Case Document 48-6 Filed 07/18/19 Page 1 of 80 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York Case No. In the Matter of the Search of (Brie?y describe the property to be searched or identify the person by name and address) Three Electronic Devices, See Attachment A SEARCH AND SEIZURE WARRANT An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identijjz the person or describe the property to be searched and give its location): Three Electronic Devices, See AttachmentA The person or property to be searched, described above, is believed to conceal (identijy the person or describe the property to be seized): See Attachment A I ?nd that the affidavit(s), or any recorded testimony, establish probable cause to 583.1 ch and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before by", a. i i (not to exceed 1 4 days) CI in the daytime 6:any time in the day or night as I find. reast?jnable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant mid a?1ecr=1ptfor the property taken to the person from whom or from whose premises, the property was taken, or leave the cepy and receipt at the place Where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Coart. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court 694% USMJInitials if I ?nd that immediate noti?cation may have an adverse result listed iIi18 C. i? 2705?i(except tor delay of trial), and authorize the of?cer executing this warrant to delay notice to the epe?rs?on who, or Whose preperty will be searched 01? 861Zed (check the appropriate box) Elfor 30 days (not to exceed 30) Duntil, the facts justifying, the later specr?c date oI Date and time issued: 4/ :3 ?were?? rife, . 5/ Judge? City and state: New York, NY Hon. Henrv B. Pitman, U.S. Maoistrate Judoe Printed name and title .Case Document 48-6 Filed 07/18/19 Page 2 of 80 AC) 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant - to the Court. Date: Executing o?icer ?3 Signature Printed name and title Case Document 48-6 Filed 07/18/19 Page 3 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?1 A black and red USB drive with a white label that says ?Tracking 180208140208.? b. Subject Device-2: A silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device?3: A white DVDL labelled ?2-28-18 Cohen SW Returns Google 311mm,? . . ., II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U. S. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 0. Evidence of communications with American Media, Inc., David Pecker, and/ or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. Case Document 48-6 Filed 07/18/19 Page 4 of 80 e. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape. f. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. g. Evidence indicating Michael Cohen?s intent With respect to the Subject Offense, including Whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Case Document 48-6 Filed 07/18/19 . Page 5 of 80 A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of In the Matter of the Search of (Brie?y describe the property to be searched or identi?t the person by name and address) Three Electronic Devices, See Attachment A APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I .have reason to believe that on the following person or property (identi?t the person or describe the ., . . 7 . 7 - See Attachment?A (rg located in the Southern District of New York there is now concealed (idehtz'?t the person or describe the property to be seized): PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): ?ievidence of a crime; contraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O??ertse Description 52 USC 30116(a)(1)(A), 30109 Illegai campaign contributions The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. IEI Continued on the attached sheet. [if Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 18 USC. 3103a, the basis of which is set forth on the attached sheet. Ir?l' . 't I?tinted name .ahd titleSworn to before me and signed in my presenceDate: [49/ ?r 3557/57 . W/?efi?rew 'j I gt? Judge - 5 ,City and state: 4/ hi5?? Rafa/4} M?ot/ Vet/37L Hon Henry Pitrnan, US gistiate Judge Prmted r?tarme and title Case Document 48-6 Filed'O7/18/19 Page6of80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for Three Electronic Devices, USAO Reference No Agent Af?davit in Support of 2018R00127 5 Application for a Search Warrant SOUTHERN DISTRICT OF NEW YORK) ss.: Special Agent - of the United States Attorney?s Of?ce for the Southern District of New duly sworn, deposes and says: I. Introduction A. Af?ant 1. I have been a Special Agent with the USAO since August 2016. Ipreviously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions, and have been involved in investigations involving violations of campaign ?nances laws and regulations. I also have training and experience executing search warrants, including those authorizing the search of email accounts and electronic devices. 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the electronic devices speci?ed below (the ?fSubject Devices?) for the items and information described in Attachment A. This af?davit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis of 2 Case Document 48-6 Filed 07/18/19 Page 7 of 80 electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. Prior Warrants and the Subject Devices 3. The USAO and the Federal Bureau of Investigation have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 4. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the. account-@gmailcom (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17?mj-00503, is attached as Exhibit A (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account?). This warrant, which is numbered, l7?mj-005 70, is attached as Exhibit (the ?Cohen iCloud Warrant?). Case Document 48-6 Filed 07/18/19 Page 8 of 80 c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017. This warrant, which is numbered 17?mj?00855, is attached as Exhibit (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account-_the ?Cohen Account?) sent or received between the opening of the Cohen Account1 and November 13, 2017. This warrant, which is numbered 17-mj?00854, is attached as Exhibit (the ?First Cohen Warrant?). 5. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.2 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 6. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the. date of the warrant. - 2 The SCO had previously provided a subset of this non?privileged content on or about February 2, 2018. Case Document 48-6 Filed 07/18/19 Page 9 of 80 received between November 14, 2017 and February 28, 2018. These warrants, which are both numbered 18 Mag. 1696, are attached as Exhibits (the ?Third Cohen Gmail Warrant?) and (the ?Second Cohen Warrant?), reSpectively. The content produced pursuant to these warrants is being reviewed for privilege by an SDNY ?lter team. 7. The search warrants described above are referred to collectively herein as the ?Prior Warrants.? 