mancial transactions involving that ?nancial institution; 11. Evidence indicating how and when the Subj ect Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney- client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 70 of 73 Email Search Attachment 1. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email and (the ?Subject Accounts?) for the time period between October 1,20l? and February 28, 2018, inclusive. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Emoii content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 201103.25 Case Document 48-5 Filed 07/18/19 Page 71 of 73 c. Subscriber and pmmiear information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Tiamaca'onotr records. All transactional records associated with the Subject Accounts, including any IP logs or other records of session times and durations. e. Customer correspondence. All con'espondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services and records of actions taken. f. Search History. All search history andfor web history associated with the Subject Accounts. g. Associated content. All Google Docs, ?les maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in reaponse to a preservation request issued pursuant to 13 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attomeys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under govenunent control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 201103.25 Case Document 48-5 Filed 07/18/19 Page 72 of 73 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen and! or entities associated with him to transfer any interest in taxi with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) - who communicated with the Subject Accounts about any matters relating to any plan or proposal or agreement for Michael D. Cohen andf or entities associated him to transfer any interest in taxi medallions, and any associated debts or liabilities, to_and/or entities associated with him; Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Co hen?s ?nances; e. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?otiving into an account; or the purpose or nature of any fmancial transactions involving that ?nancial institution; 11133.25 Case Document 48-5 Filed 07/18/19 Page 73 of 73 f. Evidence indicating how and when the Subject Accounts vvas accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedtu'es designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team," separate and apart from the investigative team, in order to address potential privileges. 201 1(3325