8. The returns of the Prior Warrants are presently contained on three electronic devices. In particular: a. Subject Device-J The non?privileged emails and content returned in response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen Warrant are contained on Subject Device?1, which is particularly described as a black and red USB drive with a white label that says ?Tracking 180208140208.? b. ?Subject Device-2: The non?privileged content returned in response to the Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device-3: The content returned in response to the Third Cohen Gmail Warrant and the Second Cohen Warrant is contained on Subject Device?3, which is particularly described as one white DVD labelled ?2-28?18 Cohen SW Returns Google and 9. The Subject Devices are presently located in the Southern District of New York. C. The Subject Offenses 10. The af?davits in support of the Prior Warrants describe evidence of several different courses of conduct by Cohen, including, among other things, false statements to financial institutions relating to the purpose of an account he opened in the name of Essential Consultants 5 Case Document 48-6 Filed 07/18/19 Page 10 of 80 LLC and the nature of funds ?owing into that account; false statements and fraudulent omissions by Cohen in connection with this attempt to re?nance his debts with certain financial institutions; and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without having registered as a foreign agent. The Prior Warrants accordingly de?ne the evidence to be seized by reference to subject offenses and speci?c categories of information related to these courses of conduct. The subject offenses in the Prior Warrants are summarized as follows: EM Subject Offenses in Prior Warrant3 A First Cohen Gmail ,18 U.S.C. 371 (conspiracyto defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act Second Cohen Gmail 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen Warrant 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen iCloud Warrant 18 U.S.C. 1014 (false statement to ?nancial institution), 1344 (bank fraud), 195 6 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 etseq. (FARA) Third Cohen Gmail 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial. institution), 1343 (Wire fraud), 1344 (bank fraud) Second Cohen 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud) 1 1. Based on my participation in this investigation, including my review of documents obtained pursuant to subpoena and court order, my conversations with witnesses and review of reports of conversations with witnesses, and my review of publicly available information, I have 3 On or about February 28, 2018, the USAO sought and obtained a Rule 41 warrant, authorizing it to expand its search of the email returns for the warrants attached as Exhibits (the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and First Cohen Warrant) for additional offenses not authorized in the original warrants for those accounts. The below chart therefore lists both the subject offenses listed in the original warrants for these accounts and the subject offenses? authorized in the February 28, 2018 warrant. Case Document 48-6 Filed 07/18/19 Page 11 of 80 learned of evidence of an additional Subject Offense'committed by Cohen, described below, which was not listed in the Prior Warrants.4 12. I am therefore requesting authority to expand the search of the returns of the Prior Warrants, as contained on the Subject Devices, for evidence related to the additional Subject Offense. As set forth below, in addition to the categories of evidence already described in the Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?Subject II. Probable Cause Regarding the Subject Offense 13. As set forth above, the USAO and the FBI have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. During the course of this investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal violation of the campaign ?nance laws by making an excessive in?kind contribution to the presidential election campaign of then?candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford from making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 4 As set forth below, I base this application in part on my review of emails and text messages obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of the emails or texts returned pursuant to the applicable Prior Warrant. 5 The Prior Warrants describe categories of information that likely encompass evidence of the additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking eXplicit authorization to search the Subject Devices for evidence of the Subject Offense. 7 Case Document 48-6 Filed 07/18/19 Page 12 of 80 14. From my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip websites heDirty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDz?rtycom, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11,2011, Keith-Davidson, who. identi?ed himself I I as Clifford?s attorney, sent a cease and desist letter to heDirty. com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 15. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an of?cial title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. Case Document 48-6 Filed 07/18/19 Page 13 of 80 16. On or about October 7, 2016, The Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things-I regret and words released today on this more than a decade old video are one of them. 'Anyone who knows me knows these words don?t re?ect who I am. I said it. I was wrong and I apologize.?- Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 17. Based on-my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. AsCohen summarized in a 2018 email obtained pursuant to the Cohen Email warrants: ?In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? 18. From my review of telephone toll records6 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access 6 My attribution of certain telephone numbers to certain individuals as described in this affidavit is based on my review of the vCard (virtual contact ?le) obtained from Cohen?s telephone pursuant to the iCloud Warrant. Case Document 48-6 Filed 07/18/19 Page 14 of 80 Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard of American Media, Inc. the publisher of the National Enquirer,7 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. Based on the timing of these calls, and the content of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford from going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.8 Based on the toll records that the USAO has obtained to date, I believe that this was the first call Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. 7 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 8 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Specifically, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three~way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not speci?cally asked about this three?way call. 10 Case Document 48-6 Filed 07/18/19 Page 15 of 80 c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, "the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57pm., Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3 :31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entityI formed a week ago. Whenever you wake, please call my cell.? 11 Case Document 48-6 Filed 07/18/19 Page 16 of 80 f. The following day, on October 10, 2016,. at 10:58 a.n1., Howard sent a text message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM and they?re confirmed to proceed with the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen a text message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keit Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then?candidate Trump.9 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson app ear to have signed a ?side letter agreemen that stated it was an exhibit to a ?con?dential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the 9 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson. 12 Case Document 48-6 "Filed 07/18/19 Page 17 of 80 document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen this partially?signed ?side letter agreemen in order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on October 10, 2016. 19. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. On the morning of October 13, 2016, at 8 :54 Cohen sent Pecker a text message that stated: need to talk to you.? At 9:06 Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned . that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. b. At 9:23 Cohen sent an email that stated ?call me? to a banker at First Republic Bank (?First Republic Employee?2?). The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution ConsultantS? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee?2 and told him, in sum and 13 Case Document 48-6 Filed 07/18/19 Page 18 of 80 substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks written out of the account. Later that day, another employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. 0. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he filed paperwork to dissolve Resolution Consultants LLC. 20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Specifically, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreemen Cohen did not complete the transaction.10 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. 10' Due to the partially covert nature of the investigation to this date, the Government has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 14 Case Document 48-6 Filed 07/18/19 Page 19 of 80 b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreemen appear to have touched off a ?urry of communications about the settlement agreement and whether Clifford would go public. Speci?cally: i. At 4:43 pm, Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 pm, Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s first call after he spoke with Davidson. iv. At 5:25 pm, Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent. Based on my involvement in this investigation, I understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6 :49 pm, Cohen called Howard and they spoke for nearly four minutes. 0. The following day, on October 18, 2016, heSmokingGun.c0m, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which. alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 15 Case DocUment 48-6 Filed 07/18/19 Page about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review 0f toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating all me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 Cohen and Davidson spoke for about eight minutes. At 7:11 they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. 0. At approximately 9:04 than thirty minutes after speaking with Trump? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the ?ling receipt? and then, in the second email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted First Republic Employee?2 and told him, in sum . and substance, that he decided not to open anaccount in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee?2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee?2 called, a 16 _Case Document 48-6 Filed 07/18/19 Page 21 off 80 preferred banker at that branch (?First Republic Employee?1?), to assiSt Cohen. At 11:00 am, First Republic Employee~1 called Cohen. I know from my participation in an interview with First Republic Employee-1, that around the time of the call he went to Cohen?s office in Trump Tower? on the same ?oor as the Trump Organization?Hand went through account opening questions, including know your customer questions, with Cohen. In response to a series of know?your? customer questions about the purpose of the account?the answers to which First Republic Employee-1 entered into a form?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Account?) was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the Essential Consultants Account. Following the transfer, at approximately 4: 15 pm. on October 26, 2016, First Republic Employee?2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 Cohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. 17 Case Document 48-6 Filed 07/18/19 Page 22 of 80 and connected for about thirty seconds. At 7:06 pm, Cohen called Peckerxagain and they spoke for nearly thirteen minutes. At 7:24 Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. Itold him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 Howard told Cohen by text message to ?check your Gmail for email from my private accoun In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Con?rming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same?day FedEx to Michael, - Change of agreement to re?ect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 22. On October 27, 2016, Cohen made a payment to Davidson of $130,000?with the ?mds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 am, Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? 18 Case Document 48-6 Filed 07/18/19 Page 23 of 80 b. At approximately 10:01 am, according to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account?? which had been funded a day prior from Cohen?s home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 am, Davidson responded to Cohen?s email from 9:47 stating: con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff . personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff? signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. air?? d. At 10:50 am, First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent'and providing him with the wire number. 23. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: a. On October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 pm, Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized docs on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 ?Keith [Davidson] says 19 Case Document 48-6 Filed 07/18/19 Page 24 of 80 we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 Cohen spoke to Hicks for three minutes. c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive apackage. (1. Based on my review of court ?lings that became public in 2018, I have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?confidential information pertaining to [Dennison]? in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlemen On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery confirmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization 20 Case Document 48-6 Filed 07/18/19 Page 25 of 80 address. On the same day, at approximately 6:14 Davidson sent Cohen an email with an audio ?le attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled and was a ?ve-minute recording of Davidson interviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 however, Cohen received a return call from Conway, which lasted for approximately six minutes. 24. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard, Pecker and Davidson. For instance, at approximately 4:49 Cohen sent Howard a' text message with a screenshot of an email forwarded to him by another'Trump Organization 21 Case Document 48-6 Filed 07/18/19 Page 26 of 80 lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 pm, using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She definitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8:55 pm, Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and aplausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a plausible position that she is rightfully employed as a columnist? was ?a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. c. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, Ibelieve Cohen was referring to Trump when he stated ?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could 22 Case Document 48-6 Filed 07/18/19 Page 27 of 80 publish its article if ?everyone denies.? Howard responded, ?Because there is the payment from AMI. It looks suspicious at best.? d. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for ?ve minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appearsto have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 pm, the Wall Street Journal article was published online, Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingll It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now' or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above?referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker spoke to Trump. 23 Case Document 48-6 Filed 07/18/19 Page 28 of 80 25. On or about November 8, 2016, Trump won the election for President of the United States. i 26. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime Special counsel and protector, I took it upon myself to match the offer and keep the story from breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn ?t mean that it doesn ?t create harm and damage. I could not allow this to occur. I negotiated a non-disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time ..the 20] 1 story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. 24 Case Document 48-6 Filed 07/18/19 Page 29 of 80 b. On or about February 13, 2018, Cohen said in a statement to The New ark Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow-up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. c. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? d. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 27. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed Violations of the Subject Offense by making an in-kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford 25 Case Document 48-6 Filed 07/18/19 Page 30 of 80 existed since 2011. In addition, the communication records set forth above make evident that Cohen communicated with members of the Trump campaign about his negotiation with Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. 28. Therefore, there is probable cause to believe that a search of the Subject Devices will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. c. Evidence of communications with American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. e. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape. f. Evidence relating to Cohen?s knowledge of the campaign finance laws, campaign contribution reporting requirements, and campaign contribution limits. 26 Case Document 48-6 Filed 07/18/19 Page 31 of 80 g. Evidence indicating Michael Cohen?s intent with respect to the Subject Offense, including whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Procedures for Searching ESI A. Review of E81 29. Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys forthe government, attorney support staff, agency personnel assisting. the government in this investigation, interpreters, and outside vendors or technical experts under government control) will review the E81 contained on the Subject Devices for information responsive to the warrant. 30. In conducting this review, law enforcement personnel may use various methods to locate evidence, fruits, and instrumentalities of the Subject Offense, including but not limited to undertaking a cursory inspection of all emails, texts or files contained on the Subject Devices. This method is analogous to cursorily inspecting all the files in a ?le cabinet in an of?ce to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of files commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and 27 Case Document 48-6 Filed 07/18/19 Page 32 of 80 consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. IV. Conclusion and Ancillary Provisions 31. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 32. In light of the con?dential nature of the c0ntinuing investigation, and for the reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent, USAO Sworn to before me on 7th day of April, 20,13} i . f} t" HON. HBNR PITMAN UNITED 1? A I ES MAGISTRATE JUDGE ., ., - v. 28 Case Document 48-6 Filed 07/18/19 Page 33 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?J A black and red USB drive with a white label that says ?Trackin 180208140208.? . b. Subject Device~22 A silver DVD with 'a white label that reads ?Cohen 2018.03.07.? 0. Subject Device?3: A white DVD labelled ?2?28?18 Cohen SW Returns Google and . . . . .. II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or: agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 0. Evidence of communications with American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and! or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. Case Document 48-6 Filed 07/18/19 Page 34 of 80 6. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape. I f. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. g. Evidence indicating Michael Cohen?s intent with respect to the Subject Offense, including whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Case Document 48-6 Filed 07/18/19 Page 35 of 80 Exhibit A Case Document 48-6 Filed 07/18/19 Page 36 of 80 r: 4?23 JUL 22 an UNITED STATES DISTRICT COURT mm 3 Wm for the Edd District of Columbia A0 93 (Rev. 11MB) Search and Seizure Warrant In the Matter of the Search of 0503 (Brie?y describethepropertyto be searched . 633821 17 ml 0 Ell Beryl A or identr?z the person by name and address) AS?lgFled TO ASSOCIATED WITH THE EMAIL pat? 7? and Warrant Dese'nptInn: 393m - SEARCH AND SEIZURE WARRANT To Any? authorizedlawenforcementofti oer - An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the . Northern District of California (identtfir the person or describe the properlyI to be searched and give its location): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (tdentt?; the person or describe the property to be seized): See Attachment 8. YOU ARE COMMANDED to execute this warrant on or before 1, 2017 1 {not to exceed 14 days) [ill in the daytime 6:00 am. to 10:00 pm. Cl at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hond?eryi A. Howell United States Magistrate Judge) El Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) Cl for days (not to exceed 30) [3 until, the facts justi?ling, the later speci?c date of Date and time issued: [145% .23? 453i?? Judge' signature City and state: Washington, DC. Hon. Howell Chief S. DIstrIct Judge Printed name and title um Case Document 48-6 Filed 07/18/19 Page 37 of 80 A0 93 (Rev I l/l3) Search and Seizure Warrant (Page 2) Return Case No:: I 7 Date and [in ?e warrant executed: Copy of warrant and inventory left With: inventory t?ade in the presence of Inventory of the property taken andnenie of any per?o'nts) seiiedt Delta" 55,; 1 Letter? {569067 119190501? 2017071q~ gap A ?For MC 'pwcfevf?lm? JUL 21? 23!? Clerk, U.S. an Bankruptcy Courts 7 . Certi?cation declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. A Date: 7/36/wa . Primed name and Inn: Case Document 48-6 Filed 07/18/19 Page 38 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmai1.com that is stored at premises owned, maintained, controlled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 48-6 Filed 07/18/19 Page 39 of 80 I. ATTACHMENT Information to be disclosed by? Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each accoUnt or?identi?er listed in AttachmentA: 7 a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log?in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log?in IP addresses associated with .session times and dates, aceount status, alternative e?mail, addresses provided Case Document 48-6 Filed 07/18/19 Page 40 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; g. All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; i i. All cookies, including third-party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and . 7 R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 101.4 (false statements to a ?nancial institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 95] (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 et seq, involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 48-6 Filed 07/18/19 Page 41 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or forej gnprinnipals: f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s. state of mind as it relates to the crimes under investigation; h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and it The identity of any records that help reveal the whereabduts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 48-6 Filed 07/18/19 Page 42 of 80 Exhibit Case Document 48-6 Filed 07/18/19. Page 43 of 80 A0 93 (Rev. 11/13) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia 1n the Matter of the Search of (Brie?y describe the property to? be searched or idenrpji the by name and address} INFORMATION ASSOCIATED WITH THE EMAIL ACCOUNT COM 0332: Assigned To: Chref Judge Howell, Beryl A Assign Date: 1111312017 Desc?riptien: Search and Seizure Warrant SEARCH AND smug}; WARRANT -- I An application by a federal iaW enforcement officer or an attorney for the government requests the sear-ch of the following ?perSOH Or property located in the Northern - District of Califbrnia the person or describe the property re be searched arid give its location): See Attachment A. I ?nd'that-the af?davitCs), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that search will reveal (ideht?r?) the person or describe'rhe property to be seized): See Attachment E3. YOU ARE COMMANDED to execute this warrant on or before November 20. 2017 (not to exceed 1:4 days) in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good caUSe has been established. Unless delayed notice is authorized below, you must give a copy of the remnant and a receipt for the property? taken to the person from?whoms or from Whose premises,- the propelty Was taken, Or leave the copy and receipt at the place where the property was, taken. The of?cer executing this Warrant, or an officm' preSent during the execution of the warrant, tnust prepare an invieritory as required by law and return this warrant and inventory to Hon. Beryl A. Howell A (Urrima? States Magistl are Judge) CI Pursuant to 18 3103a(b), i ?nd that immediate noti?cation may have an adVelse result listed at 18 C. 2-705 (except foi delay of trial), and authorize the af?ne executing this warrant to delay notice to the person Who, or whose property will be searched or seized (check the box) far days {not {a exceedSO) until, the facts justifying,_ the later speci?c date of Date-vandtirneissued; 3143/ 259/ ?it [egg/ff Jadge? Signaarre City and state: Washington, Dc Hon. Beryl a. Hewett, chier'us. District Judge Printed name and ri?e Case Document 48-6 Filed 07/18/19 Page 44 of 80 A0 93 (Elev. 11/13) Search and Seizure Warrant (Page 2) 3.493%. Return Case No.: Date and time warrant executEd: Copy 'of Warrant and inventory left with: Inventmy made in the presence of: Inventory of the prbp'e'rty taken and flame of any person(s) Seized: Certi?eatibn designated judge. Date: I declare Under penalty of perjury that this inventory is correct and was l?etufned along With the original warrant to; the Eat?euti?g o?icer? ?3 Signature ,Prfn'te?dnapie and title- Case Document 48-6 Filed 07/18/19 Page 45 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mai] Account -@gmail.com that is stored at. premises owned, maintained, or operated by Google, ecompany headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 48-6 Filed 07/18/19 Page 46 of 80 1. ATTACHMENT Information to be disclosed by Google To the extent that the information described in Attachment A is within the possession, custody, 01' control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted "but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment a. The contents of an emails associated vulth the account, including stored orpreserved copies of emails Sent to and from the account, draft entails, the source and destination addresses associated with each email, the date and time at which each email Was sent, and the sizeand length of each email; All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account Was created, the length of service, the iP address used to register the account, log-in IP addresses associated with schiOn times and dates, actiount status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and s?ourCe of payment (including any credit ?o?r'bank account number); The types of serviCe utilized; All records .or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les;- All, records pertaining to communications betWeen the Provider and any person regarding the account, including Contacts with support services. and records of actions taken; and other identi?ers, records of Session times and durations, the date on which the a'ccount'wes created, th'e length of Service, the types of serviCe utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided during registratidn, all other user names associated With the aecount, all account- names associated with the 'subScriber, methods of cennecting; Case Document 48-6 Filed 07/18/19 Page 47 of 80 All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a,login IP address or broWser cookie with the accounts; All cookies, including thirdnparty cookies, associated with the user; All records that are associated with the machine cookies associated with'th?e user; and All telephone or instrument numbers associated with the Account (including MAC II. Numbers Mobile Equipment Identifier Mobile Identi?cation Numbers Subscriber Identity Module-s Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section [that constitutes evidence, contraband, fruits! and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial institution), is use. 1343 (wire fraud), 18- 1344 (bank fraud), and 18 use. 1956 (money laundering), as well as 18 11.8.0. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 611 at S?tq., involving Michael Dean Cohen and occurring on or after June 1, 2015, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: _aa records, documents, and other ?les involving Essential Consultants, Communications, record's, documents, and other? ?les that false repreSentations to. a' ?nancial institution with relation to intended the purpOSe of an account Or lean at that ?nancial institution; the nature of-any business or entity associated withvan account a ?nancial institutibn; thesource of funds ?owing into 'an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document "48-6 Filed 07/18/19 Page 48 of 80 Records of any funds or- bene?ts received by or offered to MichaelDean Cohen by, or on behalf of, any foreign government, foreign of?oial's, foreign entities, foreign persons, or foreign principals; Communications, records, documents5 and other ?les that reveal efforts by Michael Dean Cohen to conduct activities On behalf of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; Evidence indicating how and when the account was accessed or used, to determine 11. user and events relating to the crimes under investigation and to the account owner; Evidence indicating the account owneris "state of mind as it relates to the crimes- under investigation; The identity of the person(s) who created ?or used the account,'including records that help reveal the whereabouts-of such personCs); and i The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals. Review Protocols, Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other Operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,?se atate and a the investivative team, in order to address otenti'al rivile es. a Case Document 48-6 Filed 07/18/19 Page 49 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 50 of 80 Jammy?1 rm 9 um. A0 .93 (Rev. [1113) Search and Seizure Warrant UNITED STATES DISTRICT COURT - for the Disitrict of Columbia in the Matter of the Search of (Brie?y describe the. property to he: searched Case: 'o?r iderr?tp?lthEperson by name and address) Assigned T0 Chief Judge Beryl ASSOCIATED WITH THE ACCOUNT Date I 11/131'2017 '5 STORED AT THE Description: Search and Seizure Warrant PREMISES OF 1&1 INTERNET iNc SEARCH AND SEIZUREWARRANT of?cer .77 .. .A 7 An application 'by? a federal law enforcement of?cer or an attorney for the government requests the search pf the following person or property located in the Northern District of California (id?rr'rigfiz the person 0r describe Thepreperry to be searched and give ifs jeearfon)?: See Attachment A. I find that the af?davitCS), or any recorded testimony, establish probable cause to search and seize the person or property deSC-ribed above, and that such search will reveal (remap: tfiepersbn er derc?rrbe theproperzy-?m be seized): See Attachment 13. YOU ARE COMMANDED to execute this Walrant on or before November'ZO. 2017 (no: to exceed 14 days) Elf in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good cause has been established. Unless delayed notice is-authorize?d below. you must give a copy of the warrant and a receipt for the property taken to the person from whom, Or from" whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer ertecnting this Warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant'and inventory to Hon. Beryl A. Howell . . . rldagr'strme Judge) El Pursuant to 18 U. 7S. 3103510)), I ?nd that immediate noti?cation inay have an adverse result listed in 18 .C. 2705 (except for delay of trial) and authorize the of?cer executing this warrant to delay notice to the person who or WhoSe property be seal ched (check the appi opqule box) for days (170110 exceed 30) until, the facts justifying, the later Speci?c date of Date. and timei's?sued: [fit/ll sz?fiff?m ef?gy?? 11/? fW Judge 5' sigrratur City and state: Washington, DC . Hon. Beryl A. Hewet? ?cmer'ue. District Judge Printed name and ri?e Case Document 48-6 Filed 07/18/19 Page 51 of 80 w- A0 93 (Rev. Seatoh and Seizure Warrant (PageZ) Return "Case No.: Date and time warrant executed: Copy ofwam?ant and inventory left with: Inventory made in'the presence of -: Inventory of the property taken and name of any lpei?SonCs) seized: CErii??a?On A designated judge. Date: I declare, under penalty of pel?jury that this inventory is correct and Was returned along with the original warrantto the Executing of?cer sigizqittre I P?n?r?ed name mid ri?e Case Document 48-6 Filed 07/18/19 Page 52 of 80 PIS-N .7 ATTACHMENT A This warrant applies to information associated with the. email -_hat is stored at premises owned, maintained, controlled, or operated ?by 1&1 Internet: Inc. an electronic communication arid/or remote computinglsetvice provider headquartered in Sunnyvale, California. Case Document 48-6 Filed 07/18/19 Page 53 of 80 I. ATTACHMENT Information to be disclosed by 1&1 To the extent that the information described in Attachment A is Within the possession, custody, or control ofthe 1&1 (hereinafter ?the Provider"), regardless of whether such infennation is stored, held 0r maintained inside or outside of the United States, and including any ?einails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: Va" The aerator? ?reserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was-sent, and the size and length of'each? email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephonenumbers and other identi?ers, records of session times and durations,the date on which the account was created, the length of serviCe, the IP- address used to register the account, log?in IP addresses associated'with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); Thetypes of-servi?ce utilized;- All records or other information stored at any time by an individual using the account, including. address books, contact and buddy lists, calendar data, pictures, and ?les; All rec01?ds pertaining to, communications between the Provider and any person regarding the account, including centac?ts with ?fservices and records of actions taken; and other identi?ers, records of ~ses:Sion'ti1nes and durations, the-date on which the account?was created, the length of service, the types of service utilized, the IP?address used: to register the account, log-in IP addresses associated with Session times and dates, account status, alternative carnal} addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; Case Document 48-6 Filed 07/18/19 Page 54 of 80 ?as m, i All search history or web history; All records indicating the services available to subscribers of the accounts; All usernarnes (associated with or sharing a lo gin IP address or browsercookie with the accounts; All Cookies, including tliird~party cookies, associated with the user; All records that are associated with, the machine cookies associated with the user; and All telephone or instrument numbers associated with. the Account (including MAC II. Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All informatiOn described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C-. 1014 (false statements to a financial institution), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1344 (bank fraud), and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 at 5351., involving Michael Dean Cohen, including, for each account or identifier listed. on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other tiles-that) false representations to a ?nancial institution with relation to intended the purpose of an amount (Dr loan at that, financial institution; the nature of any business or entity associated with an I aecount a financial institution; the'sour'ce of funds flowing into anaCcount; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document 48-6 Filed 07/18/19 Page 55 of 80 Q's, Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to cenduct activities on behalf'of, for the bene?t of, or at the directien "of any foreign government, foreign of?cials, foreign entities, foreign persons, 0r foreign principals; Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to the account owner;- Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; - The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such and The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities. conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals, Review Protocols Review of th'eitems described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorneyaclient and other operative privileges, When appropriate, the proCedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address- p?otential privileges. Case Document 48-6 Filed 07/18/19 Page 56 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 57 of 80 A0 93 (Rev. Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter ofthe Search of Case: Nani?00570 Assigned To Howell, Beryl A. Assign.? Date 8172017 i {Brie?y describe the property to be searched ASSOCIATED WITH THE APPLE ID i I Descriptioni Search and Seizure Warrant or idemy?ji the person by name and address) THAT is STORED AT PREMISES CONTROLLED BY APPLE, SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal iaw enforcement of?cer or an attorney for the government requests the search of the following person or property located in the District of . California {he person or describe the preperry to be searched and girls its locan'bn)! See Attachment A. i ?nd that the or any recorded testimony, establish probable cause to search and seiZe the person or property described abOVe, and that such search will reveai (identi?r the person or describe (be properly (a be seized}: See Attachment YOU ARE COMMANDED to execute this warrant on or before . . August 2:1. 2017 (not to exceed days) in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. . The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to 7 Hon. Beryi A. Howell ?(Unir??b? States Magi'srrare Judge) [3 Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate notification may have an adverse result listed in 18 USS. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property. will be searched or seized (check (he apprapriale box} for days (not to exceed 30) until, the facts justifying, the later speci?c date of Date andtime issued: @f 733 .. @yfj? m?g? . Jndge ?s signalure City and state: Washington, DC Hon. Beryl A. Howell, Chief US. District Judge 7: Primed name and Iii/er tee Case Document 48-6 Filed 07/18/19 Page 58 of 80 A0 93 (Rev. llt13) Search and Seizure Warrant (Page 2) Return base Noni Date and tinie warrant executed-:- Copy of 'warrantand inventory le?r'With: Inventory made in of Inventory of the property taken and name oteny person(s) seized: 'Eer?ti?eetie?n- Date: I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Executing o?icer's signature Printed name and title Case Document 48-6 Filed 07/18/19 Page 59 of 80 ATTACHMENT A. This warrant applies to information ?associated with the Apple ID that is stored at premises owned, maintained, controlled, or operated by Apple, Inc. (?Apple?), a company headquartered at 1 In?nite Loop, Cupertino, CA 95014. Case Document 48-6 Filed 07/18/19 Page 60 of 80 1. ATTACHMENT Information to be disclosed by Apple, Inc. To the extent that theinformation described in Attachment A is within the possession, custody, or control of Apple, lnc. (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside ofthe United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session timesand durations, the date on which the account was created, the length of service, the 1P address used to register the account, log-in lP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); The types of service utilized; All recordsior other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the 1P address used to register the account, log?in lP addresses associated with session times and dates, account status, alternative e-_mail addresses provided Case Document 48-6 Filed 07/18/19 Page 61 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; All records indicating the services available to subscribers of the accounts; h. All usernames associated with or sharing a login IP address or browser cookie with the accounts; i. All cookies, including third?party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identification Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital?Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities .. Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a financial institution), [8 U.S.C. 1344 (bank fraud), 18 U.S.C. 1956 (money laundering), 18 U.S.C. ?95 1? (acting as an unregistered foreign agent), and 22 U.S.C. 611 at seq. (Foreign Agents Registration Act), involving Michael Dean Cohen and occurring on or afterJanuary I, 2016, including, for each account or identifier listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 48-6 Filed 07/18/19 Page 62 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign?principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; I h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and i. The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 48-6 Filed 07/18/19 Page 63 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 64 of 80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated With the Email Accounts @grnailcom, . _@gmail.com, and Maintained at Premises Controlled by Google, Inc., USAO Reference No. 201 SROO 127 SEARCH WARRANT AND ON-DISCLOSURE ORDER . TO: Goo gle, Inc. (?Provider?) United States Attorney?s Office for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -of the United States Attorney?s O?ce for the Southern District of New York, and pursuant to the? provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable cause to believe the email accounts -@gmail.com, -@grnail.com, and g. maintained at premises controlled by Google, Inc., contain evidence, fruits, and instrumentalities of crime, all as specified in Attachments A and hereto. Accordingly, . the Provider is hereby directed to provide to the Investigative Agencies, Within 7 days of the date of service of this Warrant and Order, the records specified in Section II of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider Within 7 days of the date of issuance. The Warrant and Order may be served via Case Document 48-6 Filed 07/18/19 Page 65 of 80 electronic transmission or any other means through which the Provider is capable of accepting service. a 2. Non~Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the eXistencepf scrib er ~orrtov any otherp'erson'vforap erio d7 of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice, 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon Which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 4? 1f 11.: a; SI my; I 4 fl" Sid-3Bate Issued Time Issued isomers Gasman Chiernited States'Magistra?Le Judge Southern District oi New York 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 66 of 80 4 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account _@gmail.com' (the ?Subject Account?) for the time period referenced below. Arlaw~enforcement~ email: or?another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section l1 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section 111 below. I II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: I a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header . information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book information. All address book, contact list, or similar information associated with the Subject Account. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/19 Page 67 of 80 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated and records of actions taken, limited to items sent, received, or created-between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history and/or web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, tiles, maintained on Google Drive,and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. Preserved or backup records. Any preserved or baclcup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 use. 2793(1) or otherwise. 111. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, .attomeys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?uits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 68 of 80 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (Wire fraud), and 1344 (bank fraud), including the following: a. Con?ununications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Account; I b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; I d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to'or from Essential Consultants or Michael D. Cohen Associates, e. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated With the Subject Account about any matters relating to Essential Consultants, LLC, . or about any plan or proposal oragreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _1Ild/ or entities associated with him; i Communications between the Subject Account and Jersey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and] or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations .to a financial institution with relation to the intended purpose of an account or loan at that financial 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 69 of 80 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under mvestigation and to the account owner; and 1. b?v1dence indicating th?SnbjEtiAccount?owner?s intent as i?elatesvtovthevSubj'e?ctr" Offenses under investigation. IV. Re?ew Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect anyattorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ??orn the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 70 of 80 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 i Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s ossession, custod or control associated with the email accounts -gmail.com and?(the ?Subject Accounts?) for the time A law enforcement of?cer will serve this warrant by transmitting it Via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section Ii below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Email content. All emails sent to or from, stored in dra? form in, or otherwise associated with the Subject Accounts, sincluding all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/19 Page 71 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, type-s of services utilized, means and source of payment, and payment history, d. Transactional records. All transactional records associated with the Subject Accounts, including any IP logs or other records ofsession times and durations. e. I Customer correspondence. A11 correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services f. Search History. All search history and/or web history associated with the Subject Accounts. g. Associated content. All Goo gle Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup re cords. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside te chnical, experts under government control). are authorized to review the records produced by the Provider in order to locate any evidence,fruits, and instrumentalities of violations of .1 8 US . C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire ?aud), and 1344 (bank including the following: a. Communications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 02.23.2013 Case Document 48-6' Filed 07/18/19 Page 72 of 80 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to and/or entities associated with him; A c. Cormnunications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who oreproposaleor agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to _and/ or entities associated d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that financial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 73 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 74 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 75 of 80 is are res UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account maintained at Premises Controlled by 1 85 1 Internet, Inc., USAO Reference NoInternet, Inc. (?Provider?) United States Attorney?s O?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?), 1. Warrant. Upon an af?davit of Special Agents-of the United States Attorney?s Office for the Southern District of New York, and pursuantto the provisions of the Stored Communications Act, 18 U.S.C. and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account-?naintained at premises controlled by 1 85 1 Internet, Inc, contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto; Accordingly, the Provider is hereby directed to provide to the hlvestigative Agencies, Within 7 days. of the date of service of this Warrant and Order, the records speCi?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as . authorized in Sections and IV of Attachment D. The Government is required to serve a copy of this Warrant and Order on the Provider Within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document48?6 Filed 07/18/19 Page 76 of 80 2. Oil-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date. of this Order, subject to extension upon application to the Court if for the purpose of receiving legal adviCe. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the War-rant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure . obligations in any prosecutions related to this matter. Dated: New York, New York Date-Issued Time Issued United States 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 77 of 80 Email SearchAttachment I. Subject Account and Execution of Warrant This warrant is directed to 1 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087, and applies to all content and other information within the Provider? possession, custody, or control associated with the email account -- (the ?Subject Account?) for the time period between November 14, 2017 -. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement I officer an electronic copy of the information speci?ed in SectiOn 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To?the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account; 3.. Email content. All emails Sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment information. All subscriber ?and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/191 Page 78 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations. 6. Customer correspondence. All correspondence withthe subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services andrecords?ofa'cti'onstaken. f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation reuuest issued pursuant to 18 U.S.C. 2703(f) or otherwise. Ill Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under goverrnnent control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 USC. 371 (conspiracy to commit offense or to de?aud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other files'necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ??les' involving Sterling National Bank, 'Melrose Credit Union, and/or taxi medallions; I 0. Communications, records, documents, and other files involving a plan, proposal, or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 2 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 79 of 80 medallions, and any associated debts or liabilities, to others, including to -i'nd/ or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen 85 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. The identity of anylperson(s) including records that reveal the whereabouts of the Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with'relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 80 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney~client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart fromthe investigative team, in order to address potential privileges. 02.28.2018